CVSS: 5.0EPSS: 0%CPEs: 96EXPL: 0CVE-2011-0160
https://notcve.org/view.php?id=CVE-2011-0160
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header. WebKit, tal como se utiliza en Apple Safari antes de v5.0.4 e iOS antes de v4.3, no controla correctamente las redirecciones en conjunto con la autenticación básica HTTP, lo que podría permitir a los servidores Web remotos capturar las credenciales de registro de la cabecera HTTP de autorización. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 http://www.securitytracker.com/id?1025182 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 1%CPEs: 96EXPL: 0CVE-2011-0163
https://notcve.org/view.php?id=CVE-2011-0163
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remote attackers to cause a denial of service (resource unavailability) via a crafted web site that conducts a cache-poisoning attack. WebKit, tal como se utiliza en Apple Safari v5.0.4 e iOS antes de v4.3, no controla correctamente "los recursos almacenados en caché" sin especificar, lo que permite a atacantes remotos provocar una denegación de servicio (falta de disponibilidad de recursos) a través de un sitio web manipulad que lleva a cabo un ataque de envenenamiento de caché. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 http://www.securitytracker.com/id?1025182 https://exchange.xforce.ibmcloud.com/vulnerabilities/66001 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 96EXPL: 0CVE-2011-0161
https://notcve.org/view.php?id=CVE-2011-0161
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site. WebKit, como se usa en Apple Safari anterior a v5.0.4 e iOS antes de v4.3, no maneja adecuada mente el acceso a Attr.style, lo que permite a atacantes remotos evitar la Same Origin Policy e inyectar secuencias de hojas de estilo en cascada (CSS) a través de un sitio web manipulado. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 http://www.securityfocus.com/bid/46814 http://www.securitytracker.com/id?1025182 https://exchange.xforce.ibmcloud.com/vulnerabilities/66000 • CWE-20: Improper Input Validation CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.8EPSS: 0%CPEs: 65EXPL: 0CVE-2011-0166
https://notcve.org/view.php?id=CVE-2011-0166
The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778. La funcionalidad arrastrar y soltar de HTML5 de WebKit en Apple Safari anterior a v5.0.4, permite a atacantes remotos asistidos por el usuario evitar la Same Origin Policy y obtener información sensible a través de vectores relacionados con el contenido arrastrado NOTA: esto puede superponerse con CVE-2011-0778. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4566 http://support.apple.com/kb/HT4999 http://www.securityfocus.com/bid/46811 http://www.securitytracker.com/id?1025183 https://exchange.xforce.ibmcloud.com/vulnerabilities/66004 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 65EXPL: 1CVE-2011-0167 – WebKit 1.2.x - Local Webpage Cross Domain Information Disclosure
https://notcve.org/view.php?id=CVE-2011-0167
The windows functionality in WebKit in Apple Safari before 5.0.4 allows remote attackers to bypass the Same Origin Policy, and force the upload of arbitrary local files from a client computer, via a crafted web site. La funcionalidad de ventanas en WebKit de Apple Safari anterior a v5.0.4, permite a atacantes remotos evitar la Same Origin Policy, y forzar la carga de ficheros locales desde un equipo cliente, a través de un sitio web manipulado. • https://www.exploit-db.com/exploits/35434 http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4566 http://www.securityfocus.com/bid/46816 http://www.securitytracker.com/id?1025183 • CWE-264: Permissions, Privileges, and Access Controls •