CVSS: 7.2EPSS: 0%CPEs: 12EXPL: 0CVE-2009-2027
https://notcve.org/view.php?id=CVE-2009-2027
The Installer in Apple Safari before 4.0 on Windows allows local users to gain privileges by checking a box that specifies an immediate launch of the application after installation, related to an unspecified compression method. El instalador en Apple Safari anterior a v4.0 en Windows permite a usuarios locales obtener privilegios marcando un cuadro (checkbox) que especifica que aplicación ejecutar después de la instalación, en relación con un método de compresión sin especificar. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://support.apple.com/kb/HT3613 http://www.securityfocus.com/bid/35339 https://exchange.xforce.ibmcloud.com/vulnerabilities/51290 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1713
https://notcve.org/view.php?id=CVE-2009-1713
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors. La funcionalidad XSLT en WebKit en Apple Safari anteriores a v4.0 no implementa adecuadamente la función "document", lo que permite a atacantes remotos leer (1) ficheros locales arbitrariamente (2) ficheros de diferentes zonas de seguridad a través de vectores inespecíficos. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/54975 http://secunia.com/advisories/35379 http://secunia.com/advisories/43068 http://support.apple.com/kb/HT3613 http://www.securityfocus.com/bid/35260 http://www.ubuntu.com/usn/USN-857-1 http://www.vupen.com/english/advisories/2009/1522 http://www.vupen.com/english/advisories/2011/0212 https://exchange&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 3%CPEs: 6EXPL: 5CVE-2009-1699 – WebKit - XML External Entity Information Disclosure
https://notcve.org/view.php?id=CVE-2009-1699
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack." La implementación de la hoja de estilo XSL en WebKit en Apple Safari anterior a v4.0 no maneja adecuadamente las entidades externas XML, lo cual permite a atacantes remotos leer ficheros arbitrarios a través de un DTD elaborado, como lo demuestra un fichero: ///etc/passwd URL en una declaración de entidad, relacionado con un "ataque XXE". • https://www.exploit-db.com/exploits/33034 http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/54972 http://scary.beasts.org/security/CESA-2009-006.html http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html http://secunia.com/advisories/35379 http://secunia.com/ad • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.0EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1696
https://notcve.org/view.php?id=CVE-2009-1696
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session. WebKit en Apple Safari anterior a v4.0 emplea números aleatorios predecibles en las aplicaciones JavaScript, esto simplifica a los servidores Web remotos seguir el comportamiento de un usuario de Safari en una sesión. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/55027 http://secunia.com/advisories/35379 http://secunia.com/advisories/43068 http://support.apple.com/kb/HT3613 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35260 http://www.vupen.com/english/advisories/2009/1522 http& • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 1CVE-2009-1702
https://notcve.org/view.php?id=CVE-2009-1702
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebKit en Apple Safari anteriores a v4.0 permite a atacantes remotos inyectar secuencias de comandos web i HTML a traves de vctores relacionados con la gestion inadecuada de los objetos "Location" y "History". • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/54993 http://secunia.com/advisories/35379 http://secunia.com/advisories/43068 http://securitytracker.com/id?1022344 http://support.apple.com/kb/HT3613 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35260 http://www.sec • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •