CVSS: 9.3EPSS: 3%CPEs: 34EXPL: 1CVE-2009-1712
https://notcve.org/view.php?id=CVE-2009-1712
WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element. WebKit de Apple Safari anterior a v4.0 no previene la carga remota de los applets de Java locales, esto permite a atacante remotos ejecutar código de su elección, aumentar sus privilegios u obtener información sensible a través de un APPLET o elemento OBJECT. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/55022 http://secunia.com/advisories/35379 http://secunia.com/advisories/36790 http://secunia.com/advisories/37746 http://secunia.com/advisories/43068 http://securitytracker.com/id?1022345 http://support.apple.com/kb/HT3613 http://www.debian.org/security/2009/dsa-1950 http://www.securityfocus.com/bid/35260 http: • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1718
https://notcve.org/view.php?id=CVE-2009-1718
WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page. Webkit de Apple Safari anterior a v4.0, permite a atacantes remotos con la ayuda del usuario obtener información sensible a través de vectores que utilizan eventos drag -arrastrar- y el arrastre de contenidos a través de una página Web manipulada. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/35379 http://secunia.com/advisories/43068 http://support.apple.com/kb/HT3613 http://www.securityfocus.com/bid/35260 http://www.vupen.com/english/advisories/2009/1522 http://www.vupen.com/english/advisories/2011/0212 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1695
https://notcve.org/view.php?id=CVE-2009-1695
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving access to frame contents after completion of a page transition. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebKit de Apple Safari anterior a v4.0, permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de vectores que incluyen acceso a contenidos de marco después de finalizar la transición de una página. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/54991 http://secunia.com/advisories/35379 http://secunia.com/advisories/37746 http://secunia.com/advisories/43068 http://securitytracker.com/id?1022344 http://support.apple.com/kb/HT3613 http://support.apple.com/kb/HT3639 http://www.debian. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 3%CPEs: 34EXPL: 1CVE-2009-1708
https://notcve.org/view.php?id=CVE-2009-1708
Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call. Apple Safari anterior a v4.0 no previene las llamadas al manejador URL open-help-anchor por los sitios web, lo que permite a atacantes remotos abrir archivos de ayuda locales, ejecutar código de su elección u obtener información sensible a través de una llamada manipulada. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://osvdb.org/55011 http://secunia.com/advisories/35379 http://securitytracker.com/id?1022345 http://support.apple.com/kb/HT3613 http://www.securityfocus.com/bid/35260 http://www.securityfocus.com/bid/35351 http://www.vupen.com/english/advisories/2009/1522 •
CVSS: 4.3EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1681
https://notcve.org/view.php?id=CVE-2009-1681
WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document. WebKit en Apple Safari anteriores a v4.0 no previene que páginas web sean cargadas en contenidos de terceros dentro de un "submarco", lo que permite a los atacantes remotos evitar la Política Original Misma y conduce a un ataque de "clickjacking" a través de un documento HTML manipulado. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://osvdb.org/54981 http://secunia.com/advisories/35379 http://secunia.com/advisories/37746 http://secunia.com/advisories/43068 http://support.apple.com/kb/HT3613 http://support.apple.com/kb/HT3639 http://www.debian.org/security/2009/dsa-1950 http:/&#x •