CVSS: 4.3EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1009
https://notcve.org/view.php?id=CVE-2008-1009
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary JavaScript by modifying the history object. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebCore, como se usa en Apple Safari antes de 3.1, permite a atacantes remotos inyectar Javascript de su elección modificando el objeto history. • http://docs.info.apple.com/article.html?artnum=307563 http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html http://secunia.com/advisories/29393 http://www.securityfocus.com/bid/28290 http://www.securityfocus.com/bid/28337 http://www.securitytracker.com/id?1019653 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0920/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41322 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1007
https://notcve.org/view.php?id=CVE-2008-1007
WebCore, as used in Apple Safari before 3.1, does not enforce the frame navigation policy for Java applets, which allows remote attackers to conduct cross-site scripting (XSS) attacks. WebCore, como es usado en Apple Safari versiones anteriores a 3.1, no aplica la política de navegación de tramas para applets de Java, que permite a los atacantes remotos conducir ataques de tipo cross-site scripting (XSS). • http://docs.info.apple.com/article.html?artnum=307563 http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html http://secunia.com/advisories/29393 http://www.securityfocus.com/bid/28290 http://www.securityfocus.com/bid/28335 http://www.securitytracker.com/id?1019653 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0920/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41324 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1005
https://notcve.org/view.php?id=CVE-2008-1005
WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password. Webcore, usado en Apple Safaru anterior a 3.1, no oculta adecuadamente el campo de contraseña cuando una conversión inversa es usada con el método Kotoeri, puede permitir que atacantes que se encuentren cerca del ordenador lean la contraseña. • http://docs.info.apple.com/article.html?artnum=307563 http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html http://secunia.com/advisories/29393 http://www.securityfocus.com/bid/28290 http://www.securityfocus.com/bid/28326 http://www.securitytracker.com/id?1019656 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0920/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41329 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1003
https://notcve.org/view.php?id=CVE-2008-1003
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to sites that set the document.domain property or have the same document.domain. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebCore, usado en Apple Safari anterior a 3.1, permite a atacantes remotos inyectar secuencias de comandos web o html de su elección a través de vectores desconocidos en relación a sitios que han establecido la propiedad document.domain o que tienen el mismo document.domain. • http://docs.info.apple.com/article.html?artnum=307563 http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html http://secunia.com/advisories/29393 http://www.securityfocus.com/bid/28290 http://www.securityfocus.com/bid/28330 http://www.securitytracker.com/id?1019653 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0920/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41334 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 16EXPL: 0CVE-2008-1004
https://notcve.org/view.php?id=CVE-2008-1004
Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebCore, como el utilizado en Apple Safari anterior a 3.1, permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de vectores desconocidos relacionados con Web Inspector. • http://docs.info.apple.com/article.html?artnum=307563 http://lists.apple.com/archives/security-announce/2008/Mar/msg00000.html http://secunia.com/advisories/29393 http://www.securityfocus.com/bid/28290 http://www.securityfocus.com/bid/28347 http://www.securitytracker.com/id?1019653 http://www.us-cert.gov/cas/techalerts/TA08-079A.html http://www.vupen.com/english/advisories/2008/0920/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41331 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •