4.3

CVE-2007-2400

Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ iPhone OS Version <= 1.0
   Apple ≫ macOS X
   Microsoft ≫ Windows Vista
   Microsoft ≫ Windows Xp
Apple ≫ Safari Version3.0 Editionwindows
   Apple ≫ macOS X
   Microsoft ≫ Windows Vista
   Microsoft ≫ Windows Xp
Apple ≫ Safari Version3.0.1 Editionwindows
   Apple ≫ macOS X
   Microsoft ≫ Windows Vista
   Microsoft ≫ Windows Xp
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.624
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.