CVE-2009-0162

EPSS 1.71%
Veröffentlicht 13.05.2009 15:30:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows remote attackers to inject arbitrary web script or HTML via a crafted feed: URL.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 16

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apple ≫ Safari Version <= 3.2.2

   Apple ≫ macOS X Version10.5.0
   Apple ≫ macOS X Version10.5.1
   Apple ≫ macOS X Version10.5.2
   Apple ≫ macOS X Version10.5.3
   Apple ≫ macOS X Version10.5.4
   Apple ≫ macOS X Version10.5.5
   Apple ≫ macOS X Version10.5.6
   Apple ≫ macOS X Server Version10.5.0
   Apple ≫ macOS X Server Version10.5.1
   Apple ≫ macOS X Server Version10.5.2
   Apple ≫ macOS X Server Version10.5.3
   Apple ≫ macOS X Server Version10.5.4
   Apple ≫ macOS X Server Version10.5.6
   Microsoft ≫ Windows Vista
   Microsoft ≫ Windows Xp

Apple ≫ Safari Version0.8

Apple ≫ Safari Version0.9

Apple ≫ Safari Version1.0

Apple ≫ Safari Version1.0 Updatebeta

Apple ≫ Safari Version1.0 Updatebeta2

Apple ≫ Safari Version1.0.0

Apple ≫ Safari Version1.0.0b1

Apple ≫ Safari Version1.0.0b2

Apple ≫ Safari Version1.0.1

Apple ≫ Safari Version1.0.2

Apple ≫ Safari Version1.0.3

Apple ≫ Safari Version1.0.3 Update85.8

Apple ≫ Safari Version1.0.3 Update85.8.1

Apple ≫ Safari Version1.1

Apple ≫ Safari Version1.1.0

Apple ≫ Safari Version1.1.1

Apple ≫ Safari Version1.2

Apple ≫ Safari Version1.2.0

Apple ≫ Safari Version1.2.1

Apple ≫ Safari Version1.2.2

Apple ≫ Safari Version1.2.3

Apple ≫ Safari Version1.2.4

Apple ≫ Safari Version1.2.5

Apple ≫ Safari Version1.3

Apple ≫ Safari Version1.3.0

Apple ≫ Safari Version1.3.1

Apple ≫ Safari Version1.3.2

Apple ≫ Safari Version1.3.2 Update312.5

Apple ≫ Safari Version1.3.2 Update312.6

Apple ≫ Safari Version2

Apple ≫ Safari Version2.0

Apple ≫ Safari Version2.0.0

Apple ≫ Safari Version2.0.1

Apple ≫ Safari Version2.0.2

Apple ≫ Safari Version2.0.3

Apple ≫ Safari Version2.0.3 Update417.8

Apple ≫ Safari Version2.0.3 Update417.9

Apple ≫ Safari Version2.0.3 Update417.9.2

Apple ≫ Safari Version2.0.4

Apple ≫ Safari Version3

Apple ≫ Safari Version3.0

Apple ≫ Safari Version3.0.0

Apple ≫ Safari Version3.0.1

Apple ≫ Safari Version3.0.2

Apple ≫ Safari Version3.0.3

Apple ≫ Safari Version3.0.4

Apple ≫ Safari Version3.1

Apple ≫ Safari Version3.1.0

Apple ≫ Safari Version3.1.1

Apple ≫ Safari Version3.1.2

Apple ≫ Safari Version3.2

Apple ≫ Safari Version3.2.0

Apple ≫ Safari Version3.2.1

Apple ≫ Safari Version4.0 Updatebeta

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.71%	0.817

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Patch

Vendor Advisory

http://secunia.com/advisories/35074

http://support.apple.com/kb/HT3549

Patch

Vendor Advisory

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

US Government Resource

http://www.vupen.com/english/advisories/2009/1297

http://lists.apple.com/archives/security-announce/2009/May/msg00000.html

Patch