4.3

CVE-2009-1684

Exploit

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next loaded document.

Data is provided by the National Vulnerability Database (NVD)
Apple ≫ Safari Editionmac Version <= 4.0_beta
Apple ≫ Safari Version0.8 Editionmac
Apple ≫ Safari Version0.9 Editionmac
Apple ≫ Safari Version1.0 Editionmac
Apple ≫ Safari Version1.0.3 Editionmac
Apple ≫ Safari Version1.1 Editionmac
Apple ≫ Safari Version1.2 Editionmac
Apple ≫ Safari Version1.3 Editionmac
Apple ≫ Safari Version1.3.1 Editionmac
Apple ≫ Safari Version1.3.2 Editionmac
Apple ≫ Safari Version2.0 Editionmac
Apple ≫ Safari Version2.0.2 Editionmac
Apple ≫ Safari Version2.0.4 Editionmac
Apple ≫ Safari Version3.0 Editionmac
Apple ≫ Safari Version3.0.2 Update- Editionmac
Apple ≫ Safari Version3.0.3 Editionmac
Apple ≫ Safari Version3.0.4 Editionmac
Apple ≫ Safari Version3.1 Editionmac
Apple ≫ Safari Version3.1.1 Editionmac
Apple ≫ Safari Version3.1.2 Editionmac
Apple ≫ Safari Version3.2.1 Editionmac
Apple ≫ Safari Version3.2.3 Editionmac
Apple ≫ Safari Editionwindows Version <= 3.2.3
Apple ≫ Safari Version3.0 Editionwindows
Apple ≫ Safari Version3.0.1 Editionwindows
Apple ≫ Safari Version3.0.2 Editionwindows
Apple ≫ Safari Version3.0.3 Editionwindows
Apple ≫ Safari Version3.0.4 Editionwindows
Apple ≫ Safari Version3.1 Editionwindows
Apple ≫ Safari Version3.1.1 Editionwindows
Apple ≫ Safari Version3.1.2 Editionwindows
Apple ≫ Safari Version3.2 Update- Editionwindows
Apple ≫ Safari Version3.2.1 Editionwindows
Apple ≫ Safari Version3.2.2 Editionwindows
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.96% 0.827
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://support.apple.com/kb/HT3613
Patch
Vendor Advisory