var-200803-0230
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via a frame that calls a method instance in another frame. Apple Safari is prone to 12 security vulnerabilities. Attackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. These issues affect versions prior to Apple Safari 3.1 running on Apple Mac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista. NOTE: This BID is being retired. An attacker may leverage this issue to access frame methods in another domain. This may help the attacker steal potentially sensitive information and launch other attacks. NOTE: This vulnerability was previously covered in BID 28290 (Apple Safari Prior to 3.1 Multiple Security Vulnerabilities), but has been given its own record to better document the issue. Safari is the WEB browser bundled with the Apple family operating system by default. If a user is tricked into visiting a malicious web page, sensitive information will be leaked. ----------------------------------------------------------------------
Secunia Network Software Inspector 2.0 (NSI) - Public Beta
4 days left of beta period.
The 1st generation of the Secunia Network Software Inspector (NSI) has been available for corporate users for almost 1 year and its been a tremendous success.
The 2nd generation Secunia NSI is built on the same technology as the award winning Secunia PSI, which has already been downloaded and installed on more than 400,000 computers world wide.
For more information: SA29393
SOLUTION: Apply updated packages via the yum utility ("yum update WebKit").
Note: Updated packages for midori and kazehakase have also been issued, which have been rebuilt against the new WebKit library. ----------------------------------------------------------------------
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched.
Download and test it today: https://psi.secunia.com/
Read more about this new version: https://psi.secunia.com/?page=changelog
TITLE: Apple Safari Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA29393
VERIFY ADVISORY: http://secunia.com/advisories/29393/
CRITICAL: Highly critical
IMPACT: Security Bypass, Cross Site Scripting, Exposure of sensitive information, System access
WHERE:
From remote
SOFTWARE: Safari 3.x http://secunia.com/product/17989/ Safari 2.x http://secunia.com/product/5289/
DESCRIPTION: Some vulnerabilities have been reported in Safari, which can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, or to compromise a vulnerable system.
1) An error in the processing of "javascript:" URLs can be exploited to execute arbitrary HTML and script code in context of another site via a specially crafted web page.
2) An error exists the handling of web pages that have explicitly set the document.domain property. This can be exploited to conduct cross-site scripting attacks in sites that set the document.domain property or between HTTP and HTTPS sites with the same document.domain.
3) An error in Web Inspector can be exploited to inject script code that will run in other domains and can read the user's file system when a specially crafted page is inspected.
4) A security issue exists with the Kotoeri input method, which can result in exposing the password field on the display when reverse conversion is requested.
5) An error within the handling of the "window.open()" function can be used to change the security context of a web page to the caller's context. This can be exploited to execute arbitrary script code in the user's security context via a specially crafted web page.
6) The frame navigation policy is not enforced for Java applets. This can be exploited to conduct cross-site scripting attacks using java and to gain escalated privileges by enticing a user to open a specially crafted web page.
7) An unspecified error in the handling of the document.domain property can be exploited to conduct cross-site scripting attacks when a user visits a specially crafted web page.
8) An error exists in the handling of the history object. This can be exploited to inject javascript code that will run in the context of other frames.
9) A boundary error exists in the handling of javascript regular expressions, which can be exploited to cause a buffer overflow via a specially crafted web page.
Successful exploitation allows execution of arbitrary code.
10) An error in WebKit allows method instances from one frame to be called in the context of another frame. This can be exploited to conduct cross-site scripting attacks.
SOLUTION: Update to version 3.1.
PROVIDED AND/OR DISCOVERED BY: 1) Robert Swiecki of Google Information Security Team 2, 3, 5, 6) Adam Barth and Collin Jackson of Stanford University 10) Eric Seidel of the WebKit Open Source Project, and Tavis Ormandy and Will Drewry of Google Security Team
ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307563
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200803-0230",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "2.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "0.9"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "1.3.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "0.8"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "2.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "version"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "3.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.4"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3"
},
{
"model": "safari",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "3.1"
}
],
"sources": [
{
"db": "BID",
"id": "28290"
},
{
"db": "BID",
"id": "28342"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Robert Swiecki robert@swiecki.netAdam BarthCollin Jackson collinj@cs.stanford.eduEric SeidelTavis Ormandy taviso@gentoo.orgWill Drewry wad@google.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
}
],
"trust": 0.6
},
"cve": "CVE-2008-1011",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2008-1011",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-31136",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-1011",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2008-1011",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200803-308",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-31136",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31136"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via a frame that calls a method instance in another frame. Apple Safari is prone to 12 security vulnerabilities. \nAttackers may exploit these issues to execute arbitrary code, steal cookie-based authentication credentials, spoof secure websites, obtain sensitive information, and crash the affected application. Other attacks are also possible. \nThese issues affect versions prior to Apple Safari 3.1 running on Apple Mac OS X 10.4.1 and 10.5.2, Microsoft Windows XP, and Windows Vista. \nNOTE: This BID is being retired. \nAn attacker may leverage this issue to access frame methods in another domain. This may help the attacker steal potentially sensitive information and launch other attacks. \nNOTE: This vulnerability was previously covered in BID 28290 (Apple Safari Prior to 3.1 Multiple Security Vulnerabilities), but has been given its own record to better document the issue. Safari is the WEB browser bundled with the Apple family operating system by default. If a user is tricked into visiting a malicious web page, sensitive information will be leaked. ----------------------------------------------------------------------\n\nSecunia Network Software Inspector 2.0 (NSI) - Public Beta\n\n4 days left of beta period. \n\nThe 1st generation of the Secunia Network Software Inspector (NSI)\nhas been available for corporate users for almost 1 year and its been\na tremendous success. \n\nThe 2nd generation Secunia NSI is built on the same technology as the\naward winning Secunia PSI, which has already been downloaded and\ninstalled on more than 400,000 computers world wide. \n\nFor more information:\nSA29393\n\nSOLUTION:\nApply updated packages via the yum utility (\"yum update WebKit\"). \n\nNote: Updated packages for midori and kazehakase have also been\nissued, which have been rebuilt against the new WebKit library. ----------------------------------------------------------------------\n\nA new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI\nhas been released. The new version includes many new and advanced\nfeatures, which makes it even easier to stay patched. \n\nDownload and test it today:\nhttps://psi.secunia.com/\n\nRead more about this new version:\nhttps://psi.secunia.com/?page=changelog\n\n----------------------------------------------------------------------\n\nTITLE:\nApple Safari Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA29393\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/29393/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSecurity Bypass, Cross Site Scripting, Exposure of sensitive\ninformation, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nSafari 3.x\nhttp://secunia.com/product/17989/\nSafari 2.x\nhttp://secunia.com/product/5289/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Safari, which can be\nexploited by malicious people to bypass certain security\nrestrictions, conduct cross-site scripting attacks, or to compromise\na vulnerable system. \n\n1) An error in the processing of \"javascript:\" URLs can be exploited\nto execute arbitrary HTML and script code in context of another site\nvia a specially crafted web page. \n\n2) An error exists the handling of web pages that have explicitly set\nthe document.domain property. This can be exploited to conduct\ncross-site scripting attacks in sites that set the document.domain\nproperty or between HTTP and HTTPS sites with the same\ndocument.domain. \n\n3) An error in Web Inspector can be exploited to inject script code\nthat will run in other domains and can read the user\u0027s file system\nwhen a specially crafted page is inspected. \n\n4) A security issue exists with the Kotoeri input method, which can\nresult in exposing the password field on the display when reverse\nconversion is requested. \n\n5) An error within the handling of the \"window.open()\" function can\nbe used to change the security context of a web page to the caller\u0027s\ncontext. This can be exploited to execute arbitrary script code in\nthe user\u0027s security context via a specially crafted web page. \n\n6) The frame navigation policy is not enforced for Java applets. This\ncan be exploited to conduct cross-site scripting attacks using java\nand to gain escalated privileges by enticing a user to open a\nspecially crafted web page. \n\n7) An unspecified error in the handling of the document.domain\nproperty can be exploited to conduct cross-site scripting attacks\nwhen a user visits a specially crafted web page. \n\n8) An error exists in the handling of the history object. This can be\nexploited to inject javascript code that will run in the context of\nother frames. \n\n9) A boundary error exists in the handling of javascript regular\nexpressions, which can be exploited to cause a buffer overflow via a\nspecially crafted web page. \n\nSuccessful exploitation allows execution of arbitrary code. \n\n10) An error in WebKit allows method instances from one frame to be\ncalled in the context of another frame. This can be exploited to\nconduct cross-site scripting attacks. \n\nSOLUTION:\nUpdate to version 3.1. \n\nPROVIDED AND/OR DISCOVERED BY:\n1) Robert Swiecki of Google Information Security Team\n2, 3, 5, 6) Adam Barth and Collin Jackson of Stanford University\n10) Eric Seidel of the WebKit Open Source Project, and Tavis Ormandy\nand Will Drewry of Google Security Team\n\nORIGINAL ADVISORY:\nApple:\nhttp://docs.info.apple.com/article.html?artnum=307563\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-1011"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "BID",
"id": "28290"
},
{
"db": "BID",
"id": "28342"
},
{
"db": "VULHUB",
"id": "VHN-31136"
},
{
"db": "PACKETSTORM",
"id": "65784"
},
{
"db": "PACKETSTORM",
"id": "64736"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "28342",
"trust": 2.8
},
{
"db": "BID",
"id": "28290",
"trust": 2.8
},
{
"db": "NVD",
"id": "CVE-2008-1011",
"trust": 2.8
},
{
"db": "SECTRACK",
"id": "1019653",
"trust": 2.5
},
{
"db": "USCERT",
"id": "TA08-079A",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "29924",
"trust": 1.8
},
{
"db": "SECUNIA",
"id": "29393",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2008-0920",
"trust": 1.7
},
{
"db": "USCERT",
"id": "SA08-079A",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308",
"trust": 0.7
},
{
"db": "CERT/CC",
"id": "TA08-079A",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2008-03-18",
"trust": 0.6
},
{
"db": "XF",
"id": "41320",
"trust": 0.6
},
{
"db": "FEDORA",
"id": "FEDORA-2008-3229",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-31136",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "65784",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "64736",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31136"
},
{
"db": "BID",
"id": "28290"
},
{
"db": "BID",
"id": "28342"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "PACKETSTORM",
"id": "65784"
},
{
"db": "PACKETSTORM",
"id": "64736"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"id": "VAR-200803-0230",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-31136"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T21:28:32.031000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Safari 3.1",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT1315"
},
{
"title": "Safari 3.1",
"trust": 0.8,
"url": "http://docs.info.apple.com/article.html?artnum=307563-ja"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31136"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/28290"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/28342"
},
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta08-079a.html"
},
{
"trust": 2.5,
"url": "http://www.securitytracker.com/id?1019653"
},
{
"trust": 2.4,
"url": "http://docs.info.apple.com/article.html?artnum=307563"
},
{
"trust": 1.8,
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-april/msg00402.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2008/mar/msg00000.html"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29393"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/29924"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2008/0920/references"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0920/references"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41320"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-1011"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta08-079a/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/trta08-079a/index.html"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-1011"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa08-079a.html"
},
{
"trust": 0.6,
"url": "http://www.apple.com/safari/"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/41320"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/29393/"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-april/msg00401.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/network_software_inspector_2/"
},
{
"trust": 0.1,
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-april/msg00400.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/29924/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/16769/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/?page=changelog"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/5289/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/17989/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-31136"
},
{
"db": "BID",
"id": "28290"
},
{
"db": "BID",
"id": "28342"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "PACKETSTORM",
"id": "65784"
},
{
"db": "PACKETSTORM",
"id": "64736"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-31136"
},
{
"db": "BID",
"id": "28290"
},
{
"db": "BID",
"id": "28342"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"db": "PACKETSTORM",
"id": "65784"
},
{
"db": "PACKETSTORM",
"id": "64736"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-03-19T00:00:00",
"db": "VULHUB",
"id": "VHN-31136"
},
{
"date": "2008-03-18T00:00:00",
"db": "BID",
"id": "28290"
},
{
"date": "2008-03-18T00:00:00",
"db": "BID",
"id": "28342"
},
{
"date": "2008-04-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"date": "2008-04-28T14:37:56",
"db": "PACKETSTORM",
"id": "65784"
},
{
"date": "2008-03-20T00:11:50",
"db": "PACKETSTORM",
"id": "64736"
},
{
"date": "2008-03-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"date": "2008-03-19T00:44:00",
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-08T00:00:00",
"db": "VULHUB",
"id": "VHN-31136"
},
{
"date": "2008-03-20T20:40:00",
"db": "BID",
"id": "28290"
},
{
"date": "2008-03-28T19:29:00",
"db": "BID",
"id": "28342"
},
{
"date": "2008-04-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001197"
},
{
"date": "2008-10-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-308"
},
{
"date": "2024-11-21T00:43:27.123000",
"db": "NVD",
"id": "CVE-2008-1011"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "28290"
},
{
"db": "BID",
"id": "28342"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Safari of WebKit Vulnerable to cross-site scripting due to incomplete instance handling",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001197"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "65784"
},
{
"db": "PACKETSTORM",
"id": "64736"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-308"
}
],
"trust": 0.8
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…