Vulnerabilities (CVE)

Filtered by vendor Apple Subscribe
Filtered by product Safari
Total 1535 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2003-0975 1 Apple 3 Mac Os X, Mac Os X Server, Safari 2025-04-03 5.0 MEDIUM N/A
Apple Safari 1.0 through 1.1 on Mac OS X 10.3.1 and Mac OS X 10.2.8 allows remote attackers to steal user cookies from another domain via a link with a hex-encoded null character (%00) followed by the target domain.
CVE-2005-2272 1 Apple 1 Safari 2025-04-03 2.6 LOW N/A
Safari version 2.0 (412) does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."
CVE-2004-0720 1 Apple 1 Safari 2025-04-03 7.5 HIGH N/A
Safari 1.2.2 does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability.
CVE-2006-3372 1 Apple 1 Safari 2025-04-03 5.0 MEDIUM N/A
Apple Safari 2.0.4/419.3 allows remote attackers to cause a denial of service (application crash) via a DHTML setAttributeNode function call with zero arguments, which triggers a null dereference.
CVE-2006-1987 1 Apple 1 Safari 2025-04-03 7.5 HIGH N/A
Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via an invalid FRAME tag, possibly due to (1) multiple SCROLLING attributes with no values, or (2) a SRC attribute with no value. NOTE: due to lack of diagnosis by the researcher, it is unclear which vector is responsible.
CVE-2003-0370 4 Apple, Kde, Redhat and 1 more 6 Safari, Kde, Konqueror Embedded and 3 more 2025-04-03 7.5 HIGH N/A
Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.
CVE-2004-1121 1 Apple 1 Safari 2025-04-03 5.0 MEDIUM N/A
Apple Safari 1.0 through 1.2.3 allows remote attackers to spoof the URL displayed in the status bar via TABLE tags.
CVE-2004-0361 1 Apple 1 Safari 2025-04-03 5.0 MEDIUM N/A
The Javascript engine in Safari 1.2 and earlier allows remote attackers to cause a denial of service (segmentation fault) by creating a new Array object with a large size value, then writing into that array.
CVE-2006-3224 1 Apple 1 Safari 2025-04-03 5.4 MEDIUM N/A
Apple Safari 2.0.3 (417.9.3) on Mac OS X 10.4.6 allows remote attackers to cause a denial of service (CPU consumption) via Javascript with an infinite for loop. NOTE: it could be argued that this is not a vulnerability, unless it interferes with the operation of the system outside of the scope of Safari itself.
CVE-2005-0234 1 Apple 1 Safari 2025-04-03 5.0 MEDIUM N/A
The International Domain Name (IDN) support in Safari 1.2.5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.
CVE-2005-2524 1 Apple 3 Mac Os X, Mac Os X Server, Safari 2025-04-03 5.0 MEDIUM N/A
Safari after 2.0 in Apple Mac OS X 10.3.9 allows remote attackers to bypass domain restrictions via crafted web archives that cause Safari to render them as if they came from a different site.
CVE-2006-2019 1 Apple 1 Safari 2025-04-03 5.0 MEDIUM N/A
Apple Mac OS X Safari 2.0.3, 1.3.1, and possibly other versions allows remote attackers to cause a denial of service (CPU consumption and crash) via a TD element with a large number in the rowspan attribute.
CVE-2005-4678 1 Apple 1 Safari 2025-04-03 5.0 MEDIUM N/A
Apple Safari 2.0.2 (aka 416.12) allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2006-1986 1 Apple 1 Safari 2025-04-03 7.5 HIGH N/A
Apple Safari 2.0.3 allows remote attackers to cause a denial of service and possibly execute code via a large CELLSPACING attribute in a TABLE tag, which triggers an error in KWQListIteratorImpl::KWQListIteratorImpl.
CVE-2005-0341 1 Apple 1 Safari 2025-04-03 4.3 MEDIUM N/A
Apple Safari 1.2.4 does not obey the Content-type field in the HTTP header and renders text as HTML, which allows remote attackers to inject arbitrary web script or HTML and perform cross-site scripting (XSS) attacks.
CVE-2005-2516 1 Apple 2 Mac Os X, Safari 2025-04-03 7.5 HIGH N/A
Safari in Mac OS X 10.3.9 and 10.4.2, when rendering Rich Text Format (RTF) files, can directly access URLs without performing the normal security checks, which allows remote attackers to execute arbitrary commands.
CVE-2005-3897 1 Apple 1 Safari 2025-04-03 7.8 HIGH N/A
Apple Safari 2.0.2 allows remote attackers to cause a denial of service (system slowdown) via a Javascript BODY onload event that calls the window function.
CVE-2024-23284 4 Apple, Fedoraproject, Webkitgtk and 1 more 10 Ipados, Iphone Os, Macos and 7 more 2025-03-28 N/A 6.5 MEDIUM
A logic issue was addressed with improved state management. This issue is fixed in tvOS 17.4, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, watchOS 10.4, iOS 16.7.6 and iPadOS 16.7.6, Safari 17.4. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
CVE-2024-40866 1 Apple 2 Macos, Safari 2025-03-25 N/A 6.5 MEDIUM
The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.
CVE-2024-40785 1 Apple 7 Ipados, Iphone Os, Macos and 4 more 2025-03-25 N/A 6.1 MEDIUM
This issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, Safari 17.6, iOS 17.6 and iPadOS 17.6, watchOS 10.6, tvOS 17.6, visionOS 1.3, macOS Sonoma 14.6. Processing maliciously crafted web content may lead to a cross site scripting attack.