PT-2007-1938 · Apple · Webcore

Publicado 2007-01-25 · Atualizado 2018-10-16 · CVE-2007-0478

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCore versions 10.3.9 through 10.4.10

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by embedding certain HTML tags within an HTML comment in TITLE elements, which can bypass some XSS protection schemes.

Recommendations For versions 10.3.9 through 10.4.10, consider disabling the parsing of HTML comments in TITLE elements as a temporary workaround until a patch is available. Restrict access to potentially vulnerable WebCore components to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-0478

Produtos afetados

Webcore

Referências · 12

• http://securitytracker.com/id?1018494 · Nota
• http://vupen.com/english/advisories/2007/2732 · Nota
• http://securityfocus.com/bid/25159 · Nota
• http://beanfuzz.com/wordpress/?p=99 · Nota
• http://secunia.com/advisories/26235 · Aviso do Fabricante
• http://osvdb.org/32712 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31846 · Nota
• http://secunia.com/advisories/23893 · Aviso do Fabricante
• http://docs.info.apple.com/article.html?artnum=306172 · Nota
• http://securityfocus.com/archive/1/457763/100/0/threaded · Nota
• http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0478 · Nota de Segurança