CVE-2011-0166
published 2011-03-11CVE-2011-0166: The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain…
PriorityP423medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
2.06%
79.4th percentile
The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | safari | <= 5.0.3 | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
| apple | safari | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vh6c-5xwq-r5vw: The HTML5 drag and drop functionality in WebKit in Apple Safari before 5
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2011-0166 [HIGH] GHSA-vh6c-5xwq-r5vw: The HTML5 drag and drop functionality in WebKit in Apple Safari before 5
The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778.
OSV
CVE-2011-0166: The HTML5 drag and drop functionality in WebKit in Apple Safari before 5
osv·2011-03-11·CVSS 5.8
CVE-2011-0166 [MEDIUM] CVE-2011-0166: The HTML5 drag and drop functionality in WebKit in Apple Safari before 5
The HTML5 drag and drop functionality in WebKit in Apple Safari before 5.0.4 allows user-assisted remote attackers to bypass the Same Origin Policy and obtain sensitive information via vectors related to the dragging of content. NOTE: this might overlap CVE-2011-0778.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlhttp://support.apple.com/kb/HT4566http://support.apple.com/kb/HT4999http://www.securityfocus.com/bid/46811http://www.securitytracker.com/id?1025183https://exchange.xforce.ibmcloud.com/vulnerabilities/66004http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2011//Mar/msg00004.htmlhttp://support.apple.com/kb/HT4566http://support.apple.com/kb/HT4999http://www.securityfocus.com/bid/46811http://www.securitytracker.com/id?1025183https://exchange.xforce.ibmcloud.com/vulnerabilities/66004
2011-03-11
Published