Apple Safari vulnerabilities

CVE-2010-1764 [MEDIUM] CVE-2010-1764: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac O WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, follows multiple redirections during form submission, which allows remote web servers to obtain sensitive information by recording the form data.

CVE-2011-3243 [MEDIUM] CWE-79 CVE-2011-3243: Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows.

CVE-2013-1012 [MEDIUM] CWE-79 CVE-2013-1012: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attack Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.

CVE-2009-2842 [MEDIUM] CVE-2009-2842: Apple Safari before 4.0.4 does not properly implement certain (1) Open Image and (2) Open Link menu Apple Safari before 4.0.4 does not properly implement certain (1) Open Image and (2) Open Link menu options, which allows remote attackers to read local HTML files via a crafted web site.

CVE-2015-3660 [MEDIUM] CWE-79 CVE-2015-3660: Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6 Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.

CVE-2011-0163 [MEDIUM] CWE-20 CVE-2011-0163: WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecifie WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle unspecified "cached resources," which allows remote attackers to cause a denial of service (resource unavailability) via a crafted web site that conducts a cache-poisoning attack.

CVE-2011-3968 [MEDIUM] CWE-416 CVE-2011-3968: Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving Cascading Style Sheets (CSS) token sequences.

CVE-2016-1781 [MEDIUM] CWE-19 CVE-2016-1781: WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easi WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors.

CVE-2020-9993 [MEDIUM] CWE-1021 CVE-2020-9993: The issue was addressed with improved UI handling. This issue is fixed in watchOS 7.0, Safari 14.0, The issue was addressed with improved UI handling. This issue is fixed in watchOS 7.0, Safari 14.0, iOS 14.0 and iPadOS 14.0. Visiting a malicious website may lead to address bar spoofing.

CVE-2007-4424 [MEDIUM] CVE-2007-4424: Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. NOTE: it could be argued that this is not a vulnerability because a dangerous file

CVE-2018-4307 [MEDIUM] CWE-20 CVE-2018-4307: A logic issue was addressed with improved state management. This issue affected versions prior to iO A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12, Safari 12.

CVE-2015-1129 [MEDIUM] CWE-310 CVE-2015-1129: Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 cli Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.

CVE-2012-3714 [MEDIUM] CWE-200 CVE-2012-3714: The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the se The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site.

CVE-2019-8670 [MEDIUM] CWE-20 CVE-2019-8670: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.6, Safari 12.1.2. Visiting a malicious website may lead to address bar spoofing.

CVE-2020-9784 [MEDIUM] CVE-2020-9784: A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1. A malici A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1. A malicious iframe may use another website’s download settings.

CVE-2020-9987 [MEDIUM] CWE-1021 CVE-2020-9987: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 14.0. Visiting a malicious website may lead to address bar spoofing.

CVE-2010-1805 [MEDIUM] CWE-264 CVE-2010-1805: Untrusted search path vulnerability in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2 on Windows Untrusted search path vulnerability in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2 on Windows allows local users to gain privileges via a Trojan horse explorer.exe (aka Windows Explorer) program in a directory containing a file that had been downloaded by Safari.

CVE-2020-3833 [MEDIUM] CVE-2020-3833: An inconsistent user interface issue was addressed with improved state management. This issue is fix An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead to address bar spoofing.

CVE-2018-4445 [MEDIUM] CWE-200 CVE-2018-4445: "Clear History and Website Data" did not clear the history. The issue was addressed with improved da "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2.

CVE-2025-24128 [MEDIUM] CVE-2025-24128: The issue was addressed by adding additional logic. This issue is fixed in Safari 18.3, iOS 18.3 and The issue was addressed by adding additional logic. This issue is fixed in Safari 18.3, iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. Visiting a malicious website may lead to address bar spoofing.