CVE-2014-4363

Опубликовано: 18 сент. 2014

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attackers to obtain sensitive information via (1) an http web site, (2) an https web site with an unacceptable X.509 certificate, or (3) an IFRAME element.

Ссылки

http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
Third Party Advisory
http://secunia.com/advisories/61306
Third Party Advisory
http://support.apple.com/kb/HT6440
Vendor Advisory
http://support.apple.com/kb/HT6441
Vendor Advisory
http://www.securityfocus.com/bid/69882
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/69909
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1030866
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/96075
Third Party Advisory
VDB Entry
http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
Third Party Advisory
http://secunia.com/advisories/61306
Third Party Advisory
http://support.apple.com/kb/HT6440
Vendor Advisory
http://support.apple.com/kb/HT6441
Vendor Advisory
http://www.securityfocus.com/bid/69882
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/69909
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1030866
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/96075
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

Версия от 7.0 (включая) до 7.1.2 (включая)

Конфигурация 2

Одно из

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия от 6.0 (включая) до 6.1.5 (включая)

cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*

Версия от 7.0 (включая) до 7.0.5 (включая)

EPSS

Процентиль: 73%

0.00762

Низкий

5 Medium

CVSS2

Дефекты

CWE-255

Связанные уязвимости

GHSA-vq78-89mr-jhrh

github

больше 3 лет назад