CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 06/08/2009 |
| CVE-2009-1726 | 緊急9.3 | Heap-based buffer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image containing an embedded ColorSync profile. | 06/08/2009 |
| CVE-2009-1723 | 中4.3 | CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for remote attackers to trick a user into visiting an arbitrary https web site by leveraging an open redirect vulnerability, a different issue than CVE-2009-2062. | 06/08/2009 |
| CVE-2009-0151 | 高7.2 | The screen saver in Dock in Apple Mac OS X 10.5 before 10.5.8 does not prevent four-finger Multi-Touch gestures, which allows physically proximate attackers to bypass locking and "manage applications or use Expose" via unspecified vectors. | 06/08/2009 |
| CVE-2009-2198 | 中4.3 | Apple GarageBand before 5.1 reconfigures Safari to accept all cookies regardless of domain name, which makes it easier for remote web servers to track users. | 04/08/2009 |
| CVE-2009-1725 | 緊急9.3 | WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code o | 09/07/2009 |
| CVE-2009-1724 | 中4.3 | Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects. | 09/07/2009 |
| CVE-2009-2421 | 中5.0 | The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a "high-bit character" in a URL fragment for an unspecified protocol. | 09/07/2009 |
| CVE-2009-2420 | 中5.8 | Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors involving an unspecified HTML tag, possibly a related issue to CVE-2009-1703. | 09/07/2009 |
| CVE-2009-2419 | 中4.3 | Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted HTML document that references a zero-length .js file and the JavaScript reload fu | 09/07/2009 |
| CVE-2009-2072 | 中5.4 | Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server. | 15/06/2009 |
| CVE-2009-2066 | 中6.8 | Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intend | 15/06/2009 |
| CVE-2009-2062 | 中6.8 | Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. | 15/06/2009 |
| CVE-2009-2058 | 中6.8 | Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. | 15/06/2009 |
| CVE-2009-2027 | 高7.2 | The Installer in Apple Safari before 4.0 on Windows allows local users to gain privileges by checking a box that specifies an immediate launch of the application after installation, related to an unspecified compression method. | 10/06/2009 |
| CVE-2009-1718 | 高7.1 | WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page. | 10/06/2009 |
| CVE-2009-1716 | 低2.1 | CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files. | 10/06/2009 |
| CVE-2009-1715 | 中4.3 | Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges. | 10/06/2009 |