CVE & Exploit Intelligence Database

CVE-2016-5137 4.3 MEDIUM EPSS 0.01

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution.

CWE-200 Jul 23, 2016

CVE-2016-5135 6.5 MEDIUM 1 PoC Analysis EPSS 0.00

WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element.

CWE-20 Jul 23, 2016

CVE-2016-5133 5.3 MEDIUM EPSS 0.01

Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream.

CWE-287 Jul 23, 2016

CVE-2016-5130 6.5 MEDIUM EPSS 0.01

content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site.

CWE-284 Jul 23, 2016

CVE-2016-1707 6.5 MEDIUM EPSS 0.01

ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site.

CWE-20 Jul 23, 2016

CVE-2016-6204 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CWE-79 Jul 22, 2016

CVE-2016-4652 6.3 MEDIUM EPSS 0.00

CoreGraphics in Apple OS X before 10.11.6 allows local users to obtain sensitive information from kernel memory and consequently gain privileges, or cause a denial of service (out-of-bounds read), via unspecified vectors.

CWE-125 Jul 22, 2016

CVE-2016-4651 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.

CWE-79 Jul 22, 2016

CVE-2016-4649 5.5 MEDIUM EPSS 0.00

Audio in Apple OS X before 10.11.6 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.

CWE-476 Jul 22, 2016

CVE-2016-4648 5.5 MEDIUM EPSS 0.00

Audio in Apple OS X before 10.11.6 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) via unspecified vectors.

CWE-200 Jul 22, 2016

CVE-2016-4646 6.5 MEDIUM EPSS 0.01

Audio in Apple OS X before 10.11.6 mishandles a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted audio file.

CWE-200 Jul 22, 2016

CVE-2016-4635 5.3 MEDIUM EPSS 0.00

FaceTime in Apple iOS before 9.3.3 and OS X before 10.11.6 allows man-in-the-middle attackers to spoof relayed-call termination, and obtain sensitive audio information in opportunistic circumstances, via unspecified vectors.

CWE-200 Jul 22, 2016

CVE-2016-4628 5.5 MEDIUM EPSS 0.00

IOAcceleratorFamily in Apple iOS before 9.3.3 and watchOS before 2.2.2 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via unspecified vectors.

CWE-125 Jul 22, 2016

CVE-2016-4605 6.5 MEDIUM EPSS 0.01

Calendar in Apple iOS before 9.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a crafted invitation.

CWE-476 Jul 22, 2016

CVE-2016-4604 5.4 MEDIUM EPSS 0.00

Safari in Apple iOS before 9.3.3 allows remote attackers to spoof the displayed URL via an HTTP response specifying redirection to an invalid TCP port number.

CWE-601 Jul 22, 2016

CVE-2016-4603 4.3 MEDIUM EPSS 0.00

Web Media in Apple iOS before 9.3.3 allows attackers to bypass the Private Browsing protection mechanism and obtain sensitive video URL information by leveraging Safari View Controller misbehavior.

CWE-254 Jul 22, 2016

CVE-2016-4595 4.6 MEDIUM EPSS 0.00

Safari Login AutoFill in Apple OS X before 10.11.6 allows physically proximate attackers to discover passwords by reading the screen during the login procedure.

CWE-200 Jul 22, 2016

CVE-2016-4592 6.5 MEDIUM EPSS 0.02

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted web site.

CWE-400 Jul 22, 2016

CVE-2016-4590 5.4 MEDIUM EPSS 0.01

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

CWE-20 Jul 22, 2016

CVE-2016-4587 6.5 MEDIUM EPSS 0.01

WebKit in Apple iOS before 9.3.3 and tvOS before 9.2.2 allows remote attackers to obtain sensitive information from uninitialized process memory via a crafted web site.

CWE-119 Jul 22, 2016