CVE-2008-1006

Safari - Cross-Site Scripting via Window Open Security Context Change

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML by using the window.open function to change the security context of a web page.

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28332
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1019653
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA08-079A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28290
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41326
Vendor Advisory x_refsource_confirm
http://docs.info.apple.com/article.html?artnum=307563
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/0920/references
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29393

Scores

EPSS 0.0183
EPSS Percentile 76.7%

Details

CWE
CWE-79
Status published
Products (16)
apple/safari 0.8
apple/safari 0.9
apple/safari 1.0
apple/safari 1.1
apple/safari 1.2
apple/safari 1.3
apple/safari 1.3.1
apple/safari 1.3.2
apple/safari 2.0
apple/safari 2.0.2
... and 6 more
Published Mar 19, 2008
Tracked Since Feb 18, 2026