ByteOS

Product

macOS

Versions

Affected

From unspecified before 14.8 (custom)

Vendor

Product

macOS

Versions

Affected

From unspecified before 26 (custom)

Problem Types

Type	CWE ID	Description
N/A	N/A	Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

Type: N/A

CWE ID: N/A

Description: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

References

Hyperlink	Resource
https://support.apple.com/en-us/125636	N/A
https://support.apple.com/en-us/125110	N/A

Hyperlink: https://support.apple.com/en-us/125636

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125110

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Version: 3.1

Base score: 7.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:04 Nov, 2025 | 02:15

Updated At:17 Dec, 2025 | 21:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.1	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 7.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

CPE Matches

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions before 26.0(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 26.0(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions before 14.8.2(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-79

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
https://support.apple.com/en-us/125110	product-security@apple.com	N/A
https://support.apple.com/en-us/125636	product-security@apple.com	Release Notes Vendor Advisory

Hyperlink: https://support.apple.com/en-us/125110

Source: product-security@apple.com

Resource: N/A

Hyperlink: https://support.apple.com/en-us/125636

Source: product-security@apple.com

Resource:

Release Notes

Vendor Advisory

Similar CVEs

242Records found

CVE-2014-4406

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.57% / 68.17%

7 Day CHG~0.00%

Published-19 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Xcode Server in CoreCollaboration in Apple OS X Server before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Apple Inc.

Product-os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-5858

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.03% / 76.93%

7 Day CHG~0.00%

Published-19 Dec, 2007 | 21:00

Updated-07 Aug, 2024 | 15:47

WebKit in Safari in Apple Mac OS X 10.4.11 and 10.5.1, iPhone 1.0 through 1.1.2, and iPod touch 1.1 through 1.1.2 allows remote attackers to "navigate the subframes of any other page," which can be leveraged to conduct cross-site scripting (XSS) attacks and obtain sensitive information.

Vendor-n/a Apple Inc.

Product-iphone_os ipod_touch safari mac_os_x iphone n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-4698

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.20% / 78.66%

7 Day CHG~0.00%

Published-15 Nov, 2007 | 00:00

Updated-07 Aug, 2024 | 15:08

Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripting (XSS) attacks by causing JavaScript events to be associated with the wrong frame.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3761

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.56% / 67.99%

7 Day CHG~0.00%

Published-27 Sep, 2007 | 22:00

Updated-07 Aug, 2024 | 14:28

Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain.

Vendor-n/a Apple Inc.

Product-iphone_os safari iphone n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3760

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.36% / 79.94%

7 Day CHG~0.00%

Published-27 Sep, 2007 | 22:00

Updated-07 Aug, 2024 | 14:28

Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags.

Product-iphone_os windows_vista safari windows_xp mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0509

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-0.58% / 68.56%

7 Day CHG~0.00%

Published-08 Apr, 2014 | 21:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0532

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-3.59% / 87.52%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-0531 and CVE-2014-0533.

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0562

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-0.57% / 68.05%

7 Day CHG~0.00%

Published-17 Sep, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

Vendor-n/a Apple Inc.Adobe Inc.Microsoft Corporation

Product-windows acrobat mac_os_x acrobat_reader n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3758

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.57% / 81.27%

7 Day CHG~0.00%

Published-27 Sep, 2007 | 22:00

Updated-07 Aug, 2024 | 14:28

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting (XSS) attacks.

Product-iphone_os windows_vista safari windows_xp mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-0533

Matching Score-6

Matching Score-6

CVSS Score-4.3||MEDIUM

EPSS-1.01% / 76.76%

7 Day CHG~0.00%

Published-11 Jun, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Apple Inc.Microsoft Corporation

Product-flash_player adobe_air linux_kernel adobe_air_sdk windows mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-3482

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-0.30% / 53.30%

7 Day CHG~0.00%

Published-28 Jun, 2007 | 18:00

Updated-07 Aug, 2024 | 14:21

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute.

Product-safari windows_nt n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-6853

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 52.44%

7 Day CHG~0.00%

Published-26 Jan, 2014 | 01:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.2013418100420 for Windows, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim.

Vendor-n/a Apple Inc.Mozilla Corporation Yahoo Inc.

Product-firefox macos toolbar n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-2400

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.46% / 63.53%

7 Day CHG~0.00%

Published-25 Jun, 2007 | 19:00

Updated-07 Aug, 2024 | 13:33

Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to page updating and HTTP redirects.

Product-iphone_os windows_vista safari windows_xp mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2020-3867

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.37% / 58.53%

7 Day CHG+0.01%

Published-27 Feb, 2020 | 20:45

Updated-04 Aug, 2024 | 07:44

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to universal cross site scripting.

Vendor-webkitgtk openSUSE Apple Inc.

Product-itunes iphone_os ipados tvos safari webkitgtk icloud leap iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-2391

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.54% / 67.07%

7 Day CHG~0.00%

Published-14 Jun, 2007 | 18:00

Updated-07 Aug, 2024 | 13:33

Cross-site scripting (XSS) vulnerability in Apple Safari Beta 3.0.1 for Windows allows remote attackers to inject arbitrary web script or HTML via a web page that includes a windows.setTimeout function that is activated after the user has moved from the current page.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5131

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.66%

7 Day CHG~0.00%

Published-19 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5151

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 53.06%

7 Day CHG~0.00%

Published-19 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type, which allows remote attackers to conduct cross-site scripting (XSS) attacks by uploading a file.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-5129

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.66%

7 Day CHG~0.00%

Published-19 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in WebKit in Apple iOS before 7 allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-2401

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.31% / 86.99%

7 Day CHG~0.00%

Published-25 Jun, 2007 | 19:00

Updated-07 Aug, 2024 | 13:33

CRLF injection vulnerability in WebCore in Apple Mac OS X 10.3.9, 10.4.9 and later, and iPhone before 1.0.1, allows remote attackers to inject arbitrary HTTP headers via LF characters in an XMLHttpRequest request, which are not filtered when serializing headers via the setRequestHeader function. NOTE: this issue can be leveraged for cross-site scripting (XSS) attacks.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x_server mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-36486

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.34%

7 Day CHG~0.00%

Published-22 Oct, 2021 | 19:20

Updated-04 Aug, 2024 | 17:30

Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.

Vendor-swiftfiletransfer n/a BlackBerry Limited Apple Inc.Google LLC

Product-android iphone_os blackberry_os swift_file_transfer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-1012

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.49% / 65.10%

7 Day CHG~0.00%

Published-05 Jun, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-0962

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-2.6||LOW

EPSS-0.32% / 54.84%

7 Day CHG~0.00%

Published-29 Jan, 2013 | 02:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 6.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted content that is not properly handled during a copy-and-paste operation.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2013-1034

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.48% / 64.89%

7 Day CHG~0.00%

Published-19 Sep, 2013 | 10:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in Wiki Server in Apple Mac OS X Server before 2.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Apple Inc.

Product-os_x_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-2889

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.39% / 59.51%

7 Day CHG~0.00%

Published-26 Sep, 2012 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)."

Vendor-n/a Apple Inc.Google LLC

Product-iphone_os chrome n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-19658

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.34% / 56.52%

7 Day CHG~0.00%

Published-02 Mar, 2020 | 19:49

Updated-05 Aug, 2024 | 11:44

The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a vulnerability in Evernote.

Vendor-evernote n/a Apple Inc.

Product-yinxiang_biji macos n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-5851

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.34% / 56.60%

7 Day CHG~0.00%

Published-15 Nov, 2012 | 11:00

Updated-11 Apr, 2025 | 00:51

html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.

Vendor-n/a Apple Inc.Google LLC

Product-webkit safari chrome n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4144

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 60.44%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, does not properly escape characters in DOM elements, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted HTML document.

Vendor-n/a Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Opera

Product-mac_os_x opera_browser linux_kernel windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-54540

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-5.5||MEDIUM

EPSS-0.14% / 34.70%

7 Day CHG+0.03%

Published-15 Jan, 2025 | 19:35

Updated-24 Mar, 2025 | 18:15

The issue was addressed with improved input sanitization. This issue is fixed in Apple Music 1.5.0.152 for Windows. Processing maliciously crafted web content may disclose internal states of the app.

Vendor-Microsoft Corporation Apple Inc.

Product-windows_10_22h2 music windows_11_24h2 Apple Music for Windows

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-4142

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.40%

7 Day CHG~0.00%

Published-06 Aug, 2012 | 16:00

Updated-11 Apr, 2025 | 00:51

Opera before 12.01 on Windows and UNIX, and before 11.66 and 12.x before 12.01 on Mac OS X, ignores some characters in HTML documents in unspecified circumstances, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.

Vendor-n/a Microsoft Corporation Apple Inc.Linux Kernel Organization, Inc Opera

Product-mac_os_x opera_browser linux_kernel windows n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-3695

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.40% / 59.95%

7 Day CHG~0.00%

Published-25 Jul, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML by leveraging improper URL canonicalization during the handling of the location.href property.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-2648

Matching Score-6

Assigner-JPCERT/CC

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.20% / 41.96%

7 Day CHG~0.00%

Published-07 Aug, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the iPhone and iPod touch, allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction with a web browser.

Vendor-goodiware n/a Apple Inc.

Product-goodreader ipod_touch ipad iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-2899

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.12% / 30.63%

7 Day CHG~0.00%

Published-05 Jan, 2014 | 20:00

Updated-11 Apr, 2025 | 00:51

Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method.

Vendor-n/a Google LLC Apple Inc.

Product-ipad2 chrome n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-16046

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-6.1||MEDIUM

EPSS-0.48% / 64.69%

7 Day CHG~0.00%

Published-14 Jan, 2021 | 20:55

Updated-04 Aug, 2024 | 13:37

Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Vendor-Apple Inc.Google LLC

Product-chrome iphone_os Chrome

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0586

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.71%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0587, CVE-2012-0588, and CVE-2012-0589.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-15138

Matching Score-6

Assigner-GitHub, Inc.

Matching Score-6

Assigner-GitHub, Inc.

CVSS Score-7.1||HIGH

EPSS-0.86% / 74.73%

7 Day CHG~0.00%

Published-07 Aug, 2020 | 16:30

Updated-04 Aug, 2024 | 13:08

Cross-Site Scripting in Prism

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

Vendor-prismjs PrismJS Apple Inc.Microsoft Corporation

Product-internet_explorer safari previewers prism

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0588

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.71%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0587

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.71%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0589

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.71%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0767

Matching Score-6

Matching Score-6

CVSS Score-6.1||MEDIUM

EPSS-16.27% / 94.68%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Vendor-n/a Linux Kernel Organization, Inc Microsoft Corporation Apple Inc.Oracle Corporation Google LLC Adobe Inc.

Product-mac_os_x flash_player windows linux_kernel solaris android n/a Flash Player

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0678

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 47.83%

7 Day CHG~0.00%

Published-25 Jul, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL.

Vendor-n/a Apple Inc.

Product-safari n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2012-0590

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.71%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a drag-and-drop operation.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3881

Matching Score-6

Assigner-Chrome

Matching Score-6

Assigner-Chrome

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.60%

7 Day CHG~0.00%

Published-25 Oct, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

WebKit, as used in Google Chrome before 15.0.874.102 and Android before 4.4, allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors related to (1) the DOMWindow::clear function and use of a selection object, (2) the Object::GetRealNamedPropertyInPrototypeChain function and use of an __proto__ property, (3) the HTMLPlugInImageElement::allowedToLoadFrameURL function and use of a javascript: URL, (4) incorrect origins for XSLT-generated documents in the XSLTProcessor::createDocumentFromSource function, and (5) improper handling of synchronous frame loads in the ScriptController::executeIfJavaScriptURL function.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os safari chrome android n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3998

Matching Score-6

Assigner-JPCERT/CC

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.47%

7 Day CHG~0.00%

Published-09 Nov, 2011 | 20:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Apple WebObjects 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Apple Inc.

Product-webobjects n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3426

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.88% / 74.91%

7 Day CHG~0.00%

Published-14 Oct, 2011 | 10:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.

Vendor-n/a Apple Inc.

Product-iphone_os n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3058

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.75% / 72.86%

7 Day CHG~0.00%

Published-30 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Vendor-n/a Apple Inc.Google LLC

Product-mac_os_x iphone_os chrome n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2007-0478

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.76% / 87.79%

7 Day CHG+1.22%

Published-25 Jan, 2007 | 00:00

Updated-07 Aug, 2024 | 12:19

WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment.

Vendor-n/a Apple Inc.

Product-webcore safari mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32445

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.47% / 64.02%

7 Day CHG~0.00%

Published-28 Jul, 2023 | 04:30

Updated-22 Oct, 2024 | 18:17

This issue was addressed with improved checks. This issue is fixed in Safari 16.6, watchOS 9.6, iOS 15.7.8 and iPadOS 15.7.8, tvOS 16.6, iOS 16.6 and iPadOS 16.6, macOS Ventura 13.5. Processing a document may lead to a cross site scripting attack.

Vendor-Apple Inc.

Product-iphone_os watchos ipados tvos safari macos watchOS Safari macOS tvOS iOS and iPadOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-10012

Matching Score-6

Assigner-Apple Inc.

Matching Score-6

Assigner-Apple Inc.

CVSS Score-6.1||MEDIUM

EPSS-0.89% / 75.19%

7 Day CHG~0.00%

Published-08 Dec, 2020 | 20:03

Updated-04 Aug, 2024 | 10:50

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Big Sur 11.0.1. Processing a maliciously crafted document may lead to a cross site scripting attack.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3046

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-10||HIGH

EPSS-3.22% / 86.79%

7 Day CHG-2.36%

Published-09 Mar, 2012 | 00:00

Updated-11 Apr, 2025 | 00:51

The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.

Vendor-n/a openSUSE Apple Inc.Google LLC

Product-opensuse iphone_os safari chrome n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2011-3218

Matching Score-6

Assigner-Apple Inc.