deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-1389
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) paste or (2) drag-and-drop operation for a selection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1390
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to improper UTF-7 canonicalization, and lack of termination of a quoted string in an HTML document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1391
Published: 2010-06-11
Description: Multiple directory traversal vulnerabilities in the (a) Local Storage and (b) Web SQL database implementations in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allow remote attackers to create arbitrary database files via vectors involving a (1) %2f and .. (dot dot) or (2) %5c and .. (dot dot) in a URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1392
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to HTML buttons and the first-letter CSS style.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1393
Published: 2010-06-11
Description: The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to discover sensitive URLs via an HREF attribute associated with a redirecting URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1394
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML document fragments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1395
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving DOM constructor objects, related to a "scope management issue."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1396
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the contentEditable attribute and removing container elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1397
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to a layout change during selection rendering and the DOCUMENT_POSITION_DISCONNECTED attribute in a container of an unspecified type.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1398
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly perform ordered list insertions, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document, related to the insertion of an unspecified element into an editable container and the access of an uninitialized element.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1399
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses uninitialized memory during a selection change on a form input element, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1400
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving caption elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=870; http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1401
Published: 2010-06-11
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving the :first-letter pseudo-element.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1402
Published: 2010-06-11
Description: Double free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to an event listener in an SVG document, related to duplicate event listeners, a timer, and an AnimateTransform object.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1403
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses uninitialized memory during the handling of a use element in an SVG document, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document containing XML that triggers a parsing error, related to ProcessInstruction.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1404
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an SVG document that contains recursive Use elements, which are not properly handled during page deconstruction.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1405
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an HTML element that has custom vertical positioning.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1406
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging, a related issue to CVE-2010-0660.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1408
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to bypass intended restrictions on outbound connections to "non-default TCP ports" via a crafted port number, related to an "integer truncation issue." NOTE: this may overlap CVE-2010-1099.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189, CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1409
Published: 2010-06-11
Description: Incomplete blacklist vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to trigger disclosure of data over IRC via vectors involving an IRC service port.
CVSS Score: 5.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1410
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via an SVG document with nested use elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1412
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to hover events.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1413
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, sends NTLM credentials in cleartext in unspecified circumstances, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1414
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the removeChild DOM method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1415
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle libxml contexts, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to an "API abuse issue."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1416
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly restrict the reading of a canvas that contains an SVG image pattern from a different web site, which allows remote attackers to read images from other sites via a crafted canvas, related to a "cross-site image capture issue."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1417
Published: 2010-06-11
Description: The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via HTML content that contains multiple :after pseudo-selectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1422
Published: 2010-06-11
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle changes to keyboard focus that occur during processing of key press events, which allows remote attackers to force arbitrary key presses via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1749
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Cascading Style Sheets (CSS) run-in property and multiple invocations of a destructor for a child element that has been referenced multiple times.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1750
Published: 2010-06-11
Description: Use-after-free vulnerability in Apple Safari before 5.0 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to improper window management.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://secunia.com/advisories/40105; http://securitytracker.com/id?1024067
CVE: CVE-2010-0544
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to a malformed URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1418
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via a FRAME element with a SRC attribute composed of a javascript: sequence preceded by spaces.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1419
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a certain window close action that occurs during a drag-and-drop operation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
CVE: CVE-2010-1421
Published: 2010-06-11
Description: The execCommand JavaScript function in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly restrict remote execution of clipboard commands, which allows remote attackers to modify the clipboard via a crafted HTML document.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010//Sep/msg00002.html
CVE: CVE-2010-1758
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving DOM Range objects.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html
CVE: CVE-2010-1759
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the Node.normalize method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1761
Published: 2010-06-11
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving HTML document subtrees.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Jun/msg00002.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
CVE: CVE-2010-1762
Published: 2010-06-11
Description: Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML in a TEXTAREA element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2010/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html