Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.
Max CVSS
6.1
EPSS Score
0.21%
Published
2016-07-22
Updated
2018-10-09
Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
Max CVSS
6.1
EPSS Score
0.26%
Published
2016-09-25
Updated
2017-07-30
The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attackers to obtain sensitive information via a crafted URL.
Max CVSS
5.0
EPSS Score
0.19%
Published
2016-06-19
Updated
2017-09-01
3 vulnerabilities found