Erling Ellingsen

The issue concerns the Safari Reader component and is due to the lack of protection for the web page structure. This allows a remote attacker to conduct a Universal XSS (UXSS) attack using a specially crafted website. UXSS stands for Universal Cross-Site Scripting, which is a type of attack that allows an attacker to inject malicious scripts into a website, potentially affecting all users of the site.

The issue involves the Safari Reader component, which allows remote attackers to conduct UXSS attacks via a crafted web site. This is due to the lack of protection for the web page structure. The exploitation of this issue may allow a remote attacker to conduct UXSS attacks using a specially formed web site.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted web site. This is also referred to as "Universal XSS (UXSS)".

The issue is related to errors in security settings, allowing a remote attacker to exploit it by using a specially crafted website to spoof the relationship between URLs and web content. This can lead to the substitution of web page content.

The issue concerns the document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit, allowing remote attackers to bypass an intended single-cookie restriction.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.

The issue concerns the CFNetwork component in Apple iOS, which fails to properly identify the host portion of a URL. This allows remote attackers to obtain sensitive information by constructing an HTTP request with an incorrect hostname derived from a malformed URL.

The issue allows remote attackers to obtain sensitive information via a malformed URL. This occurs due to improper construction of request headers during URL parsing.

The issue allows remote attackers to obtain sensitive information via a malformed URL, due to improper construction of request headers during URL parsing.

The issue allows remote attackers to obtain sensitive information via a crafted DNS hostname, due to the `libinfo` component not properly formulating domain-name queries.

The issue allows remote attackers to trigger visits to unintended web sites and transmit cookies to unintended web sites via a crafted http or https URL, due to improper URL parsing.