Yair Amit

The issue is related to the WebSheet component in the iOS operating system, which lacks protection for certain internal data. This can be exploited by a remote attacker using a specially crafted captive portal to read or write data in cookies.

The issue is related to the Cascading Style Sheets (CSS) implementation, which mishandles the `a:visited button` selector during height processing. This makes it easier for remote attackers to obtain sensitive browser-history information via a crafted web site. The vulnerability is associated with a lack of protection for internal data, allowing a remote attacker to access browser history using a specially formed web site.

The issue allows attackers to bypass intended configuration-profile visibility requirements via a long name in the Profiles component.

A cross-application scripting issue exists in the Browser URL loading functionality, allowing local applications to bypass the sandbox and execute arbitrary Javascript in arbitrary domains. This can be achieved by either causing the maximum number of tabs to be opened and then loading a URI to the targeted domain into the current tab, or by making two `startActivity` function calls beginning with the targeted domain's URI followed by the malicious Javascript while the UI focus is still associated with the targeted domain.

A cross-site scripting (XSS) issue allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted file that appears in a preview in a search result.