Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Safari WebKit enables attackers to insert malicious web code

CVE-2010-0544 · published 16 years ago
Summary

Versions of Apple Safari that use older WebKit on Mac OS X and Windows can be tricked into running unwanted scripts or HTML that an attacker supplies. This could let attackers steal data or hijack user sessions when a victim visits a malicious link. Update Safari to the latest version or switch to a browser with current security updates to protect your users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple safari <= 4.0.5
4.0
4.0.0b
4.0.1
4.0.2
4.0.3
4.0.4
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
apple webkit All versions
cpe:2.3:a:apple:webkit:*:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary...
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors related to a malformed URL.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published11 Jun 2010
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2010-0544 · NVD
Track software like this
Free during beta