Cross-site scripting (XSS) vulnerability in WebCore, as used in Apple Safari before 3.1, allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to the Web Inspector.

The remote Mac OS X host is running a version of Safari that is older than version 3.1. The remote version of this software contains several security vulnerabilities that may allow an attacker to execute arbitrary code or a cross-site scripting attack on the remote host.  To exploit these flaws, an attacker would need to convince a victim to visit a rogue web site or open a malicious HTML file.

The version of Apple Safari installed on the remote host is older than version 3.1.

The remote version of this software contains several security vulnerabilities that may allow an attacker to execute arbitrary code or launch a cross-site scripting attack on the remote host.

To exploit these flaws, an attacker would need to lure a victim into visiting a rogue website or opening a malicious HTML file.

ID	Name	Product	Family	Severity
4434	Safari < 3.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
31604	Mac OS X : Apple Safari < 3.1	Nessus	MacOS X Local Security Checks	critical
800994	Mac OS X Safari < 3.1 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high

Detections

Analytics

CVE-2008-1004

medium

Tenable Plugins

high

critical

high