This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content may lead to universal cross site scripting.

The version of Apple Safari installed on the remote host is prior to 18.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 121241 advisory.

  - This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2,     watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2024-40857)

  - The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a     malicious website may lead to address bar spoofing. (CVE-2024-40866)

  - A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in     Safari 18, iOS 17.7.1 and iPadOS 17.7.1, macOS Sequoia 15, watchOS 11, iOS 18 and iPadOS 18. Maliciously     crafted web content may violate iframe sandboxing policy. (CVE-2024-44155)

  - A cross-origin issue existed with iframe elements. This was addressed with improved tracking of security     origins. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18,     tvOS 18. A malicious website may exfiltrate data cross-origin. (CVE-2024-44187)

  - An authentication issue was addressed with improved state management. This issue is fixed in iOS 18 and     iPadOS 18. Private Browsing tabs may be accessed without authentication. (CVE-2024-44202)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-92d80d7f9a advisory.

    Update to 2.46.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9694c3eec0 advisory.

    Update to 2.46.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apple TV on the remote device is prior to 18. It is therefore affected by multiple vulnerabilities as described in the 121248

The version of Safari installed on the remote host is prior to 18. It is, therefore, affected by multiple vulnerabilities as referenced in the 121241 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 18. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
212177	Apple Safari 18.0 Multiple Vulnerabilities (121241)	Nessus	MacOS X Local Security Checks	medium
211319	Fedora 41 : webkit2gtk4.0 (2024-92d80d7f9a)	Nessus	Fedora Local Security Checks	high
208932	Fedora 40 : webkit2gtk4.0 (2024-9694c3eec0)	Nessus	Fedora Local Security Checks	high
207682	Apple TV < 18 Multiple Vulnerabilities (121248)	Nessus	Misc.	critical
701482	Safari < 18 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
207288	Apple iOS < 18 Multiple Vulnerabilities (121250)	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2024-40857

medium

Tenable Plugins

medium

high

high

critical

medium

critical