Vulnetix
Try Vulnetix Request Demo
CVE-2015-3750 PUBLISHED

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.

EPSS 0.77% · 73.4th percentile

Risk Scores

EPSS Score
0.77%
73.4th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSqtwebkit-source0, 2.3.2-0ubuntu11, 2.3.2-0ubuntu10
Ubuntu:16.04:LTSwebkitgtk2.4.11-0ubuntu0.1, 0, 2.4.9-2ubuntu2
Ubuntu:16.04:LTSqtwebkit-opensource-src5.5.1+dfsg-2ubuntu1, 5.4.2+dfsg-1ubuntu2.1, 0

Timeline

References

Open in Interactive Console →