Browser
Spoofing
Safari Login AutoFill
Safari Login AutoFill A malicious attacker may cause Safari to suggest a password for the wrong domain
7.5
/ 10
High
CVSS v3.1
ADVISORY ID
PS35
PUBLISHED
2022-10-03
CVE IDs
CVE-2020-9903
VENDORS
Apple
PUBLIC EXPLOIT
None indexed
CWE
CWE-346
PRODUCT
Safari (macOS/iOS/iPadOS)
CVSS VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
.png)
Summary
Overview
Safari Login AutoFill
A malicious attacker may cause Safari to suggest a password for the wrong domain
Vulnerability details
Vulnerability details
CVE-2020-9903
CWE-346
High | 7.5
Safari Login AutoFill A malicious attacker may cause Safari to suggest a password for the wrong domain
Auth:
None (remote)
Impact:
Arbitrary data or code modification
DISCLOSURE
Disclosure timeline
2020-03-22 reported to the vendor
2020-07-15 fixed released by the vendor
References
2026-06-17 (NVD record)
Credits
Nikhil Mittal
Related Advisories
jscript.dll - ActiveXObject BSTR - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
Browser
Memory Corruption
CWE-787
2022-09-27
High
Adobe Reader Out-Of-Bounds Read Information Disclosure Vulnerability
Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe…
Desktop Software
Memory Corruption
CWE-125
2022-10-01
Medium
Opera Mini Location Permission Spoof
Opera Mini Location Permission Spoof Vulnerability A location permission spoof vulnerability was discovered in opera mini 47.1.2249.129326 for Android which allows an attacker to spoof location…
Browser
Spoofing
2022-10-01
Medium
Concerned about a similar issue in your product?
Payatu's researchers find these vulnerabilities before attackers do. Talk to us about product, firmware and IoT security testing.
