{"id":"CVE-2015-3729","aliases":["EUVD-2015-3765","GHSA-fw58-f9hm-xghp"],"status":"published","title":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1...","description":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02165,"percentile":0.82351,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-254"],"published":"2015-08-16T23:00:00Z","modified":"2026-06-17T00:26:10Z","products":[{"vendor":"apple","product":"safari"}],"references":[{"url":"http://www.securitytracker.com/id/1033274","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://support.apple.com/kb/HT205030","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/76342","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Vendor Advisory"]},{"url":"https://support.apple.com/kb/HT205033","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3729"},{"url":"https://github.com/advisories/GHSA-fw58-f9hm-xghp"}],"sources":{"cve":[{"id":"CVE-2015-3729","description":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","status":"published","published":"2015-08-16T23:00:00Z","modified":"2024-08-06T05:56:15.225Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2015-3765","description":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","status":"published","published":"2015-08-16T23:00:00Z","modified":"2024-08-06T05:56:15Z","updated_at":"2026-11-03T02:22:06.756432Z"}],"ghsa":[{"id":"GHSA-fw58-f9hm-xghp","title":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1...","description":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","status":"published","published":"2022-05-14T01:35:43Z","modified":"2023-02-02T05:03:55Z","updated_at":"2026-11-02T14:51:44.834559Z"}],"nvd":[{"id":"CVE-2015-3729","description":"Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.","status":"published","published":"2015-08-16T23:59:01.41Z","modified":"2026-06-17T00:26:10.863Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:08.998581Z"}]}}