CVE-2008-1005 json
WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri inp…
published 2008-03-19 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1016
- cvss
- 2.1
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
WebCore, as used in Apple Safari before 3.1, does not properly mask the password field when reverse conversion is used with the Kotoeri input method, which allows physically proximate attackers to read the password.
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
lists.apple.com
/archives/security-announce/2008/Mar/msg00000.html
vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/41329
vdb-entry
-
securitytracker.com
/id?1019656
vdb-entry
-
us-cert.gov
/cas/techalerts/TA08-079A.html
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/28290
vdb-entry
- docs.info.apple.com /article.html?artnum=307563
-
securityfocus.com
/bid/28326
vdb-entry
-
vupen.com
/english/advisories/2008/0920/references
vdb-entry
-
secunia.com
/advisories/29393
third-party-advisory
Sources
- CVE List CVE-2008-1005
- NVD CVE-2008-1005
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.