{"api_version":"1","generated_at":"2026-07-23T22:42:32+00:00","cve":"CVE-2016-7650","urls":{"html":"https://cve.report/CVE-2016-7650","api":"https://cve.report/api/cve/CVE-2016-7650.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-7650","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-7650"},"summary":{"title":"CVE-2016-7650","description":"An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the \"Safari Reader\" component, which allows remote attackers to conduct UXSS attacks via a crafted web site.","state":"PUBLISHED","assigner":"apple","published_at":"2017-02-20 08:59:03","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"4.7","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.6","severity":"","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://support.apple.com/HT207421","name":"https://support.apple.com/HT207421","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About the security content of Safari 10.0.2 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/HT207422","name":"https://support.apple.com/HT207422","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About the security content of iOS 10.2 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1037459","name":"http://www.securitytracker.com/id/1037459","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apple Safari Multiple Bugs Let Remote Users Obtain Potentially Sensitive Information, Conduct Cross-Site Scripting Attacks, and Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/94915","name":"http://www.securityfocus.com/bid/94915","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apple Safari and iOS CVE-2016-7650 Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7650","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7650","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"7650","vulnerable":"1","versionEndIncluding":"10.1.1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"7650","vulnerable":"1","versionEndIncluding":"10.0.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"safari","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T02:04:55.615Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"94915","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/94915"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/HT207421"},{"name":"1037459","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1037459"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://support.apple.com/HT207422"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-02-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the \"Safari Reader\" component, which allows remote attackers to conduct UXSS attacks via a crafted web site."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-26T09:57:01.000Z","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","shortName":"apple"},"references":[{"name":"94915","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/94915"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/HT207421"},{"name":"1037459","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1037459"},{"tags":["x_refsource_CONFIRM"],"url":"https://support.apple.com/HT207422"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"product-security@apple.com","ID":"CVE-2016-7650","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the \"Safari Reader\" component, which allows remote attackers to conduct UXSS attacks via a crafted web site."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"94915","refsource":"BID","url":"http://www.securityfocus.com/bid/94915"},{"name":"https://support.apple.com/HT207421","refsource":"CONFIRM","url":"https://support.apple.com/HT207421"},{"name":"1037459","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1037459"},{"name":"https://support.apple.com/HT207422","refsource":"CONFIRM","url":"https://support.apple.com/HT207422"}]}}}},"cveMetadata":{"assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","assignerShortName":"apple","cveId":"CVE-2016-7650","datePublished":"2017-02-20T08:35:00.000Z","dateReserved":"2016-09-09T00:00:00.000Z","dateUpdated":"2024-08-06T02:04:55.615Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-02-20 08:59:03","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:N/I:P/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndIncluding":"10.1.1","matchCriteriaId":"904491D9-AAB8-4754-901C-F5D261BEAC17"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*","versionEndIncluding":"10.0.1","matchCriteriaId":"826BEA13-02E8-4A81-91DE-BED9E05EDDEE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"7650","Ordinal":"1","Title":"CVE-2016-7650","CVE":"CVE-2016-7650","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"7650","Ordinal":"1","NoteData":"An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the \"Safari Reader\" component, which allows remote attackers to conduct UXSS attacks via a crafted web site.","Type":"Description","Title":"CVE-2016-7650"},{"CveYear":"2016","CveId":"7650","Ordinal":"2","NoteData":"2017-02-20","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"7650","Ordinal":"3","NoteData":"2017-07-26","Type":"Other","Title":"Modified"}]}}}