Unscored severity · published May 2, 2005
CVE-2005-0976
AppleWebKit (WebCore and WebKit), as used in multiple products such as Safari 1.2 and OmniGroup OmniWeb 5.1, allows remote attackers to read arbitrary files via the XMLHttpRequest…
–
CVSS
1.8%
EPSS
No
On KEV
Description
AppleWebKit (WebCore and WebKit), as used in multiple products such as Safari 1.2 and OmniGroup OmniWeb 5.1, allows remote attackers to read arbitrary files via the XMLHttpRequest Javascript component, as demonstrated using automatically mounted disk images and file:// URLs.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
Omniweb · Omnigroup
5.1 · source: NVD
SA
Safari · Apple
1.2 · source: NVD
SH
Shiira · Hmdt
0.93 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-0976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-0976
lists.apple.com
http://lists.apple.com/archives/security-announce/2005/Apr/msg00000.html
Exploit
http://remahl.se/david/vuln/001/
More from Safari
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
8.8
CVE-2025-43529
Apple Multiple Products Use-After-Free WebKit Vulnerability
8.8
CVE-2025-14174
Google Chromium Out of Bounds Memory Access Vulnerability
8.8
CVE-2023-43000
Apple Multiple products Use-After-Free Vulnerability
8.8
CVE-2025-31277
Apple Multiple Products Buffer Overflow Vulnerability