CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4426 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4426
17 Oct 2014 — AFP File Server in Apple OS X before 10.10 allows remote attackers to discover the network addresses of all interfaces via an unspecified command to one interface. AFP File Server en Apple OS X anterior a 10.10 permite a atacantes remotos descubrir todas las direcciones de red de todas las interfaces a través de un comando no especificado hacia una interfaz. OS X 10.10.2 and Security Update 2015-001 are now available and address information disclosure, arbitrary code execution, cache clearing, integer overf... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4427 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4427
17 Oct 2014 — App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API. App Sandbox en Apple OS X anterior a 10.10 permite a atacantes evadir un mecanismo de protección de sandbox a través de la API de accesabilidad. OS X Yosemite v10.10 is now available and addresses 802.1X, AFP file server, Apache, App Sandbox, and various other vulnerabilities. • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4428 – Apple Security Advisory 2014-10-20-1
https://notcve.org/view.php?id=CVE-2014-4428
17 Oct 2014 — Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing. Bluetooth en Apple OS X anterior a 10.10 no requiere cifrado para dispositivos HID de baja energía, lo que permite a atacantes remotos suplantar un dispositivo mediante el aprovechamiento de un emparejamiento previo. OS X Yosemite v10.10 is now available and addresses 802.1X, AFP file server, Apache, App Sandbox, and various other vulner... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-310: Cryptographic Issues •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4430 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4430
17 Oct 2014 — CoreStorage in Apple OS X before 10.10 retains a volume's encryption keys upon an eject action in the unlocked state, which makes it easier for physically proximate attackers to obtain cleartext data via a remount. CoreStorage en Apple OS X anterior a 10.10 retiene una clave de cifrado del volumen hasta la acción de expulsión en el estado de desbloqueo, lo que facilita a un atacante físicamente próximo obtener datos en claro al volver a montar la unidad. OS X Yosemite v10.10 is now available and addresses 8... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-310: Cryptographic Issues •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4431 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4431
17 Oct 2014 — Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows by leveraging an unattended workstation. Dock en Apple OS X anterior a 10.10 no gestiona debidamente el estado de la pantalla de bloqueo, lo que permite a atacantes físicamente próximos ver ventanas mediante el aprovechamiento de una estación de trabajo desatendida. OS X Yosemite v10.10 is now available and addresses 802.1X, AFP file server, Apache, App Sandbox, and var... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4432 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4432
17 Oct 2014 — fdesetup in Apple OS X before 10.10 does not properly display the encryption status in between a setting-update action and a reboot action, which might make it easier for physically proximate attackers to obtain cleartext data by leveraging ignorance of the reboot requirement. fdesetup en Apple OS X anterior a 10.10 no muestra correctamente el estado de cifrado entre una acción de actualización de la configuración y una acción de reinicio, lo que podría facilitar a un atacante físicamente próximo obtener da... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-310: Cryptographic Issues •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 3CVE-2014-4434 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4434
17 Oct 2014 — The kernel in Apple OS X before 10.10 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted filename on an HFS filesystem. El kernel en Apple OS X anterior a 10.10 permite a atacantes físicamente próximos causar una denegación de servicio (referencia a puntero nulo y caída del sistema) a través de un nombre de fichero manipulado en un sistema de archivos HFS. OS X Yosemite v10.10 is now available and addresses 802.1X, AFP file server, Ap... • https://packetstorm.news/files/id/134091 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4435 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4435
17 Oct 2014 — The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots. La característica 'iCloud Find My Mac' en Apple OS X anterior a 10.10 no fuerza debidamente el límite de velocidad en la entrada del PIN en el modo perdido, lo que facilita a atacantes físicamente próximos obtener acceso a través de un ataque de fuerza bruta... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-287: Improper Authentication •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4437 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4437
17 Oct 2014 — LaunchServices in Apple OS X before 10.10 allows attackers to bypass intended sandbox restrictions via an application that specifies a crafted handler for the Content-Type field of an object. LaunchServices en Apple OS X anterior a 10.10 permite a atacantes evadir restricciones de sandbox a través de una aplicación que especifica un manejador manipulado para el campo Content-Type de un objeto. OS X Yosemite v10.10 is now available and addresses 802.1X, AFP file server, Apache, App Sandbox, and various other... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4438 – Apple Security Advisory 2014-10-16-1
https://notcve.org/view.php?id=CVE-2014-4438
17 Oct 2014 — Race condition in LoginWindow in Apple OS X before 10.10 allows physically proximate attackers to obtain access by leveraging an unattended workstation on which screen locking had been attempted. Condición de carrera en LoginWindow en Apple OS X anterior a 10.10 permite a atacantes físicamente próximos obtener acceso mediante el aprovechamiento de una estación de trabajo desatendida en la cual se ha intentado bloquear la pantalla. OS X Yosemite v10.10 is now available and addresses 802.1X, AFP file server, ... • http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •