CVSS: 7.5EPSS: 25%CPEs: 76EXPL: 1CVE-2013-5704 – httpd: bypass of mod_headers rules via chunked requests
https://notcve.org/view.php?id=CVE-2013-5704
15 Apr 2014 — The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such." El módulo mod_headers en el servidor de Apache HTTP 2.2.22 permite a atacantes remotos evadir directivas "RequestHeader unset" mediante la colocación de una cabera en la porción "trailer" de datos enviados con codificación de tran... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 3%CPEs: 4EXPL: 6CVE-2011-3336 – Libc - 'regcomp()' Stack Exhaustion Denial of Service
https://notcve.org/view.php?id=CVE-2011-3336
14 Mar 2014 — regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. regcomp en la implementación BSD de libc, es vulnerable a una denegación de servicio debido al agotamiento de la pila. Mac OS X, Safari, Firefox and Kaspersky all suffer from a regular expression denial of service condition that was discovered long ago in regcomp(). • https://packetstorm.news/files/id/125725 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 59EXPL: 0CVE-2014-0106 – sudo: certain environment variables not sanitized when env_reset is disabled
https://notcve.org/view.php?id=CVE-2014-0106
06 Mar 2014 — Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. Sudo 1.6.9 anterior a 1.8.5, cuando env_reset está deshabilitada, no comprueba debidamente variables de entorno para la restricción env_delete, lo que permite a usuarios locales con permisos sudo evadir restricciones de comando a través de una variable de en... • http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2234
https://notcve.org/view.php?id=CVE-2014-2234
05 Mar 2014 — A certain Apple patch for OpenSSL in Apple OS X 10.9.2 and earlier uses a Trust Evaluation Agent (TEA) feature without terminating certain TLS/SSL handshakes as specified in the SSL_CTX_set_verify callback function's documentation, which allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to TEA but not acceptable to that application. Cierto parche de Apple para OpenSSL en Apple OS X 10.9.2 y anteriores utiliza una funcionalidad... • https://hynek.me/articles/apple-openssl-verification-surprises • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0CVE-2014-1265 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1265
26 Feb 2014 — The systemsetup program in the Date and Time subsystem in Apple OS X before 10.9.2 allows local users to bypass intended access restrictions by changing the current time on the system clock. El programa systemsetup en el subsistema de fecha y hora en Apple OS X anterior a 10.9.2 permite a usuarios locales evadir restricciones de acceso mediante el cambio la hora actual en el reloj del sistema. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses multiple security issues includin... • http://support.apple.com/kb/HT6150 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 21EXPL: 0CVE-2014-1259 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1259
26 Feb 2014 — Buffer overflow in File Bookmark in Apple OS X before 10.9.2 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted filename. Desbordamiento de buffer en File Bookmark en Apple OS X anterior a 10.9.2 permite a atacantes ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de un nombre de archivo manipulado. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses multiple security issues incl... • http://support.apple.com/kb/HT6150 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 32EXPL: 0CVE-2014-1269 – Apple Security Advisory 2014-03-10-2
https://notcve.org/view.php?id=CVE-2014-1269
26 Feb 2014 — WebKit, as used in Apple Safari before 6.1.2 and 7.x before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-1268 and CVE-2014-1270. WebKit, tal como es utilizado en Apple Safari anterior a 6.1.2 y 7.x anterior a 7.0.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de ... • http://support.apple.com/kb/HT6145 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2014-1257 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1257
26 Feb 2014 — CFNetwork in Apple OS X through 10.8.5 does not remove session cookies upon a Safari reset action, which allows physically proximate attackers to bypass intended access restrictions by leveraging an unattended workstation. CFNetwork en Apple OS X hasta 10.8.5 no elimina cookies de sesión en una acción de restablecimiento de Safari, lo que permite a atacantes físicamente próximos evadir restricciones de acceso mediante el aprovechamiento de una estación de trabajo desatendida. OS X Mavericks 10.9.2 and Secur... • http://support.apple.com/kb/HT6150 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2014-1260 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1260
26 Feb 2014 — QuickLook in Apple OS X through 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Microsoft Office document. QuickLook en Apple OS X hasta 10.8.5 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria o caída de aplicación) a través de un documento de Microsoft Office manipulado. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresse... • http://support.apple.com/kb/HT6150 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1261 – Apple Security Advisory 2014-02-25-1
https://notcve.org/view.php?id=CVE-2014-1261
26 Feb 2014 — Integer signedness error in CoreText in Apple OS X before 10.9.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Unicode font. Error de signo de enteros en CoreText en Apple OS X anterior a 10.9.2 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (caída de aplicación) a través de una fuente Unicode manipulada. OS X Mavericks 10.9.2 and Security Update 2014-001 is now available and addresses multiple sec... • http://support.apple.com/kb/HT6150 • CWE-189: Numeric Errors •