CVSS: 9.8EPSS: 0%CPEs: 99EXPL: 0CVE-2011-3231
https://notcve.org/view.php?id=CVE-2011-3231
14 Oct 2011 — The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate. La implementación SSL en Apple Safari anterior a v5.1.1 en MAC OS X anterior a v10.7 accede a memoria no inicializada durante el procesamiento de certificados X.509, permitiendo a servidores web remotos ejecutar código arbitrario mediante una certificado manipulado. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.4EPSS: 0%CPEs: 132EXPL: 0CVE-2011-3224
https://notcve.org/view.php?id=CVE-2011-3224
14 Oct 2011 — The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server. El componente User Documentation en Apple Mac OS X hasta v10.6.8 usa sesiones http para las actualizaciones a información de ayuda de la APP Store, permitiendo a atacantes de "hombre en medio" ejecutar código arbitrario mediante la suplantación de un servidor http. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html •
CVSS: 9.8EPSS: 4%CPEs: 10EXPL: 0CVE-2011-2834 – libxml2: double-free caused by malformed XPath expression in XSLT
https://notcve.org/view.php?id=CVE-2011-2834
17 Sep 2011 — Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling. Vulnerabilidad de doble liberación en libxml2, tal y como se usa en Google Chrome antes de v14.0.835.163, permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores relacionados con el manejo de XPath. • http://code.google.com/p/chromium/issues/detail?id=93472 • CWE-415: Double Free •
CVSS: 5.9EPSS: 0%CPEs: 18EXPL: 0CVE-2011-3422
https://notcve.org/view.php?id=CVE-2011-3422
10 Sep 2011 — The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari. La implementación del Keychain en Apple Mac OS X v10.6.8 y anteriores no controla correctamente un atributo, no es de confianza un certificado de una autoridad de certificación, lo que ha... • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 2%CPEs: 10EXPL: 0CVE-2011-2821 – libxml2: double free caused by malformed XPath expression in XSLT
https://notcve.org/view.php?id=CVE-2011-2821
29 Aug 2011 — Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath expression. Doble vulnerabilidad libre en libxml2, como se usa en Google Chrome antes de v13.0.782.215, permite a atacantes remotos causar una denegación de servicio o posiblemente tener un impacto no especificado a través de una expresión XPath manipulada. • http://code.google.com/p/chromium/issues/detail?id=89402 • CWE-415: Double Free CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2011-2192 – curl: Improper delegation of client credentials during GSS negotiation
https://notcve.org/view.php?id=CVE-2011-2192
07 Jul 2011 — The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests. La función Curl_input_negotiate en http_negotiate.c en libcurl v7.10.6 a v7.21.6, tal y como se utiliza en curl y otras aplicaciones, siempre lleva a cabo delegación de credenciales durante la autenticación GSSAPI, lo que permite a hacerse pasar po... • http://curl.haxx.se/curl-gssapi-delegation.patch • CWE-255: Credentials Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0CVE-2009-5078 – Gentoo Linux Security Advisory 201310-14
https://notcve.org/view.php?id=CVE-2009-5078
30 Jun 2011 — contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document. contrib/pdfmark/pdfroff.sh en GNU troff (también conocido como groff) antes de v1.21 lanza el programa Ghostscript sin la opcion -dSAFER, lo que permite a usuarios remotos crear, sobrescribir, renombrar o eliminar archivos de su elección a través de un documento manipulado. OS... • ftp://ftp.gnu.org/gnu/groff/groff-1.20.1-1.21.diff.gz • CWE-254: 7PK - Security Features •
CVSS: 5.5EPSS: 0%CPEs: 16EXPL: 0CVE-2009-5044 – Gentoo Linux Security Advisory 201310-14
https://notcve.org/view.php?id=CVE-2009-5044
24 Jun 2011 — contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file. contrib/pdfmark/pdfroff.sh en GNU troff (también conocido como groff) antes de v1.21 permite sobreescribir ficheros de su elección a los usuarios locales a través de un ataque de enlace simbólico sobre un fichero temporal pdf#####.tmp . OS X Yosemite 10.10.5 and Security Update 2015-006 is now available and addresses vulnerabilities in Apache,... • ftp://ftp.gnu.org/gnu/groff/groff-1.20.1-1.21.diff.gz • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 5%CPEs: 8EXPL: 0CVE-2011-1755 – jabberd: DoS via the XML "billion laughs attack"
https://notcve.org/view.php?id=CVE-2011-1755
21 Jun 2011 — jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. jabberd2 antes de v2.2.14 no detecta correctamente la recursividad durante la expansión de la entidad, lo que permite a atacantes remotos provocar una denegación de servicio ( consumo de memoria y CPU ) a través de un documen... • http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog • CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2011-1783 – (mod_dav_svn): DoS (excessive memory use) when configured to provide path-based access control
https://notcve.org/view.php?id=CVE-2011-1783
06 Jun 2011 — The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data. El módulo mod_dav_svn para Apache HTTP Server, como se distribuye en Apache Subersion v1.5.x y v1.6.x antes de 1.6.17, cuando la opción SVNPathAuthz short_circuit está habilitada permite a atacant... • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html •