CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1146 – Apple Security Advisory 2015-04-08-2
https://notcve.org/view.php?id=CVE-2015-1146
09 Apr 2015 — The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass intended access restrictions via a crafted bundle, a different vulnerability than CVE-2015-1145. La implentación Code Signing en Apple OS X anterior a 10.10.3 no valida correctamente las firmas, lo que permite a usuarios locales evadir las restricciones de acceso a través de un paquete manipulado, una vulnerabilidad diferente a CVE-2015-1145. OS X Yosemite 10.10.3 and Securi... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-310: Cryptographic Issues •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1145 – Apple Security Advisory 2015-04-08-2
https://notcve.org/view.php?id=CVE-2015-1145
09 Apr 2015 — The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass intended access restrictions via a crafted bundle, a different vulnerability than CVE-2015-1146. La implementación Firma de Código (Code Signing) en Apple OS X anterior a 10.10.3 no valida correctamente firmas, lo que permite a usuarios locales evadir las restricciones de acceso a través de un paquete manipulado, una vulnerabilidad diferente a CVE-2015-1146. OS X Yosemite 10... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-310: Cryptographic Issues •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1138 – Apple Security Advisory 2015-04-08-2
https://notcve.org/view.php?id=CVE-2015-1138
09 Apr 2015 — Hypervisor in Apple OS X before 10.10.3 allows local users to cause a denial of service via unspecified vectors. Hypervisor en Apple OS X anterior a 10.10.3 permite a usuarios locales causar una denegación de servicio a través de vectores no especificados. OS X Yosemite 10.10.3 and Security Update 2015-004 are now available and address privilege escalation, code execution, information disclosure, and various other vulnerabilities. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1148 – Apple Security Advisory 2015-04-08-2
https://notcve.org/view.php?id=CVE-2015-1148
09 Apr 2015 — Screen Sharing in Apple OS X before 10.10.3 stores the password of a user in a log file, which might allow context-dependent attackers to obtain sensitive information by reading this file. Screen Sharing en Apple OS X anterior a 10.10.3 almacena la contraseña de un usuario en un fichero del registro, lo que podría permitir a atacantes dependientes de contexto obtener información sensible mediante la lectura de este fichero. OS X Yosemite 10.10.3 and Security Update 2015-004 are now available and address pri... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2015-1136 – Apple Security Advisory 2015-04-08-2
https://notcve.org/view.php?id=CVE-2015-1136
09 Apr 2015 — Use-after-free vulnerability in CoreAnimation in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code by leveraging improper use of a mutex. Vulnerabilidad de uso después de liberación en CoreAnimation en Apple OS X anterior a 10.10.3 permite a atacantes remotos ejecutar código arbitrario mediante el aprovechamiento del uso indebido de un mutex. OS X Yosemite 10.10.3 and Security Update 2015-004 are now available and address privilege escalation, code execution, information disclosure... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-1101 – Apple OS X XNU HFS_GETPATH Buffer Overflow Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2015-1101
08 Apr 2015 — The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. El kernel en Apple iOS anterior a 8.3, Apple OS X anterior a 10.10.3, y Apple TV anterior a 7.2 permite a atacantes ejecutar código arbitrario en un contexto privilegiado o causar una denegación de servicio (corrupción de memoria) a través de una aplicación manipulada. This vulnerability a... • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html •
CVSS: 9.8EPSS: 0%CPEs: 60EXPL: 1CVE-2015-2348 – php: move_uploaded_file() NUL byte injection in file name
https://notcve.org/view.php?id=CVE-2015-2348
30 Mar 2015 — The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. La implementación move_uploaded_file en ext/standard/basic_functions.c en PHP anterior a 5.4.39... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=1291d6bbee93b6109eb07e8f7916ff1b7fcc13e1 • CWE-264: Permissions, Privileges, and Access Controls CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 9.8EPSS: 17%CPEs: 66EXPL: 1CVE-2015-2787 – php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re
https://notcve.org/view.php?id=CVE-2015-2787
30 Mar 2015 — Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231. Vulnerabilidad de uso después de liberación en la función process_nested_data en ext/standard/var_unserializer.re en PHP anterior a 5.4.39, 5.5.x anterior a 5.5... • http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 21EXPL: 2CVE-2014-8129 – libtiff: out-of-bounds read/write with malformed TIFF image in tiff2pdf
https://notcve.org/view.php?id=CVE-2014-8129
30 Mar 2015 — LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by failure of tif_next.c to verify that the BitsPerSample value is 2, and the t2p_sample_lab_signed_to_unsigned function in tiff2pdf.c. LibTIFF 4.0.3 permite que atacantes remotos provoquen una denegación de servicio (escritura fuera de límites) u otro tipo de impacto sin especificar mediante una imagen TIFF manipulada. Esto se demuestra... • http://bugzilla.maptools.org/show_bug.cgi?id=2487 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-8128 – Gentoo Linux Security Advisory 201701-16
https://notcve.org/view.php?id=CVE-2014-8128
30 Mar 2015 — LibTIFF prior to 4.0.4, as used in Apple iOS before 8.4 and OS X before 10.10.4 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image. LibTIFF versiones anteriores a 4.0.4, como es usado en Apple iOS versiones anteriores a 8.4 y OS X versiones anteriores a 10.10.4 y otros productos, permite a atacantes remotos causar una denegación de servicio (escritura fuera de límites) por medio de una imagen TIFF diseñada. William Robinet discovered that ... • http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html • CWE-787: Out-of-bounds Write •