CVSS: 9.8EPSS: 3%CPEs: 78EXPL: 0CVE-2010-1783 – WebKit: multiple vulnerabilities in WebKitGTK
https://notcve.org/view.php?id=CVE-2010-1783
30 Jul 2010 — WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle dynamic modification of a text node, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. WebKit de Apple Safari en versiones anteriores a la v5.0.1 en Mac OS X v10.5 hasta v10.6 y Windows, y anteriores a la v4.1.1 en Mac OS X v10.4, no gesti... • http://lists.apple.com/archives/security-announce/2010//Jul/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 67%CPEs: 6EXPL: 3CVE-2010-0211 – OpenLDAP 2.4.22 - 'modrdn' Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-0211
27 Jul 2010 — The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, uninitialized pointer in the slap_mods_free function, as demonstrated using the Codenomicon LDAPv3 test suite. La función slap_modrdn2mods en modrdn.c e... • https://www.exploit-db.com/exploits/34348 • CWE-252: Unchecked Return Value •
CVSS: 9.8EPSS: 83%CPEs: 31EXPL: 4CVE-2010-1205 – libpng 1.4.2 - Denial of Service
https://notcve.org/view.php?id=CVE-2010-1205
30 Jun 2010 — Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers an additional data row. Desbordamiento de buffer en el fichero pngpread.c en libpng anteriores a 1.2.44 y 1.4.x anteriroes a 1.4.3, como se utiliza en aplicaciones progresivas, podría permitir a atacantes remotos ejecutar código arbitrario mediante una imagen PNG que desencadena una serie de datos adicionales. ... • https://www.exploit-db.com/exploits/14422 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2010-1637 – SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
https://notcve.org/view.php?id=CVE-2010-1637
22 Jun 2010 — The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number. El plugin Mail Fetch en SquirrelMail 1.4.20 y versiones anteriores, permite a atacantes remotos autenticados eludir las restricciones del firewall y usar SquirrelMail como un proxy para escanear redes internas mediante un número de puerto POP3 modificado. • http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2010-0541 – Ruby WEBrick javascript injection flaw
https://notcve.org/view.php?id=CVE-2010-0541
17 Jun 2010 — Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el servidor HTTP WEBrick en Ruby en Apple Mac OS X v10.5.8 y v10.6 antes de v10.6.4, permite a atacantes remotos inyectar HTML o secuencias de comandos weba través de una URI debidamente modificada q... • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 32EXPL: 0CVE-2010-1374
https://notcve.org/view.php?id=CVE-2010-1374
17 Jun 2010 — Directory traversal vulnerability in iChat in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, when AIM is used, allows remote attackers to create arbitrary files via directory traversal sequences in an inline image-transfer operation. Vulnerabilidad de salto de directorio en iChat en Apple Mac OS X v10.5.8 y v10.6 antes de v10.6.4, cuando el objetivo se utiliza, permite a atacantes remotos crear ficheros arbitrarios mediante secuencias de salto de directorio en una operación de transferencia de un archivo de... • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2010-0543
https://notcve.org/view.php?id=CVE-2010-0543
17 Jun 2010 — ImageIO in Apple Mac OS X 10.5.8, and 10.6 before 10.6.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with MPEG2 encoding. ImageIO en Apple Mac OS X v10.5.8 y v10.6 antes de v10.6.2 permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (por corrupción de memoria y caída de la aplicación) a través de un archivo de película debidamente modificado con codificación MPEG2... • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.4EPSS: 0%CPEs: 10EXPL: 0CVE-2010-1382
https://notcve.org/view.php?id=CVE-2010-1382
17 Jun 2010 — Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote authenticated users to inject arbitrary web script or HTML via crafted Wiki content, related to lack of a charset field. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Wiki Server de Apple Mac OS X v10.5.8, y v10.6 anterior a v10.6.4, permite a usuarios autenticados en remotos, inyectar secuencias de comandos web de su elección o HTML a través de contenidos Wiki manip... • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 10EXPL: 0CVE-2010-0546
https://notcve.org/view.php?id=CVE-2010-0546
17 Jun 2010 — Folder Manager in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows local users to delete arbitrary folders via a symlink attack in conjunction with an unmount operation on a crafted volume, related to the Cleanup At Startup folder. El administrador de carpetas de Apple Mac OS X v10.5.8 y v10.6 antes de v10.6.4, permite a usuarios locales borrar las carpetas de su elección mediante un ataque de enlace simbólico junto con una operación de desmontaje (umount) de un volumen debidamente modificado. Es una v... • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 1%CPEs: 8EXPL: 0CVE-2010-1376
https://notcve.org/view.php?id=CVE-2010-1376
17 Jun 2010 — Multiple format string vulnerabilities in Network Authorization in Apple Mac OS X 10.6 before 10.6.4 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) afp, (2) cifs, or (3) smb URL. Múltiples vulnerabilidades de formato de cadena en "Network Authorization" en Apple Mac OS X v10.6 antes de v10.6.4 permiten a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (por caída de la aplicación) a travé... • http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html • CWE-134: Use of Externally-Controlled Format String •