CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5875
https://notcve.org/view.php?id=CVE-2015-5875
Cross-site scripting (XSS) vulnerability in Notes in Apple OS X before 10.11 allows local users to inject arbitrary web script or HTML via crafted text. Vulnerabilidad de XSS en Notes en Apple OS X en versiones anteriores a 10.11 permite a usuarios locales inyectar secuencias de comandos web o HTML arbitrarios a través de un texto manipulado. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://www.securityfocus.com/bid/76908 http://www.securitytracker.com/id/1033703 https://support.apple.com/HT205267 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5914
https://notcve.org/view.php?id=CVE-2015-5914
The EFI component in Apple OS X before 10.11 allows physically proximate attackers to modify firmware during the EFI update process by inserting an Apple Ethernet Thunderbolt adapter with crafted code in an Option ROM, aka a "Thunderstrike" issue. NOTE: this issue exists because of an incomplete fix for CVE-2014-4498. El componente EFI en Apple OS X en versiones anteriores a 10.11 permite a atacantes físicamente próximos modificar el firmware durante el proceso de actualización de EFI insertando un adaptador Apple Ethernet Thunderbolt con código manipulado en una Option ROM, también conocido como un problema 'Thunderstrike'. NOTA: este problema existe debido a una solución incompleta de la vulnerabilidad CVE-2014-4498. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://www.securitytracker.com/id/1033703 https://support.apple.com/HT205267 https://trmm.net/Thunderstrike_FAQ • CWE-17: DEPRECATED: Code •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7761
https://notcve.org/view.php?id=CVE-2015-7761
Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760. Mail en Apple OS X en versiones anteriores a 10.11 no reconoce correctamente las preferencias de usuario, lo que permite a atacantes obtener información sensible a través de una acción no especificada durante la impresión de un mensaje de correo electrónico, una vulnerabilidad diferente a CVE-2015-7760. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://www.securityfocus.com/bid/76908 https://support.apple.com/HT205267 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5870
https://notcve.org/view.php?id=CVE-2015-5870
The debugging interfaces in the kernel in Apple OS X before 10.11 allow local users to obtain sensitive memory-layout information via unspecified vectors. Las interfaces de depuración en el kernel en Apple OS X en versiones anteriores a 10.11 permiten a usuarios locales obtener información sensible de la estructura de memoria a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://www.securityfocus.com/bid/76908 http://www.securitytracker.com/id/1033703 https://support.apple.com/HT205267 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5894
https://notcve.org/view.php?id=CVE-2015-5894
The X.509 certificate-trust implementation in Apple OS X before 10.11 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certificate. La implementación del certificado de confianza X.509 en Apple OS X en versiones anteriores a 10.11 no reconoce que el indicador kSecRevocationRequirePositiveResponse implica un requerimiento de control de revocación, lo que hace más fácil para atacantes man-in-the-middle falsificar terminales mediante el aprovechamiento de acceso a un certificado revocado. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://www.securityfocus.com/bid/76908 http://www.securitytracker.com/id/1033703 https://support.apple.com/HT205267 • CWE-17: DEPRECATED: Code •