CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0508
https://notcve.org/view.php?id=CVE-2010-0508
Mail in Apple Mac OS X before 10.6.3 does not disable the filter rules associated with a deleted mail account, which has unspecified impact and attack vectors. Mail en Apple Mac OS X en versiones anteriores a la v10.6.3 no deshabilita las reglas de filtrado asociadas con una cuenta de correo eliminada, lo que tiene un impacto y vectores de ataque sin especificar. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 •
CVSS: 6.8EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0063
https://notcve.org/view.php?id=CVE-2010-0063
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari, as demonstrated by the values for the (1) .ibplugin and (2) .url extensions. Vulnerabilidad de lista negra incompleta en CoreTypes en Apple Mac OS X anterior v10.6.3 hace que sea fácil para atacantes asistidos por usuario ejecutar JavaScript de su elección a través de una página web que ofrece una descarga con un valor content-Type que no está en la lista de contenido posiblemente inseguro de Safari, como quedó demostrado con los valores para las extensiones (1) .ibplugin y(2) .url • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 •
CVSS: 7.2EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0498
https://notcve.org/view.php?id=CVE-2010-0498
Directory Services in Apple Mac OS X before 10.6.3 does not properly perform authorization during processing of record names, which allows local users to gain privileges via unspecified vectors. Directory Services de Apple Mac OS X anterior a v10.6.3 no autoriza correctamente durante el procesamiento de nombres guardados, esto permite a usuarios locales aumentar privilegios a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 3%CPEs: 26EXPL: 0CVE-2010-0497 – Apple OS X Internet Enabled Disk Image Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0497
Disk Images in Apple Mac OS X before 10.6.3 does not provide the expected warning for an unsafe file type in an internet enabled disk image, which makes it easier for user-assisted remote attackers to execute arbitrary code via a package file type. Disk Images en Apple Mac OS X anteriores a v10.6.3 no proporciona la advertencia esperada de tipo de fichero inseguro en una imagen de disco habilitada para internet, lo cual facilita a atacantes remotos asistidos por usuarios ejecutar código a su elección a través del tipo de fichero del paquete. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists in the handling of internet enabled disk image files. When a specially crafted Menu Extras plugin is included in the disk image, it is executed without further interaction allowing for arbitrary code execution under the context of the current user. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 •
CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 0CVE-2010-0500
https://notcve.org/view.php?id=CVE-2010-0500
Event Monitor in Apple Mac OS X before 10.6.3 does not properly validate hostnames of SSH clients, which allows remote attackers to cause a denial of service (arbitrary client blacklisting) via a crafted DNS PTR record, related to a "plist injection issue." El Monitor de Eventos (Event Monitor) de Apple Mac OS X en versiones anteriores a la v10.6.3 no valida apropiadamente los nombres de equipo (hostnames) de los clientes SSH, lo que permite a atacantes remotos provocar una denegación de servicio (añadido a lista negra de un cliente de su elección) a través de un registro DNS PTR modificado. Relacionado con la inyección en plist. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://support.apple.com/kb/HT4077 • CWE-20: Improper Input Validation •