Page 38 of 613 results (0.011 seconds)

CVSS: 4.3EPSS: 0%CPEs: 118EXPL: 1

CVE-2009-2820 – CUPS - 'kerberos' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2009-2820

The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues. CUPS en Apple Mac OS X anterior a v10.6.2no maneja adecuadamente (1) las cabeceras HTTP y (2) las plantillas HTML, lo que permite a atacantes remotos dirigir ataques de petición de sitios cruzados (XSS) y ataques de separación de respuesta HTTP a través de vectores relacionados con (a) la interfaz web del producto, (b) la configuración del sistema de impresión, y (c) los títulos de los trabajos impresos. • https://www.exploit-db.com/exploits/10001 http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://secunia.com/advisories/37308 http://secunia.com/advisories/37360 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021115.1-1 http://support.apple.com/kb/HT3937 http://www.cups.org/articles.php?L590 http://www.cups.org/documentation.php/relnotes.html http://www.cups.org/str.php?L3367 http://www.mandriva.com/security/advisories?name=MDVSA-2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 118EXPL: 0

CVE-2009-2808

https://notcve.org/view.php?id=CVE-2009-2808

Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site, which allows man-in-the-middle attackers to send a crafted help:runscript link, and thereby execute arbitrary code, via a spoofed response. Help Viewer en Apple Mac OS X anterior a v10.6.2 no utiliza una conexión HTTPS que obtiene contenido Apple Help desde una página web, lo que permite a atacantes hombre-en-el-medio (man-in-the-middle) enviar un enlace help:runscript, y de ese modo ejecutar código de su elección, a través de una respuesta suplantada. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://support.apple.com/kb/HT3937 http://www.securityfocus.com/bid/36956 http://www.vupen.com/english/advisories/2009/3184 • CWE-310: Cryptographic Issues •

CVSS: 6.8EPSS: 1%CPEs: 4EXPL: 0

CVE-2009-2805

https://notcve.org/view.php?id=CVE-2009-2805

Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JBIG2 stream in a PDF file, leading to a heap-based buffer overflow. Desbordamiento de entero en CoreGraphics de Apple Mac OS X v10.4.11 y v10.5.8, permite a atacantes remotos ejecutar código de su elección o probocar una denegación de servicio (caída de la aplicación) a través de un flujo JBIG2 en un fichero PDF, conduciendo a un desbordamiento de búfer basado en memoria dinámica. • http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://osvdb.org/57950 http://secunia.com/advisories/36701 http://support.apple.com/kb/HT3865 http://www.securityfocus.com/bid/36358 https://exchange.xforce.ibmcloud.com/vulnerabilities/53167 • CWE-189: Numeric Errors •

CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2009-2803

https://notcve.org/view.php?id=CVE-2009-2803

CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a file with a crafted resource fork. CarbonCore en Apple Mac OS X 10.4.11 y 10.5.8 permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un fichero con una bifurcación de recurso manipulada. • http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://osvdb.org/57948 http://secunia.com/advisories/36701 http://support.apple.com/kb/HT3865 http://www.securityfocus.com/bid/36355 https://exchange.xforce.ibmcloud.com/vulnerabilities/53165 • CWE-399: Resource Management Errors •

CVSS: 6.8EPSS: 4%CPEs: 4EXPL: 0

CVE-2009-2809

https://notcve.org/view.php?id=CVE-2009-2809

ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to "multiple memory corruption issues." ImageIO en Apple Mac OS X 10.4.11 y 10.5.8, permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (caída de aplicación) a través de una imagen PixarFil manipulada codificada con TIFF, relacionado con "múltiples cuestiones de corrupción de memoria". • http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://osvdb.org/57952 http://secunia.com/advisories/36701 http://support.apple.com/kb/HT3865 http://www.securityfocus.com/bid/36359 https://exchange.xforce.ibmcloud.com/vulnerabilities/53170 • CWE-94: Improper Control of Generation of Code ('Code Injection') •