CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2009-2836
https://notcve.org/view.php?id=CVE-2009-2836
10 Nov 2009 — Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, when at least one account has a blank password, allows attackers to bypass password authentication and obtain login access to an arbitrary account via unspecified vectors. Race condition en Login Window en Apple Mac OS X v10.6.x anterior v10.6.2, cuando al menos una cuenta tiene el password en blanco, permite a atacantes superar la autenticación de password y obtener acceso a una cuenta arbitraria a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2009-2826
https://notcve.org/view.php?id=CVE-2009-2826
10 Nov 2009 — Multiple integer overflows in CoreGraphics in Apple Mac OS X 10.5.8 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document that triggers a heap-based buffer overflow. Múltiples desbordamiento de búfer en CoreGraphics en Apple Mac OS X v10.5.8 permite a atacantes remotos ejecutar código a su elección o causar una denegación de servicio (caída de programa) a través de documentos PDF manipulados que provoca desbordamiento de búfer basado en ... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-189: Numeric Errors •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2009-2831
https://notcve.org/view.php?id=CVE-2009-2831
10 Nov 2009 — Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents, and thereby execute arbitrary code, via crafted JavaScript, related to a "design issue." Diccionario en Apple Mac OS X v10.5.8 permite a atacantes remotos crear archivos arbitrarios con cualquier contenido, y por tanto ejecutar código arbitrario a través de JavaScript manipulado, en relación con un "problema de diseño". • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2829
https://notcve.org/view.php?id=CVE-2009-2829
10 Nov 2009 — Event Monitor in Apple Mac OS X 10.5.8 does not properly handle crafted authentication data sent to an SSH daemon, which allows remote attackers to cause a denial of service via vectors involving processing of XML log documents by other services, related to a "log injection" issue. Event Monitor en Apple Mac OS X v10.5.8 no maneja adecuadamente los datos de autenticación manipulados enviados al demonio SSH, lo que permite a atacantes remotos causar una denegación de servicio a través de vectores involucrado... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-2819
https://notcve.org/view.php?id=CVE-2009-2819
10 Nov 2009 — AFP Client in Apple Mac OS X 10.5.8 allows remote AFP servers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via unspecified vectors. AFP Client in Apple Mac OS X v10.5.8, permite a servidores AFP ejecutar comandos de su elección o provocar una denegación de servicio (corrupción de memoria o caída de aplicación) a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-399: Resource Management Errors •
CVSS: 7.4EPSS: 0%CPEs: 118EXPL: 0CVE-2009-2808
https://notcve.org/view.php?id=CVE-2009-2808
10 Nov 2009 — Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site, which allows man-in-the-middle attackers to send a crafted help:runscript link, and thereby execute arbitrary code, via a spoofed response. Help Viewer en Apple Mac OS X anterior a v10.6.2 no utiliza una conexión HTTPS que obtiene contenido Apple Help desde una página web, lo que permite a atacantes hombre-en-el-medio (man-in-the-middle) enviar un enlace help:runscript, y de ese modo ... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-310: Cryptographic Issues •
CVSS: 7.1EPSS: 0%CPEs: 118EXPL: 0CVE-2009-2835
https://notcve.org/view.php?id=CVE-2009-2835
10 Nov 2009 — The kernel in Apple Mac OS X before 10.6.2 does not properly handle task state segments, which allows local users to gain privileges, cause a denial of service (system crash), or obtain sensitive information via unspecified vectors. El núcleo de Apple Mac OS X anterior a v10.6.2 no controla correctamente los segmentos de estado de la tarea, lo que permite a usuarios locales obtener privilegios, provocar una denegación de servicio (cuelgue del sistema), u obtener información sensible a través de vectores no ... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 118EXPL: 0CVE-2009-2825
https://notcve.org/view.php?id=CVE-2009-2825
10 Nov 2009 — Certificate Assistant in Apple Mac OS X before 10.6.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Certificate Assistant en Apple Mac OS X anterior a v10.6.2 no controla correctamente un caracter '\0' en el nombre de dominio en el campo nombre comú... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-310: Cryptographic Issues •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-2833
https://notcve.org/view.php?id=CVE-2009-2833
10 Nov 2009 — Buffer overflow in the UCCompareTextDefault API in International Components for Unicode in Apple Mac OS X 10.5.8 allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. Desbordamiento de búfer en el API de UCCompareTextDefault en International Components para Unicode en Apple Mac OS X v10.5.8 permite a atacantes dependientes de contexto ejecutar código arbitrario o causar una denegación de servicio (cuelgue de aplicación) a travé... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-2839
https://notcve.org/view.php?id=CVE-2009-2839
10 Nov 2009 — Screen Sharing in Apple Mac OS X 10.5.8 allows remote VNC servers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors. Screen Sharing in Apple Mac OS X v10.5.8 permite a servidores VNC remotos ejecutar código a su elección o causar una denegación de servicio (consumo de memoria y caída de programa) a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html • CWE-399: Resource Management Errors •