CVSS: 7.6EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3213 – Apple Security Advisory 2011-10-12-3
https://notcve.org/view.php?id=CVE-2011-3213
13 Oct 2011 — The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.509 certificate that a user manually accepted for an initial https WebDAV connection, which allows man-in-the-middle attackers to hijack WebDAV communication by presenting an arbitrary certificate for a subsequent connection. El componente File Systems en Apple Mac OS X anterior a v10.7.2 no lleva correctamente el certificado específico X.509 que un usuario manualmente ha aceptado para una conexión inicial http... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3216 – Apple Security Advisory 2011-10-12-3
https://notcve.org/view.php?id=CVE-2011-3216
13 Oct 2011 — The kernel in Apple Mac OS X before 10.7.2 does not properly implement the sticky bit for directories, which might allow local users to bypass intended permissions and delete files via an unlink system call. El kernel en Apple Mac OS X anterior a v10.7.2 no aplicar correctamente el sticky bit en los directorios, lo que podría permitir a usuarios locales eludir los permisos y eliminar archivos a través de una llamada al sistema no enlazada OS X Lion has a security update available that addresses findings in ... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 136EXPL: 0CVE-2011-0231 – Apple Security Advisory 2011-10-12-3
https://notcve.org/view.php?id=CVE-2011-0231
13 Oct 2011 — CFNetwork in Apple Mac OS X before 10.7.2 does not properly follow an intended cookie-storage policy, which makes it easier for remote web servers to track users via a cookie, related to a "synchronization issue." CFNetwork en Apple Mac OS X v10.7.2 no aplica de forma adecuada la política de almacenamiento de cookies, lo que hace que sea fácil para servidores Web remotos rastrear a los usuarios a través de una cookie, en relación con un "problema de sincronización". OS X Lion has a security update available... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 99EXPL: 0CVE-2011-3242 – Apple Security Advisory 2011-10-12-4
https://notcve.org/view.php?id=CVE-2011-3242
13 Oct 2011 — The Private Browsing feature in Apple Safari before 5.1.1 on Mac OS X does not properly recognize the Always value of the Block Cookies setting, which makes it easier for remote web servers to track users via a cookie. La característica de navegación privada en Apple Safari antes de v5.1.1 en Mac OS X no reconoce adecuadamente el valor "Always" de la caracteristica "Block Cookies", lo que hace más sencillo para servidores remotos localizar a usuarios a través de una cookie. Safari version 5.1.1 is now avail... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 72%CPEs: 99EXPL: 3CVE-2011-3230 – Apple Safari - 'file://' Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2011-3230
13 Oct 2011 — Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site. Apple Safari anterior a v5.1.1 en Mac OS X no aplica una política destinada a archivo: URLs, que permiten a atacantes remotos ejecutar código arbitrario a través de un sitio web diseñado. Safari version 5.1.1 is now available and addresses a directory traversal issue, a policy issue, various arbitrary code execution issues, and 40+ other vu... • https://packetstorm.news/files/id/105827 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3220 – Apple Quicktime Empty URL Data Handler Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-3220
13 Oct 2011 — QuickTime in Apple Mac OS X before 10.7.2 does not properly process URL data handlers in movie files, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file. QuickTime en Apple Mac OS X anterior a v10.7.2 no procesa correctamente los datos de los manipuladores URL de los archivos de película, lo que permite a atacantes remotos obtener información sensible desde memoria no inicializada mediante un fichero especialmente diseñado. This vulnerability... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 132EXPL: 1CVE-2011-3224 – Mac App Store Man-In-The-Middle / Remote Command Execution
https://notcve.org/view.php?id=CVE-2011-3224
13 Oct 2011 — The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server. El componente User Documentation en Apple Mac OS X hasta v10.6.8 usa sesiones http para las actualizaciones a información de ayuda de la APP Store, permitiendo a atacantes de "hombre en medio" ejecutar código arbitrario mediante la suplantación de un servidor http. OS X Lion has a securi... • https://packetstorm.news/files/id/105826 •
CVSS: 8.8EPSS: 0%CPEs: 136EXPL: 0CVE-2011-3227 – Apple Security Advisory 2011-10-12-3
https://notcve.org/view.php?id=CVE-2011-3227
13 Oct 2011 — libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a nonstandard extension in a Certificate Revocation list (CRL), which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) a crafted (1) web site or (2) e-mail message. libsecurity en Apple Mac OS X antes de v10.7.2 no controla correctamente los errores durante el procesamiento de una extensión no estándar en la lista de certificados revocados (CRL), lo que permite a... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 99EXPL: 0CVE-2011-3231 – Apple Security Advisory 2011-10-12-4
https://notcve.org/view.php?id=CVE-2011-3231
13 Oct 2011 — The SSL implementation in Apple Safari before 5.1.1 on Mac OS X before 10.7 accesses uninitialized memory during the processing of X.509 certificates, which allows remote web servers to execute arbitrary code via a crafted certificate. La implementación SSL en Apple Safari anterior a v5.1.1 en MAC OS X anterior a v10.7 accede a memoria no inicializada durante el procesamiento de certificados X.509, permitiendo a servidores web remotos ejecutar código arbitrario mediante una certificado manipulado. Safari ve... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00004.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 1%CPEs: 136EXPL: 0CVE-2011-0230 – Apple Security Advisory 2011-10-12-3
https://notcve.org/view.php?id=CVE-2011-0230
13 Oct 2011 — Buffer overflow in the ATSFontDeactivate API in Apple Type Services (ATS) in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. Desbordamiento de búfer en la API de ATSFontDeactivate en Apple Type Services (ATS) en Apple Mac OS X v10.7.2 y anteriores que permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (caída de aplicación) a través de vectores no especificados.... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •