CVSS: 6.8EPSS: 1%CPEs: 30EXPL: 0CVE-2008-2309
https://notcve.org/view.php?id=CVE-2008-2309
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.5.4 allows user-assisted remote attackers to execute arbitrary code via a (1) .xht or (2) .xhtm file, which does not trigger a "potentially unsafe" warning message in (a) the Download Validation feature in Mac OS X 10.4 or (b) the Quarantine feature in Mac OS X 10.5. Vulnerabilidad de lista negra incompleta en CoreTypes en Apple Mac OS X anterior a 10.5.4, permite a atacantes asistidos por el usuario ejecutar código de su elección a través de ficheros (1) .xht o (2) .xhtm, que no provocan un mensaje de advertencia "potentially unsafe" en (a) la característica de validación de descarga en Mac OS X 10.4 o (b) la característica Quarantine en Mac OS X 10.5. • http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://secunia.com/advisories/30802 http://securitytracker.com/id?1020391 http://support.apple.com/kb/HT2163 http://www.securityfocus.com/bid/30018 http://www.vupen.com/english/advisories/2008/1981/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43493 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.6EPSS: 2%CPEs: 30EXPL: 0CVE-2008-2311
https://notcve.org/view.php?id=CVE-2008-2311
Launch Services in Apple Mac OS X before 10.5, when Open Safe Files is enabled, allows remote attackers to execute arbitrary code via a symlink attack, probably related to a race condition and automatic execution of a downloaded file. Ejecución de servicios en Apple MAc OS X anterior a 10.5, cuando Open Safe Files está activado, permite a atacantes remotos ejecutar código de su elección a través de un ataque de enlace simbólico, probablemente en relación con una condición de carrera y la ejecución automática de la descarga de un fichero. • http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://secunia.com/advisories/30802 http://securitytracker.com/id?1020393 http://support.apple.com/kb/HT2163 http://www.securityfocus.com/bid/30018 http://www.vupen.com/english/advisories/2008/1981/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43495 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.6EPSS: 0%CPEs: 24EXPL: 0CVE-2008-2308
https://notcve.org/view.php?id=CVE-2008-2308
Unspecified vulnerability in Alias Manager in Apple Mac OS X 10.5.1 and earlier on Intel platforms allows local users to gain privileges or cause a denial of service (memory corruption and application crash) by resolving an alias that contains crafted AFP volume mount information. Vulnerabilidad sin especificar en Alias Manager en Apple Mac OS X 10.5.1 y versiones anteriores sobre plataformas Intel, permite a usuarios locales obtener provilegios o provocar una denegación de servicio (caída de aplicación o corrupción de memoria) resolviendo un alias que contiene una información AFP manipulada del volumen montado. • http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://secunia.com/advisories/30802 http://securitytracker.com/id?1020390 http://support.apple.com/kb/HT2163 http://www.securityfocus.com/bid/30018 http://www.vupen.com/english/advisories/2008/1981/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43474 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 2CVE-2008-2830 – Apple Mac OSX 10.x - Applescript ARDAgent Shell Privilege Escalation
https://notcve.org/view.php?id=CVE-2008-2830
Open Scripting Architecture in Apple Mac OS X 10.4.11 and 10.5.4, and some other 10.4 and 10.5 versions, does not properly restrict the loading of scripting addition plugins, which allows local users to gain privileges via scripting addition commands to a privileged application, as originally demonstrated by an osascript tell command to ARDAgent. Open Scripting Architecture en Mac OS X de Apple versiones 10.4.11 y 10.5.4, y algunas otras versiones 10.4 y 10.5, no restringe apropiadamente la carga de plugins de adición de scripting, lo que permite a los usuarios locales alcanzar privilegios mediante comandos de adición de scripting hacia una aplicación privilegiada, como es originalmente demostrado por un comando osascript tell para ARDAgent. • https://www.exploit-db.com/exploits/31940 http://it.slashdot.org/it/08/06/18/1919224.shtml http://lists.apple.com/archives/security-announce//2008//Sep/msg00006.html http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html http://secunia.com/advisories/30776 http://www.securityfocus.com/bid/29831 http://www.securitytracker.com/id?1020345 http://www.vupen.com/english/advisories/2008/1905/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43294 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 9%CPEs: 60EXPL: 0CVE-2008-2307
https://notcve.org/view.php?id=CVE-2008-2307
Unspecified vulnerability in WebKit in Apple Safari before 3.1.2, as distributed in Mac OS X before 10.5.4, and standalone for Windows and Mac OS X 10.4, allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors involving JavaScript arrays that trigger memory corruption. Una vulnerabilidad no especificada en WebKit en Apple Safari anterior a la versión 3.1.2, distribuida en Mac OS X anterior a la versión 10.5.4, e independiente para Windows y Mac OS X versión 10.4, permite a los atacantes remotos causar una denegación de servicio (bloqueo de aplicación) o ejecutar código arbitrario por medio de vectores que involucra a la matriz JavaScript que desencadena una corrupción de memoria. • http://lists.apple.com/archives/security-announce/2008//Jul/msg00001.html http://lists.apple.com/archives/security-announce/2008//Jun/msg00001.html http://lists.apple.com/archives/security-announce/2008//Jun/msg00003.html http://secunia.com/advisories/30775 http://secunia.com/advisories/30801 http://secunia.com/advisories/30992 http://secunia.com/advisories/31074 http://support.apple.com/kb/HT2092 http://support.apple.com/kb/HT2163 http://support.apple.com/kb/HT2165 h • CWE-399: Resource Management Errors •