Apple Mac Os X Server vulnerabilities

CVE-2010-0498 [HIGH] CWE-287 CVE-2010-0498: Directory Services in Apple Mac OS X before 10.6.3 does not properly perform authorization during pr Directory Services in Apple Mac OS X before 10.6.3 does not properly perform authorization during processing of record names, which allows local users to gain privileges via unspecified vectors.

CVE-2010-0058 [MEDIUM] CWE-16 CVE-2010-0058: freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd. freshclam in ClamAV in Apple Mac OS X 10.5.8 with Security Update 2009-005 has an incorrect launchd.plist ProgramArguments key and consequently does not run, which might allow remote attackers to introduce viruses into the system.

CVE-2012-0655 [MEDIUM] CWE-310 CVE-2012-0655: libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffing attack during communication with a site that uses a short key.

CVE-2008-1571 [MEDIUM] CWE-22 CVE-2008-1571: Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X befo Directory traversal vulnerability in the embedded web server in Image Capture in Apple Mac OS X before 10.5 allows remote attackers to read arbitrary files via directory traversal sequences in the URI.

CVE-2009-2836 [MEDIUM] CWE-362 CVE-2009-2836: Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, when at least one account has Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, when at least one account has a blank password, allows attackers to bypass password authentication and obtain login access to an arbitrary account via unspecified vectors.

CVE-2009-2831 [MEDIUM] CVE-2009-2831: Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any conte Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create arbitrary files with any contents, and thereby execute arbitrary code, via crafted JavaScript, related to a "design issue."

CVE-2016-1774 [MEDIUM] CWE-284 CVE-2016-1774: The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading backup data that lacks intended restrictions.

CVE-2005-1332 [HIGH] CVE-2005-1332: Bluetooth-enabled systems in Mac OS X 10.3.9 enables the Bluetooth file exchange service by default, Bluetooth-enabled systems in Mac OS X 10.3.9 enables the Bluetooth file exchange service by default, which allows remote attackers to access files without the user being notified, and local users to access files via the default directory.

CVE-2011-0203 [MEDIUM] CWE-22 CVE-2011-0203: Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before Absolute path traversal vulnerability in xftpd in the FTP Server component in Apple Mac OS X before 10.6.8 allows remote attackers to list arbitrary directories by using the root directory as the starting point of a recursive listing.

CVE-2004-0538 [HIGH] CVE-2004-0538: LaunchServices in Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, LaunchServices in Mac OS X 10.3.4 and 10.2.8 automatically registers and executes new applications, which could allow attackers to execute arbitrary code without warning the user.

CVE-2015-7031 [MEDIUM] CWE-264 CVE-2015-7031: The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header config The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers to bypass intended access restrictions via unknown vectors.

CVE-2007-0721 [MEDIUM] CVE-2007-0721: Unspecified vulnerability in diskimages-helper in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allo Unspecified vulnerability in diskimages-helper in Apple Mac OS X 10.3.9 and 10.4 through 10.4.8 allows remote user-assisted attackers to execute arbitrary code via a crafted compressed disk image that triggers memory corruption.

CVE-2009-1727 [MEDIUM] CVE-2009-1727: Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari.

CVE-2009-0009 [MEDIUM] CWE-119 CVE-2009-0009: Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote att Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted movie file that triggers memory corruption.

CVE-2010-0065 [MEDIUM] CWE-119 CVE-2010-0065: Disk Images in Apple Mac OS X before 10.6.3 allows user-assisted remote attackers to execute arbitra Disk Images in Apple Mac OS X before 10.6.3 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted disk image with bzip2 compression.

CVE-2009-2803 [MEDIUM] CWE-399 CVE-2009-2803: CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a file with a crafted resource fork.

CVE-2008-0052 [MEDIUM] CWE-200 CVE-2008-0052: CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attacker CoreServices in Apple Mac OS X 10.4.11 treats .ief as a safe file type, which allows remote attackers to force Safari users into opening an .ief file in AppleWorks, even when the "Open 'Safe' files" preference is set.

CVE-2011-3227 [MEDIUM] CWE-20 CVE-2011-3227: libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a n libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a nonstandard extension in a Certificate Revocation list (CRL), which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) a crafted (1) web site or (2) e-mail message.

CVE-2010-0063 [MEDIUM] CVE-2010-0063: Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X before 10.6.3 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari, as demonstrated by the values for the (1) .ibplugin and (2) .url e

CVE-2012-0675 [MEDIUM] CWE-287 CVE-2012-0675: Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authenticat Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by spoofing the backup volume.