Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
The Mach kernel, as used in operating systems including (1) Mac OS X 10.4 through 10.4.7 and (2) OpenStep before 4.2, allows local users to gain privileges via a parent process that forces an exception in a setuid child and uses Mach exception ports to...
CVEs:CVE-2006-4392
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Buffer overflow in Apple ImageIO on Apple Mac OS X 10.4 through 10.4.7 allows remote attackers to execute arbitrary code via a malformed JPEG2000 image.
CVEs:CVE-2006-4391
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
A logic error in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, allows network accounts without GUIds to bypass service access controls and log into the system using loginwindow via unknown vectors.
CVEs:CVE-2006-4394
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Unspecified vulnerability in QuickDraw Manager in Apple Mac OS X 10.3.9 and 10.4 through 10.4.7 allows context-dependent attackers to cause a denial of service ("memory corruption" and crash) via a crafted PICT image that is not properly handled by a c...
CVEs:CVE-2006-4395
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
CFNetwork in Apple Mac OS X 10.4 through 10.4.7 and 10.3.9 allows remote SSL sites to appear as trusted sites by using encryption without authentication, which can cause the lock icon in Safari to be displayed even when the site's identity cannot be tr...
CVEs:CVE-2006-4390
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, whi...
CVEs:CVE-2006-5327
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| xcode | affected | apple | — | — |
Apple Mac OS X 10.4 through 10.4.7, when the administrator clears the "Allow user to administer this computer" checkbox in System Preferences for a user, does not remove the user's account from the appserveradm or appserverusr groups, which still allow...
CVEs:CVE-2006-4387
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Unchecked error condition in LoginWindow in Apple Mac OS X 10.4 through 10.4.7 prevents Kerberos tickets from being destroyed if a user does not successfully log on to a network account from the login window, which might allow later users to gain acces...
CVEs:CVE-2006-4397
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the simulation.sql file.
CVEs:CVE-2006-5328
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| xcode | affected | apple | — | — |
Unspecified vulnerability in LoginWindow in Apple Mac OS X 10.4 through 10.4.7, when Fast User Switching is enabled, allows local users to gain access to Kerberos tickets of other users.
CVEs:CVE-2006-4393
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.