Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote authenticated users to inject arbitrary web script or HTML via crafted Wiki content, related to lack of a charset field.

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

ID	Name	Product	Family	Type	Severity
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic		critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	Local	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	high

Detections

Analytics

CVE-2010-1382

medium

Tenable Plugins

critical

high

high