The Apple OSX 10.4 Dashboard widgets allow system commands to be executed, which is normally not considered a vulnerability in itself as they run with the user’s permissions. If the user has recently authenticated to perform a super-user function, however, Dashboard widgets can hijack these credentials by calling the system’s built-in sudo command and execute arbitrary functions with full administrative privileges.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/39280/osx104Dash.txt
Source: https://packetstormsecurity.com/files/39280/osx104Dash.txt.html