CVSS: 5.0EPSS: 0%CPEs: 127EXPL: 0CVE-2010-0383
https://notcve.org/view.php?id=CVE-2010-0383
Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, uses deprecated identity keys for certain directory authorities, which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations. Tor anteriores a v0.2.1.22, y v0.2.2.x anteriores a v0.2.2.7-alpha, utiliza claves de identidad obsoleto para determinadas autoridades de directorio , lo que facilita ataques "man-in-the-middle" para comprometer el anonimato de las fuentes y de los destinos del tráfico. • http://archives.seul.org/or/announce/Jan-2010/msg00000.html http://archives.seul.org/or/talk/Jan-2010/msg00161.html http://archives.seul.org/or/talk/Jan-2010/msg00162.html http://archives.seul.org/or/talk/Jan-2010/msg00165.html http://osvdb.org/61977 http://secunia.com/advisories/38198 http://www.securityfocus.com/bid/37901 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 12EXPL: 0CVE-2010-0384
https://notcve.org/view.php?id=CVE-2010-0384
Tor 0.2.2.x before 0.2.2.7-alpha, when functioning as a directory mirror, does not prevent logging of the client IP address upon detection of erroneous client behavior, which might make it easier for local users to discover the identities of clients in opportunistic circumstances by reading log files. Tor v0.2.2.x anterior a v0.2.2.7-alpha, cuando está funcionando como espejo de directorio, no previene el acceso a la dirección IP cliente al detectar un comportamiento erróneo del cliente, lo que podría facilitar a usuarios locales descubrir las identidades de los clientes en circunstancias favorables, leyendo sus ficheros de registro. • http://archives.seul.org/or/talk/Jan-2010/msg00162.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 127EXPL: 0CVE-2010-0385
https://notcve.org/view.php?id=CVE-2010-0385
Tor before 0.2.1.22, and 0.2.2.x before 0.2.2.7-alpha, when functioning as a bridge directory authority, allows remote attackers to obtain sensitive information about bridge identities and bridge descriptors via a dbg-stability.txt directory query. Tor anterior a v0.2.1.22, y 0.2.2.x anteriores a v0.2.2.7-alpha, cuando funciona como autoridad de directorio puente, permite a atacantes remotos obtener información sensible acerca de las identidades y descriptores puente a través de una consulta al directorio dbg-stability.txt. • http://archives.seul.org/or/announce/Jan-2010/msg00000.html http://archives.seul.org/or/talk/Jan-2010/msg00162.html http://secunia.com/advisories/38198 http://www.osvdb.org/61865 http://www.securityfocus.com/bid/37901 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 0CVE-2009-2425
https://notcve.org/view.php?id=CVE-2009-2425
Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor. Tor anterior a v0.2.0.35 permite a atacantes remotos provocar una denegación de servicio (cuelgue de aplicación) a través de un descriptor de enrutador (router) malformado. • http://archives.seul.org/or/announce/Jun-2009/msg00000.html http://secunia.com/advisories/35546 http://www.osvdb.org/55340 http://www.securityfocus.com/bid/35505 http://www.vupen.com/english/advisories/2009/1716 https://exchange.xforce.ibmcloud.com/vulnerabilities/51376 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 95EXPL: 0CVE-2009-2426
https://notcve.org/view.php?id=CVE-2009-2426
The connection_edge_process_relay_cell_not_open function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x before 0.1.2.8-beta allows exit relays to have an unspecified impact by causing controllers to accept DNS responses that redirect to an internal IP address via unknown vectors. NOTE: some of these details are obtained from third party information. La función connection_edge_process_relay_cell_not_open en src/or/relay.c en Tor v0.2.x anterior a v0.2.0.35 y v0.1.x anterior a v0.1.2.8-beta permite a los retransmisores (relays) de salida tener un impacto no especificado al provocar que los controladores acepten respuestas DNS que redirigen a direcciones IP internas a traves de vectores desconocidos. NOTA: algunos de estos detalles se obtienen a partir de información de terceros. • http://archives.seul.org/or/announce/Jun-2009/msg00000.html http://secunia.com/advisories/35546 http://www.osvdb.org/55341 http://www.securityfocus.com/bid/35505 http://www.vupen.com/english/advisories/2009/1716 https://exchange.xforce.ibmcloud.com/vulnerabilities/51377 •