CVSS: 7.1EPSS: 0%CPEs: 29EXPL: 1CVE-2009-3939 – kernel: megaraid_sas permissions in sysfs
https://notcve.org/view.php?id=CVE-2009-3939
The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file. El fichero poll_mode_io para el controlador megaraid_sas en el kernel de Linux v2.6.31.6 y anteriores tiene permisos de escritura para todos, permitiendo a usuarios locales cambiar el modo de E/S del dispositivo modificando este fichero. • http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-03 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.8EPSS: 0%CPEs: 11EXPL: 0CVE-2008-6573
https://notcve.org/view.php?id=CVE-2008-6573
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server. Múltiples vulnerabilidades de inyección SQL en Avaya SIP Enablement Services (SES) en Avaya Avaya Communication Manager 3.x, 4.0, y 5.0 (1) permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores no especificados relacionados con perfiles en el SIP Personal Information Manager (SPIM) en la interfaz web; y permite a usuarios remotos autenticados ejecutar comandos SQL de su elección a través de vectores no especificados relacionados a (2) permisos para perfiles SPIM en la interfaz web y (3) una petición SIP manipulada en el servidor SIP. • http://osvdb.org/44284 http://osvdb.org/44285 http://osvdb.org/44286 http://secunia.com/advisories/29744 http://support.avaya.com/elmodocs2/security/ASA-2008-150.htm http://support.avaya.com/elmodocs2/security/ASA-2008-151.htm http://www.securityfocus.com/bid/28682 http://www.voipshield.com/research-details.php?id=22 http://www.voipshield.com/research-details.php?id=25 http://www.voipshield.com/research-details.php?id=26 https://exchange.xforce.ibmcloud.com/vulnerabili • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 1%CPEs: 12EXPL: 0CVE-2008-5709
https://notcve.org/view.php?id=CVE-2008-5709
Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1 before 3.1.4 SP2, 4.0 before 4.0.3 SP1, and 5.0 before 5.0 SP3 allow remote authenticated users to execute arbitrary code via unknown attack vectors in the (1) Set Static Routes and (2) Backup History components. Múltiples vulnerabilidades sin especificar en la interfaz de gestión web en Avaya Communication Manager (CM) 3.1 antes de 3.1.4 SP2, 4.0 antes de 4.0.3 SP1 y 5.0 antes de 5.0 SP3 permite a usuarios remotamente autentificados ejecutar código de su elección mediante vectores de ataque desconocidos en los componentes (1) Set Static Routes y (2) Backup History. • http://secunia.com/advisories/32204 http://support.avaya.com/elmodocs2/security/ASA-2008-391.htm http://www.securityfocus.com/bid/31645 http://www.voipshield.com/research-details.php?id=121 http://www.voipshield.com/research-details.php?id=122 http://www.vupen.com/english/advisories/2008/2772 https://exchange.xforce.ibmcloud.com/vulnerabilities/45747 https://exchange.xforce.ibmcloud.com/vulnerabilities/45749 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 20EXPL: 0CVE-2008-5710
https://notcve.org/view.php?id=CVE-2008-5710
Multiple unspecified vulnerabilities in the web management interface in Avaya Communication Manager (CM) 3.1.x, 4.0.3, and 5.x allow remote attackers to read (1) configuration files, (2) log files, (3) binary image files, and (4) help files via unknown vectors. Múltiples vulnerabilidades sin especificar en la interfaz de gestión web en Avaya Communication Manager (CM) 3.1.x, 4.0.3 y 5.x permite a atacantes remotos leer (1) archivos de configuración, (2) archivos de log, (3) archivos binarios de imagen y (4) archivos de ayuda mediante vectores desconocidos. • http://secunia.com/advisories/32035 http://support.avaya.com/elmodocs2/security/ASA-2008-394.htm http://www.securityfocus.com/bid/31639 http://www.voipshield.com/research-details.php?id=123 http://www.vupen.com/english/advisories/2008/2774 https://exchange.xforce.ibmcloud.com/vulnerabilities/45750 • CWE-16: Configuration •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2008-3778
https://notcve.org/view.php?id=CVE-2008-3778
The remote management interface in SIP Enablement Services (SES) Server in Avaya SIP Enablement Services 5.0, and Communication Manager (CM) 5.0 on the S8300C with SES enabled, proceeds with Core router updates even when a login is invalid, which allows remote attackers to cause a denial of service (messaging outage) or gain privileges via an update request. El interfaz remoto de gestión en SIP Enablement Services (SES) Server en Avaya SIP Enablement Services 5.0 y Communication Manager (CM) 5.0 en el S8300C con SES activado, continua con las actualizaciones de Core router incluso con un login no válido, lo que permite a atacantes remotos provocar una denegación de servicio (corte del servicio de mensajería) o bien obtener privilegios mediante una petición de actualización. • http://support.avaya.com/elmodocs2/security/ASA-2008-347.htm http://www.securityfocus.com/bid/30758 https://exchange.xforce.ibmcloud.com/vulnerabilities/44585 • CWE-264: Permissions, Privileges, and Access Controls •