CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 1CVE-2009-2939
https://notcve.org/view.php?id=CVE-2009-2939
21 Sep 2009 — The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files. El script postfix.postinst en el paquete postfix v2.5.5 de Debian GNU/Linux y Ubuntu permite acceso de escritura al usuario postfix en /var/spool/postfix/pid, permitiendo a usuarios locales dirigir ataques de enlaces simbólicos que sobrescriban ficheros de su elección. • http://www.debian.org/security/2011/dsa-2233 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1601
https://notcve.org/view.php?id=CVE-2009-1601
11 May 2009 — The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the clamav account, which might allow local users to bypass intended access restrictions via read or write operations involving this directory. El script Ubuntu-clamav milter.init de clamav-milter antes de la versión v0.95.1+dfsg-1ubuntu1.2 en Ubuntu v9.04 establece la propiedad del directorio de trabajo actual a la cuenta clamav, lo que podría permitir el... • http://secunia.com/advisories/35000 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2008-6792
https://notcve.org/view.php?id=CVE-2008-6792
07 May 2009 — system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords with 3DES and consequently limits effective password lengths to eight characters, which makes it easier for context-dependent attackers to successfully conduct brute-force password attacks. system-tools-backends anteriores a v2.6.0-1ubuntu1.1 in Ubuntu v8.10, cuando es utilizado por "Usuarios y Grupos" en GNOME System Tools, cuentas con contraseña hashes con 3DES y cons... • http://osvdb.org/50037 • CWE-310: Cryptographic Issues •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2009-1573
https://notcve.org/view.php?id=CVE-2009-1573
06 May 2009 — xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments. xvfb-run v1.6.1 en Debian GNU/Linux, Ubuntu, Fedora 10 y posiblemente otros sistemas operativos, ubican la magic cookie (MCOOKIE) en la línea de comandos, lo que permite a usuarios locales obtener privilegios listando los procesos y sus argumentos. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526678 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2009-0365 – NetworkManager: GetSecrets disclosure
https://notcve.org/view.php?id=CVE-2009-0365
05 Mar 2009 — nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler. El manipulador de peticiones dbus en (1) network-manager-applet y (2) NetworkManager en Ubuntu v6.06 LTS, v7.10, v8.04 LTS, and v8.10 no verifica adecuadamente los privilegios, lo que permite a usuarios locales descubrir (a)las contraseñas de la conexión de red y... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2009-0578 – NetworkManager: local users can modify the connection settings
https://notcve.org/view.php?id=CVE-2009-0578
05 Mar 2009 — GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console. network-manager-applet en Ubuntu 8.10 no verifica adecuadamente los privilegios para las peticiones dbus(1) "modify" y (2) "delete", lo que permite a usuarios locales modificar o eliminar las conexiones de red de... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 6%CPEs: 3EXPL: 1CVE-2006-7236 – xterm - DECRQSS Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-7236
02 Jan 2009 — The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences. La configuración por defecto de sid en xterm para Debian GNU/Linux y posiblemente Ubuntu activa el recurso allowWindowOps, lo que permite a atacantes asistidos por el usuario, ejecutar código de su elección o tener otro impacto no determinado a través de secuencias de escape. • https://www.exploit-db.com/exploits/32690 • CWE-16: Configuration •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2008-5103
https://notcve.org/view.php?id=CVE-2008-5103
17 Nov 2008 — The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions. Las implementaciones (1) python-vm-builder y (2) ubuntu-vm-builder en VMBuilder v0.9 en Ubuntu v8.10 omiten la opción -e cuando invocan chpasswd con un argumento root:!, lo cual configura la cuenta raí... • http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2008-5104
https://notcve.org/view.php?id=CVE-2008-5104
17 Nov 2008 — Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions. Ubuntu 6.06 LTS, 7.10, 8.04 LTS y 8.10, cuando está instalado como una máquina virtual por (1) python-vm-builder o (2) ubuntu-vm-builder en VMBuilder 0.9 en Ubuntu 8.10, tiene un ! (signo de exclamación) como la contraseña por defe... • http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 0CVE-2008-4395
https://notcve.org/view.php?id=CVE-2008-4395
06 Nov 2008 — Multiple buffer overflows in the ndiswrapper module 1.53 for the Linux kernel 2.6 allow remote attackers to execute arbitrary code by sending packets over a local wireless network that specify long ESSIDs. Múltiples desbordamientos de búfer en el modulo ndiswrapper v1.53 en el kernel de Linux v2.6 permite a atacantes remotos ejecutar código a su elección mediante el envío de paquetes a través de una red inalámbrica local que obligue a tener un ESSID largo. • http://bugs.gentoo.org/show_bug.cgi?id=239371 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •