CVSS: 4.6EPSS: 0%CPEs: 4EXPL: 0CVE-2009-0365 – NetworkManager: GetSecrets disclosure
https://notcve.org/view.php?id=CVE-2009-0365
nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network connection passwords and (2) pre-shared keys via calls to the GetSecrets method in the dbus request handler. El manipulador de peticiones dbus en (1) network-manager-applet y (2) NetworkManager en Ubuntu v6.06 LTS, v7.10, v8.04 LTS, and v8.10 no verifica adecuadamente los privilegios, lo que permite a usuarios locales descubrir (a)las contraseñas de la conexión de red y (b)Las claves pre-compartidas a través de peticiones sin especificar. • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html http://secunia.com/advisories/34067 http://secunia.com/advisories/34177 http://secunia.com/advisories/34473 http://securitytracker.com/id?1021910 http://securitytracker.com/id?1021911 http://svn.gnome.org/viewvc/network-manager-applet/trunk/nm-applet.conf?r1=1133&r2=1207&pathrev=1207 http://svn.gnome.org/viewvc/network-manager-applet?view=rev • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 1CVE-2008-5104
https://notcve.org/view.php?id=CVE-2008-5104
Ubuntu 6.06 LTS, 7.10, 8.04 LTS, and 8.10, when installed as a virtual machine by (1) python-vm-builder or (2) ubuntu-vm-builder in VMBuilder 0.9 in Ubuntu 8.10, have ! (exclamation point) as the default root password, which allows attackers to bypass intended login restrictions. Ubuntu 6.06 LTS, 7.10, 8.04 LTS y 8.10, cuando está instalado como una máquina virtual por (1) python-vm-builder o (2) ubuntu-vm-builder en VMBuilder 0.9 en Ubuntu 8.10, tiene un ! (signo de exclamación) como la contraseña por defecto de root, lo que permite a atacantes remotos evitar las restricciones de login previstas. • http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff http://secunia.com/advisories/32697 http://www.securityfocus.com/bid/32292 http://www.ubuntu.com/usn/usn-670-1 https://bugs.launchpad.net/ubuntu/+source/vm-builder/+bug/296841 https://exchange.xforce.ibmcloud.com/vulnerabilities/46881 • CWE-255: Credentials Management Errors •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 1CVE-2008-5103
https://notcve.org/view.php?id=CVE-2008-5103
The (1) python-vm-builder and (2) ubuntu-vm-builder implementations in VMBuilder 0.9 in Ubuntu 8.10 omit the -e option when invoking chpasswd with a root:! argument, which configures the root account with a cleartext password of ! (exclamation point) and allows attackers to bypass intended login restrictions. Las implementaciones (1) python-vm-builder y (2) ubuntu-vm-builder en VMBuilder v0.9 en Ubuntu v8.10 omiten la opción -e cuando invocan chpasswd con un argumento root:!, lo cual configura la cuenta raíz con una contraseña en texto claro de ! • http://launchpadlibrarian.net/19619929/vm-builder_0.9-0ubuntu3.1.debdiff http://osvdb.org/49996 http://secunia.com/advisories/32697 http://www.securityfocus.com/bid/32292 http://www.ubuntu.com/usn/usn-670-1 https://bugs.launchpad.net/ubuntu/+source/vm-builder/+bug/296841 https://exchange.xforce.ibmcloud.com/vulnerabilities/46603 • CWE-255: Credentials Management Errors •
CVSS: 9.3EPSS: 0%CPEs: 4EXPL: 0CVE-2008-4306 – enscript: "font" special escape buffer overflows
https://notcve.org/view.php?id=CVE-2008-4306
Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. Vulnerabilidad inespecífica en enscript antes de la v1.6.4 en Ubuntu Linux v6.06 LTS, v7.10, v8.04 y v8.10 que tiene un impacto y unos vectores de ataque desconocidos, posiblemente este relacionado con el desbordamiento de búfer. • http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html http://osvdb.org/49569 http://rhn.redhat.com/errata/RHSA-2008-1021.html http://secunia.com/advisories/32521 http://secunia.com/advisories/32530 http://secunia.com/advisories/32753 http://secunia.com/advisories/32854 http://secunia.com/advisories/32970 http://secunia.com/advisories/33109 http://security.gentoo.org/glsa/glsa-200812-02.xml http://support.avaya.com/elmodocs2/security/ASA-2008-504.htm • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 64EXPL: 0CVE-2008-2808 – Firefox file location escaping flaw
https://notcve.org/view.php?id=CVE-2008-2808
Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly escape HTML in file:// URLs in directory listings, which allows remote attackers to conduct cross-site scripting (XSS) attacks or have unspecified other impact via a crafted filename. Mozilla Firefox anterior a 2.0.0.15 y SeaMonkey anterior a 1.1.10 no escapan correctamente el HTML en listados de directorios file:// URLs, lo que permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) o tener otros impactos no especificados mediante un nombre de archivo modificado. • http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html http://rhn.redhat.com/errata/RHSA-2008-0616.html http://secunia.com/advisories/30878 http://secunia.com/advisories/30898 http://secunia.com/advisories/30903 http://secunia.com/advisories/30911 http://secunia.com/advisories/30949 http://secunia.com/advisories/31005 http://secunia.com/advisories/31008 http://secunia.com/advisories/31021 http://secunia.com/advisories/31023 http://secunia.com/advisories/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •