CVSS: 4.6EPSS: 0%CPEs: 13EXPL: 0CVE-2007-1859 – xscreensaver authentication bypass
https://notcve.org/view.php?id=CVE-2007-1859
XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication. XScreenSaver versión 4.10, cuando está usando un servicio de directorio remoto para credenciales, no maneja apropiadamente los resultados de la función getpwuid en el archivo drivers/lock.c cuando no hay conectividad de red, lo que causa que XScreenSaver bloquee y desbloquee la pantalla y permita a usuarios locales omitir la autenticación. • http://osvdb.org/35531 http://secunia.com/advisories/25065 http://secunia.com/advisories/25105 http://secunia.com/advisories/25116 http://secunia.com/advisories/25118 http://secunia.com/advisories/25119 http://secunia.com/advisories/25225 http://secunia.com/advisories/25610 http://security.gentoo.org/glsa/glsa-200705-14.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:097 http://www.novell.com/linux/security/advisories/2007_9_sr.html http://www.redhat • CWE-287: Improper Authentication •
CVSS: 5.4EPSS: 1%CPEs: 3EXPL: 0CVE-2004-2655
https://notcve.org/view.php?id=CVE-2004-2655
rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen. • ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc http://secunia.com/advisories/20226 http://secunia.com/advisories/20456 http://secunia.com/advisories/20782 http://secunia.com/advisories/22080 http://securitytracker.com/id?1016150 http://securitytracker.com/id?1016151 http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm http://www.derkeiler.com/Newsgroups/comp.os.linux.security/2004-08/0018.html http://www.jwz.org/xscreensaver/changelog.html http:& •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2003-0885
https://notcve.org/view.php?id=CVE-2003-0885
Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecurely in the (1) apple2, (2) xanalogtv, and (3) pong screensavers, and allows local users to overwrite arbitrary files via a symlink attack. • http://bugs.gentoo.org/show_bug.cgi?id=41253 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=182286 •
CVSS: 2.1EPSS: 0%CPEs: 18EXPL: 0CVE-2003-1294
https://notcve.org/view.php?id=CVE-2003-1294
Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack. • ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc http://jwz.livejournal.com/310943.html http://secunia.com/advisories/20224 http://secunia.com/advisories/20226 http://secunia.com/advisories/20456 http://secunia.com/advisories/20782 http://support.avaya.com/elmodocs2/security/ASA-2006-107.htm http://www.novell.com/linux/download/updates/90_i386.html http://www.redhat.com/support/errata/RHSA-2006-0498.html http://www.securityfocus.com/bid/9125 http: •