CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1943
https://notcve.org/view.php?id=CVE-2011-1943
The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file. La función destroy_one_secret en nm-setting-vpn.c en libnm-util en el paquete de NetworkManager v0.8.999-3.git20110526 en Fedora 15 crea una entrada de registro que contiene una contraseña del certificado, que permite a usuarios locales obtener información sensible mediante la lectura de un archivo de registro. • http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=78ce088843d59d4494965bfc40b30a2e63d065f6 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061329.html http://www.openwall.com/lists/oss-security/2011/05/31/6 http://www.openwall.com/lists/oss-security/2011/05/31/7 https://bugzilla.redhat.com/show_bug.cgi?id=708876 https://exchange.xforce.ibmcloud.com/vulnerabilities/68057 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 0CVE-2009-4144 – NetworkManager: WPA enterprise network not verified when certificate is removed
https://notcve.org/view.php?id=CVE-2009-4144
NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) 802.1x network remains present upon a connection attempt, which might allow remote attackers to obtain sensitive information or cause a denial of service (connectivity disruption) by spoofing the identity of a wireless network. NetworkManager (NM) v0.7.2 no asegura que el fichero del certificado de la autoridad de certificación (CA) configurada para una red (1) WPA Enterprise o (2) 802.1x continúe presente durante un intento de conexión, lo que podría permitir a atacantes remotos obtener información sensible o provocar una denegación de servicio (interrupción de conectividad) mediante la suplantación de identidad de una red inalámbrica. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560067 http://git.gnome.org/browse/network-manager-applet/commit/?h=NETWORKMANAGER_APPLET_0_7&id=4020594dfbf566f1852f0acb36ad631a9e73a82b http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html http://secunia.com/advisories/38420 http://www.openwall.com/lists/oss-security/2009/12/16/3 http://www.redhat.com/support/errata/RHSA-2010-0108.html http://www.securityfocus.com/bid/37580 https://bugzilla.redhat.com/show_bug.cgi • CWE-310: Cryptographic Issues •
CVSS: 3.6EPSS: 0%CPEs: 1EXPL: 0CVE-2009-4145 – NetworkManager: information disclosure by nm-connection-editor
https://notcve.org/view.php?id=CVE-2009-4145
nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network. nm-connection-editor en NetworkManager (NM) v0.7.x envía objetos de conexión por el D-Bus sobre acciones en el editor GUI de conexión, permitiendo a usuarios locales obtener información sensible al leer las señales D-Bus, como se ha demostrado usando dbus-monitor para descubrir la contraseña de la red WiFi. • http://git.gnome.org/browse/network-manager-applet/commit/?h=NETWORKMANAGER_APPLET_0_7&id=56d87fcb86acb5359558e0a2ee702cfc0c3391f2 http://git.gnome.org/browse/network-manager-applet/commit/?h=NETWORKMANAGER_APPLET_0_7&id=8627880e07c8345f69ed639325280c7f62a8f894 http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00000.html http://secunia.com/advisories/37819 http://secunia.com/advisories/38420 http://www.openwall.com/lists/oss-security/2009/12/16/3 http://www.redhat.com/support/errata/RHSA-2010 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2005-2410
https://notcve.org/view.php?id=CVE-2005-2410
Format string vulnerability in the nm_info_handler function in Network Manager may allow remote attackers to execute arbitrary code via format string specifiers in a Wireless Access Point identifier, which is not properly handled in a syslog call. Vulnerabilidad de formateo de cadenas en la función nm_info_handler en Network Manager puede permitir que atacantes remotos ejecuten código arbitrario mediante especificadores de formato de cadenas (ya que no se manejan adecuadamente en una llamada syslog). • http://lwn.net/Alerts/145678 http://mail.gnome.org/archives/networkmanager-list/2005-July/msg00196.html http://mail.gnome.org/archives/networkmanager-list/2005-July/msg00197.html •