CVSS: 9.3EPSS: 0%CPEs: 17EXPL: 2CVE-2008-3075 – plugin: improper Implementation of shellescape() (arbitrary code execution)
https://notcve.org/view.php?id=CVE-2008-3075
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a ZIP archive and possibly (2) the filename of the first file in a ZIP archive, which is not properly handled by zip.vim in the VIM ZIP plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3074. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://marc.info/?l=bugtraq&m=121494431426308&w=2 http://secunia.com/advisories/34418 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 http://www.openwall.com/lists/oss-security/2008/07/07/1 http://www.openwall.com/lists/oss-security/2008/07/07/4 http://www.openwall. • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2008-4677
https://notcve.org/view.php?id=CVE-2008-4677
autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately." autoload/netrw.vim (también conocido como Netrw Plugin) v109, v131, y versiones anteriores a v133k para Vim v7.1.266, otras versiones v7.1 , y v7.2, guardan las credenciales de las sesiones FTP y envían estos datos al intentar establecer sesiones FTP posteriores a los servidores en diferentes host, lo que permite a los servidores FTP obtener información sensible en circunstancias oportunas mediante la validación con nombres de usuario y contraseñas. NOTA: el fabricante cuestiona un vector involucrando a distintos puertos en un mismo host afirmando que "Asumimos que están usando el mismo id y contraseña sobre el mismo servidor de manera intencionada". • http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://secunia.com/advisories/31464 http://secunia.com/advisories/34418 http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 http://www.openwall.com/lists/oss-security/2008/10/06/4 http://www.openwall.com/lists/oss-security/2008/10/16/2 http://www.openwall.com/lists/oss-security/20 • CWE-255: Credentials Management Errors •
CVSS: 9.3EPSS: 0%CPEs: 19EXPL: 3CVE-2008-4101 – Vim 7.1.314 - Insufficient Shell Escaping Multiple Command Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-4101
Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712. Vim 3.0 hasta 7.x anterior a 7.2.010, no escapa los caracteres de forma adecuada, esto permite a atacantes con la ayuda del usuario local (1) ejecutar instrucciones de su elección en el intérprete de comandos al introducir una pulsación de la tecla K en una línea que contiene un ";" (punto y coma), seguido de un comando, o ejecutar comandos Ex de su elección al introducir un argumento después de una secuencia de teclado: (2)"Ctrl-]" (control corchete de cierre) o (3) "g]" (g corchete de cierre). NOTA: se trata de una vulnerabilidad diferente de CVE-2008-2712. • https://www.exploit-db.com/exploits/32289 http://ftp.vim.org/pub/vim/patches/7.2/7.2.010 http://groups.google.com/group/vim_dev/attach/9290f26f9bc11b33/K-arbitrary-command-execution.patch.v3?part=2 http://groups.google.com/group/vim_dev/attach/dd32ad3a84f36bb2/K-arbitrary-command-execution.patch?part=2 http://groups.google.com/group/vim_dev/browse_thread/thread/1434d0812b5c817e/6ad2d5b50a96668e http://groups.google.com/group/vim_dev/msg/9290f26f9bc11b33 http://lists.apple.com/archives/ • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 1%CPEs: 6EXPL: 1CVE-2008-2712 – Vim 7.x - Vim Script Multiple Command Execution Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-2712
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075. Vim 7.1.314, 6.4 y otras versiones, permiten a atacantes remotos asistidos por el usuario ejecutar comandos de su elección a través de secuencias de comandos Vim que cuyos inputs no son limpiados correctamente previa a la ejecución o las funciones del sistema como se ha demostrado con (1) filetype.vim, (2) zipplugin, (3) xpm.vim, (4) gzip_vim y (5) netrw. • https://www.exploit-db.com/exploits/31911 http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://marc.info/?l=bugtraq&m=121494431426308&w=2 http://secunia.com/advisories/30731 http://secunia.com/advisories/32222 http://secunia.com/advisories/32858 http://secunia.com/advisories/32864 http://secunia.com/a • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 33%CPEs: 4EXPL: 0CVE-2007-2953 – vim format string flaw
https://notcve.org/view.php?id=CVE-2007-2953
Format string vulnerability in the helptags_one function in src/ex_cmds.c in Vim 6.4 and earlier, and 7.x up to 7.1, allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a help-tags tag in a help file, related to the helptags command. Vulnerabilidad de cadena de formato en la función helptags_one de src/ex_cmds.c en Vim 6.4 y anteriores, y 7.x hasta 7.1, permite a atacantes remotos con la intervención del usuario ejecutar código de su elección mediante especificadores de cadena de formato en una etiqueta help-tags de un archivo de ayuda, relacionado con el comando helptags. • ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039 http://secunia.com/advisories/25941 http://secunia.com/advisories/26285 http://secunia.com/advisories/26522 http://secunia.com/advisories/26594 http://secunia.com/advisories/26653 http://secunia.com/advisories/26674 http://secunia.com/advisories/26822 http://secunia.com/advisories/32858 http://secunia.com/advisories/33410 http://secunia.com/secunia_research/2007-66/advisory http://support.avaya.com/elmodocs2/security/ •