CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2008-4579 – cman/fence: insecure temporary file usage in the apc fence agents
https://notcve.org/view.php?id=CVE-2008-4579
15 Oct 2008 — The (1) fence_apc and (2) fence_apc_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allows local users to append to arbitrary files via a symlink attack on the apclog temporary file. Los programas (1) fence_apc y (2) fence_apc_snmp,como se utilizan en (a) fence 2.02.00-r1 y posiblemente (b) cman, cuando se ejecutan en modo verbose, permiten a usuarios locales añadir a archivos de su elección mediante un ataque de enlaces simbólicos al archivo temporal apcl... • http://bugs.gentoo.org/show_bug.cgi?id=240576 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-377: Insecure Temporary File •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2008-4580 – Ubuntu Security Notice 875-1
https://notcve.org/view.php?id=CVE-2008-4580
15 Oct 2008 — fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence_manual.fifo temporary file. fence_manual, tal y como es usado en fence versión 2.02.00-r1 y posiblemente cman, permite a los usuarios locales modificar archivos arbitrarios por medio de un ataque de tipo symlink en el archivo temporal fence_manual.fifo. Multiple insecure temporary file handling vulnerabilities were discovered in Red Hat Cluster. A local attacker could e... • http://bugs.gentoo.org/show_bug.cgi?id=240576 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2008-4394 – Gentoo Linux Security Advisory 200810-2
https://notcve.org/view.php?id=CVE-2008-4394
09 Oct 2008 — Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds. Múltiples vulnerabilidades de búsqueda en ruta no confiable en Portage en versiones anteriores a la v2.1.4.5 incluido el directorio actual de trabajo que permite a usuarios locale... • http://secunia.com/advisories/32228 •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2008-1880 – Gentoo Linux Security Advisory 200805-6
https://notcve.org/view.php?id=CVE-2008-1880
09 May 2008 — The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISC_PASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password. La configuración por defecto de Firebird anterior a 2.0.3.12981.0-r6 en Gentoo Linux establece la variable de entorno ISC_PASSWORD antes de arrancar Firebird, lo que permite a atacantes remotos evitar la autentificación SYSDBA y obtener i... • http://bugs.gentoo.org/show_bug.cgi?id=216158 • CWE-255: Credentials Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2008-1734 – Gentoo Linux Security Advisory 200804-19
https://notcve.org/view.php?id=CVE-2008-1734
18 Apr 2008 — Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server. Conflicto ... • http://bugs.gentoo.org/show_bug.cgi?id=209535 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1290 – Gentoo Linux Security Advisory 200803-29
https://notcve.org/view.php?id=CVE-2008-1290
19 Mar 2008 — ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote attackers to obtain sensitive information. ViewVC antes de 1.0.5 incluye archivos "all-forbidden" (todo prohibido) dentro de resultados de búsqueda que listan asignaciones CVS o Subversion (SVN), lo que permite a atacantes remotos obtener información sensible. Multiple unspecified errors were reportedly fixed by the ViewVC development team. Versions less than 1.05 are affec... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1291 – Gentoo Linux Security Advisory 200803-29
https://notcve.org/view.php?id=CVE-2008-1291
19 Mar 2008 — ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder. ViewVC before 1.0.5 almacena información sensible bajo la raíz web con un control de acceso insuficiente, lo que permite a atacantes remotos leer archivos y listar carpetas bajo la carpeta oculta CVSROOT. Multiple unspecified errors were reportedly fixed by the ViewVC development team. Versions less than 1.05 are a... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1292 – Gentoo Linux Security Advisory 200803-29
https://notcve.org/view.php?id=CVE-2008-1292
19 Mar 2008 — ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters. ViewVC before 1.0.5 proporciona revisión de metadatos sin comprobar correctamente si el acceso fue intencionado, lo que permite a atacantes remotos obtener información sens... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1383 – Gentoo Linux Security Advisory 200803-30
https://notcve.org/view.php?id=CVE-2008-1383
18 Mar 2008 — The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate. La función docert en el archivo ssl-cert.eclass, cuando es usada por src_compile o src_install en Gentoo Linux, almacena la clave SSL en un binpkg, lo que permite a los usuarios locales extraer la clave del binpkg, y causar que múl... • http://osvdb.org/43479 • CWE-310: Cryptographic Issues •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2008-1078 – Gentoo Linux Security Advisory 200804-9
https://notcve.org/view.php?id=CVE-2008-1078
29 Feb 2008 — expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same issue as CVE-2003-0308.1. expn en los paquetes am-utils y net-fs para Gentoo, rPath Linux y otras distribuciones, permite a usuarios locales sobrescribir archivos arbitrarios mediante un ataque de tipo symlink en el archivo temporal expn[PID]. NOTA: este es el mismo problema de CVE-2003-0308.1. ... • http://bugs.gentoo.org/show_bug.cgi?id=210158 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •