CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1291
https://notcve.org/view.php?id=CVE-2008-1291
ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read files and list folders under the hidden CVSROOT folder. ViewVC before 1.0.5 almacena información sensible bajo la raíz web con un control de acceso insuficiente, lo que permite a atacantes remotos leer archivos y listar carpetas bajo la carpeta oculta CVSROOT. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 http://bugs.gentoo.org/show_bug.cgi?id=212288 http://secunia.com/advisories/29176 http://secunia.com/advisories/29460 http://security.gentoo.org/glsa/glsa-200803-29.xml http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD http://www.securityfocus.com/bid/28055 http://www.vupen.com/english/advisories/2008/0734/references • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2008-1292
https://notcve.org/view.php?id=CVE-2008-1292
ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtain sensitive information by reading (1) forbidden pathnames in the revision view, (2) log history that can only be reached by traversing a forbidden object, or (3) forbidden diff view path parameters. ViewVC before 1.0.5 proporciona revisión de metadatos sin comprobar correctamente si el acceso fue intencionado, lo que permite a atacantes remotos obtener información sensible leyendo (1) rutas prohibidas en la vista de revisión, (2)el historial del log que sólo se puede alcanzar saltando un objeto prohibido, o (3)parámetros de ruta de vista diff prohibidos. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=471380 http://bugs.gentoo.org/show_bug.cgi?id=212288 http://secunia.com/advisories/29176 http://secunia.com/advisories/29460 http://security.gentoo.org/glsa/glsa-200803-29.xml http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?rev=HEAD http://www.securityfocus.com/bid/28055 http://www.vupen.com/english/advisories/2008/0734/references • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 1.9EPSS: 0%CPEs: 1EXPL: 0CVE-2008-1383
https://notcve.org/view.php?id=CVE-2008-1383
The docert function in ssl-cert.eclass, when used by src_compile or src_install on Gentoo Linux, stores the SSL key in a binpkg, which allows local users to extract the key from the binpkg, and causes multiple systems that use this binpkg to have the same SSL key and certificate. La función docert en el archivo ssl-cert.eclass, cuando es usada por src_compile o src_install en Gentoo Linux, almacena la clave SSL en un binpkg, lo que permite a los usuarios locales extraer la clave del binpkg, y causar que múltiples sistemas que utilizan este binpkg tengan la misma clave SSL y certificado. • http://osvdb.org/43479 http://secunia.com/advisories/29436 http://security.gentoo.org/glsa/glsa-200803-30.xml http://www.securityfocus.com/bid/28350 https://bugs.gentoo.org/show_bug.cgi?id=174759 https://exchange.xforce.ibmcloud.com/vulnerabilities/41336 • CWE-310: Cryptographic Issues •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2008-1078
https://notcve.org/view.php?id=CVE-2008-1078
expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same issue as CVE-2003-0308.1. expn en los paquetes am-utils y net-fs para Gentoo, rPath Linux y otras distribuciones, permite a usuarios locales sobrescribir archivos arbitrarios mediante un ataque de tipo symlink en el archivo temporal expn[PID]. NOTA: este es el mismo problema de CVE-2003-0308.1. • http://bugs.gentoo.org/show_bug.cgi?id=210158 http://secunia.com/advisories/29144 http://secunia.com/advisories/29187 http://secunia.com/advisories/29694 http://secunia.com/advisories/33400 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0088 http://www.gentoo.org/security/en/glsa/glsa-200804-09.xml http://www.securityfocus.com/archive/1/488931/100/0/threaded http://www.securityfocus.com/bid/28044 https://issues.rpath.com/browse/RPL-2255 https://www.redhat.com& • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.8EPSS: 4%CPEs: 5EXPL: 6CVE-2008-0386
https://notcve.org/view.php?id=CVE-2008-0386
Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email. Xdg-utils 1.0.2 y versiones anteriores permite a atacantes remotos ayudados por un usuario ejecutar comandos de su elección a través de metacaracteres de consola en un argumento URL a (1) xdg-open or (2) xdg-email. • http://bugs.gentoo.org/show_bug.cgi?id=207331 http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.html http://secunia.com/advisories/28638 http://secunia.com/advisories/28728 http://secunia.com/advisories/29048 http://security.gentoo.org/glsa/glsa-200801-21.xml http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?r1=1.24&r2=1.25 http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?view=log http://webcvs. • CWE-20: Improper Input Validation •