CVSS: 10.0EPSS: 1%CPEs: 160EXPL: 1CVE-2009-0414 – Gentoo Linux Security Advisory 200904-11
https://notcve.org/view.php?id=CVE-2009-0414
03 Feb 2009 — Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap corruption. Vulnerabilidad sin especificar en Tor anterior a v0.2.0.33 tiene un impacto y vectores de ataque desconocidos que lanzan una corrupción de montículo (heap). Multiple vulnerabilities in Tor might allow for heap corruption, Denial of Service, escalation of privileges and information disclosure. Versions less than 0.2.0.34 are affected. • http://archives.seul.org/or/announce/Jan-2009/msg00000.html • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 100EXPL: 0CVE-2008-5397 – Gentoo Linux Security Advisory 200904-11
https://notcve.org/view.php?id=CVE-2008-5397
09 Dec 2008 — Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain privileges by leveraging unintended supplementary group memberships of the Tor process. Tor anterior a v0.2.32 no procesa adecuadamente la configuración de las opciones de (1)usuario (User) y (2) Grupo (group), lo que permitiría a usuarios locales obtener privilegios aprovechando la pertenencia a grupos creados por defecto en los procesos de Tor. Multiple vulnerabilities in T... • http://blog.torproject.org/blog/tor-0.2.0.32-released • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 100EXPL: 0CVE-2008-5398 – Gentoo Linux Security Advisory 200904-11
https://notcve.org/view.php?id=CVE-2008-5398
09 Dec 2008 — Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay issues a policy-based refusal of a stream, which allows remote exit relays to have an unknown impact by mapping an internal IP address to the destination hostname of a refused stream. Tor anterior a v0.2.0.32 no procesa adecuadamente la opción de configuración ClientDNSRejectInternalAddresses en situaciones donde una cuestión en la salida de transmisión de una política qu... • http://blog.torproject.org/blog/tor-0.2.0.32-released • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 16%CPEs: 16EXPL: 2CVE-2007-4174 – Tor < 0.1.2.16 - ControlPort Remote Rewrite
https://notcve.org/view.php?id=CVE-2007-4174
07 Aug 2007 — Tor before 0.1.2.16, when ControlPort is enabled, does not properly restrict commands to localhost port 9051, which allows remote attackers to modify the torrc configuration file, compromise anonymity, and have other unspecified impact via HTTP POST data containing commands without valid authentication, as demonstrated by an HTML form (1) hosted on a web site or (2) injected by a Tor exit node. Tor versiones anteriores a 0.1.2.16, cuando ControlPort está habilitado, no restringe apropiadamente los comandos ... • https://www.exploit-db.com/exploits/4468 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 24EXPL: 0CVE-2007-3165
https://notcve.org/view.php?id=CVE-2007-3165
11 Jun 2007 — Tor before 0.1.2.14 can construct circuits in which an entry guard is in the same family as the exit node, which might compromise the anonymity of traffic sources and destinations by exposing traffic to inappropriate remote observers. Tor anterior a 0.1.2.14 puede construir circuitos en los cuales un protector de entrada está en la misma familia que el nodo de la salida, lo cual puede comprometer el anonimato de las fuentes y de los destinatarios del tráfico exponiendo tráfico a los observadores remotos ina... • http://archives.seul.org/or/announce/May-2007/msg00000.html •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1103
https://notcve.org/view.php?id=CVE-2007-1103
26 Feb 2007 — Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations. Tor no verifica el tiempo de funcionamiento y los anuncios de ancho de banda, lo cual permite a atacantes remotos que operan un nodo con bajos recursos afirmar que poseen recursos mayores, lo cual pone el nodo en uso para muc... • http://archives.seul.org/or/talk/Feb-2007/msg00197.html •
CVSS: 7.5EPSS: 1%CPEs: 40EXPL: 0CVE-2006-4508
https://notcve.org/view.php?id=CVE-2006-4508
31 Aug 2006 — Unspecified vulnerability in (1) Tor 0.1.0.x before 0.1.0.18 and 0.1.1.x before 0.1.1.23, and (2) ScatterChat before 1.0.2, allows remote attackers operating a Tor entry node to route arbitrary Tor traffic through clients or cause a denial of service (flood) via unspecified vectors. Vulnerabilidad no especificada en (1) Tor 0.1.0.x anteriores a 0.1.0.18 y 0.1.1.x anteriores a 0.1.1.23, y (2) ScatterChat anterior a 1.0.2, permite a atacantes remotos operando un "nodo de entrada" en la red Tor encaminar tráfi... • http://archives.seul.org/or/announce/Aug-2006/msg00001.html •
CVSS: 7.5EPSS: 0%CPEs: 68EXPL: 0CVE-2006-3416
https://notcve.org/view.php?id=CVE-2006-3416
07 Jul 2006 — Tor before 0.1.1.20 kills the circuit when it receives an unrecognized relay command, which causes network circuits to be disbanded. NOTE: while this item is listed under the "Security fixes" section of the developer changelog, the developer clarified on 20060707 that this is only a self-DoS. Therefore this issue should not be included in CVE ** CUESTIONADA ** Tor anterior a 0.1.1.20 cancela el circuito cuando recibe un comando de transmitir erróneo, lo que provoca que los circuitos de la red sean desconect... • http://secunia.com/advisories/20514 •
CVSS: 7.5EPSS: 0%CPEs: 68EXPL: 0CVE-2006-3413
https://notcve.org/view.php?id=CVE-2006-3413
07 Jul 2006 — The privoxy configuration file in Tor before 0.1.1.20, when run on Apple OS X, logs all data via the "logfile", which allows attackers to obtain potentially sensitive information. El archivo de configuración en Tor antes de la versión 0.1.1.20, cuando se ejecuta en Apple OS X, almacena todos los archivos de log a través del "logfile", lo que permite a atacantes remotos obtener información potencialmente sensible. • http://secunia.com/advisories/20514 •
CVSS: 7.5EPSS: 0%CPEs: 68EXPL: 0CVE-2006-3419
https://notcve.org/view.php?id=CVE-2006-3419
07 Jul 2006 — Tor before 0.1.1.20 uses OpenSSL pseudo-random bytes (RAND_pseudo_bytes) instead of cryptographically strong RAND_bytes, and seeds the entropy value at start-up with 160-bit chunks without reseeding, which makes it easier for attackers to conduct brute force guessing attacks. Tor versiones anteriores a la 0.1.1.20 utiliza bytes pseudo aleatorios OpenSSL (RAND_pseudo_bytes) en vez de RAND_bytes que son criptográficamente fuertes y genera el valor de entropía al arranque con fragmentos de 160 bits sin regener... • http://secunia.com/advisories/20514 •