CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8338 – Johnny You Are Fired
https://notcve.org/view.php?id=CVE-2019-8338
01 May 2019 — The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring. La rutina de verificació... • https://packetstorm.news/files/id/152703 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 1CVE-2010-3618
https://notcve.org/view.php?id=CVE-2010-3618
20 Nov 2010 — PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue. PGP Desktop v10.0.x anterior a v10.0.3 SP2 y v10.1.0 anterior a v10.1.0 SP1 no implementa adecu... • http://secunia.com/advisories/42293 • CWE-310: Cryptographic Issues •
CVSS: 9.3EPSS: 2%CPEs: 3EXPL: 0CVE-2010-3397
https://notcve.org/view.php?id=CVE-2010-3397
15 Sep 2010 — Untrusted search path vulnerability in PGP Desktop 9.9.0 Build 397, 9.10.x, 10.0.0 Build 2732, and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tsp.dll or tvttsp.dll that is located in the same folder as a .p12, .pem, .pgp, .prk, .prvkr, .pubkr, .rnd, or .skr file. Vulnerabilidad ruta de búsqueda no confiable en PGP Desktop v9.9.0 Build 397, v9.10.x, v10.0.0 Build 2732, y posiblemente otras versiones... • http://secunia.com/advisories/41135 •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2009-0681
https://notcve.org/view.php?id=CVE-2009-0681
15 Apr 2009 — PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys. PGP Desktop anterior a v9.10 permite a usuarios locales (1) provocar una denegación de servicio (caída) a través de peticiones IOCTL manipuladas en pgpdisk.sys, y (2) provocar una denegación de servicio (caída) y ejecutar código de su elección a través de una p... • http://en.securitylab.ru/lab/PT-2009-01 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 3CVE-2008-5731 – PGP Desktop 9.0.6 - 'PGPwded.sys' Local Denial of Service
https://notcve.org/view.php?id=CVE-2008-5731
26 Dec 2008 — The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows local users to cause a denial of service (system crash) and possibly gain privileges via a certain METHOD_BUFFERED IOCTL request that overwrites portions of memory, related to a "Driver Collapse." NOTE: some of these details are obtained from third party information. El driver del dispositivo GPwded (también conocido como PGPwded.sys) en PGP Corporation PGP Desktop 9.0.6 versión 6060 y 9.9.... • https://www.exploit-db.com/exploits/7556 • CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 15%CPEs: 1EXPL: 0CVE-2007-0603
https://notcve.org/view.php?id=CVE-2007-0603
30 Jan 2007 — PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address. PHP Desktop anterior a 9.5.1 no valida los objetos de datos recibidos por la (1) tubería con nombre \pipe\pgpserv para PGPServ.exe o (2) la tubería con nombre... • http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2005-4151
https://notcve.org/view.php?id=CVE-2005-4151
10 Dec 2005 — The Wipe Free Space utility in PGP Desktop Home 8.0 and Desktop Professional 9.0.3 Build 2932 and earlier does not clear file slack space in the last cluster for the file, which allows local users to access the previous contents of the disk. • http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2002-1696
https://notcve.org/view.php?id=CVE-2002-1696
31 Dec 2002 — Microsoft Outlook plug-in PGP version 7.0, 7.0.3, and 7.0.4 silently saves a decrypted copy of a message to hard disk when "Automatically decrypt/verify when opening messages" option is checked, "Always use Secure Viewer when decrypting" option is not checked, and the user replies to an encrypted message. • http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0201&L=ntbugtraq&F=P&S=&P=528 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2002-1977
https://notcve.org/view.php?id=CVE-2002-1977
31 Dec 2002 — Network Associates PGP 7.0.4 and 7.1 does not time out according to the value set in the "Passphrase Cache" option, which could allow attackers to open encrypted files without providing a passphrase. • http://archives.neohapsis.com/archives/bugtraq/2002-07/0313.html •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2002-2069
https://notcve.org/view.php?id=CVE-2002-2069
31 Dec 2002 — PGP 6.x and 7.x does not clear Windows alternate data streams that are attached to files on NTFS file systems, which allows attackers to recover sensitive information that was supposed to be deleted. • http://www.ciac.org/ciac/bulletins/m-034.shtml • CWE-459: Incomplete Cleanup •