CVSS: 7.5EPSS: 1%CPEs: 12EXPL: 1CVE-2010-3618
https://notcve.org/view.php?id=CVE-2010-3618
20 Nov 2010 — PGP Desktop 10.0.x before 10.0.3 SP2 and 10.1.0 before 10.1.0 SP1 does not properly implement the "Decrypt/Verify File via Right-Click" functionality for multi-packet OpenPGP messages that represent multi-message input, which allows remote attackers to spoof signed data by concatenating an additional message to the end of a legitimately signed message, related to a "piggy-back" or "unsigned data injection" issue. PGP Desktop v10.0.x anterior a v10.0.3 SP2 y v10.1.0 anterior a v10.1.0 SP1 no implementa adecu... • http://secunia.com/advisories/42293 • CWE-310: Cryptographic Issues •
CVSS: 9.3EPSS: 2%CPEs: 3EXPL: 0CVE-2010-3397
https://notcve.org/view.php?id=CVE-2010-3397
15 Sep 2010 — Untrusted search path vulnerability in PGP Desktop 9.9.0 Build 397, 9.10.x, 10.0.0 Build 2732, and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tsp.dll or tvttsp.dll that is located in the same folder as a .p12, .pem, .pgp, .prk, .prvkr, .pubkr, .rnd, or .skr file. Vulnerabilidad ruta de búsqueda no confiable en PGP Desktop v9.9.0 Build 397, v9.10.x, v10.0.0 Build 2732, y posiblemente otras versiones... • http://secunia.com/advisories/41135 •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2009-0681
https://notcve.org/view.php?id=CVE-2009-0681
15 Apr 2009 — PGP Desktop before 9.10 allows local users to (1) cause a denial of service (crash) via a crafted IOCTL request to pgpdisk.sys, and (2) cause a denial of service (crash) and execute arbitrary code via a crafted IRP in an IOCTL request to pgpwded.sys. PGP Desktop anterior a v9.10 permite a usuarios locales (1) provocar una denegación de servicio (caída) a través de peticiones IOCTL manipuladas en pgpdisk.sys, y (2) provocar una denegación de servicio (caída) y ejecutar código de su elección a través de una p... • http://en.securitylab.ru/lab/PT-2009-01 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 3CVE-2008-5731 – PGP Desktop 9.0.6 - 'PGPwded.sys' Local Denial of Service
https://notcve.org/view.php?id=CVE-2008-5731
26 Dec 2008 — The PGPwded device driver (aka PGPwded.sys) in PGP Corporation PGP Desktop 9.0.6 build 6060 and 9.9.0 build 397 allows local users to cause a denial of service (system crash) and possibly gain privileges via a certain METHOD_BUFFERED IOCTL request that overwrites portions of memory, related to a "Driver Collapse." NOTE: some of these details are obtained from third party information. El driver del dispositivo GPwded (también conocido como PGPwded.sys) en PGP Corporation PGP Desktop 9.0.6 versión 6060 y 9.9.... • https://www.exploit-db.com/exploits/7556 • CWE-399: Resource Management Errors •
CVSS: 8.8EPSS: 15%CPEs: 1EXPL: 0CVE-2007-0603
https://notcve.org/view.php?id=CVE-2007-0603
30 Jan 2007 — PGP Desktop before 9.5.1 does not validate data objects received over the (1) \pipe\pgpserv named pipe for PGPServ.exe or the (2) \pipe\pgpsdkserv named pipe for PGPsdkServ.exe, which allows remote authenticated users to gain privileges by sending a data object representing an absolute pointer, which causes code execution at the corresponding address. PHP Desktop anterior a 9.5.1 no valida los objetos de datos recibidos por la (1) tubería con nombre \pipe\pgpserv para PGPServ.exe o (2) la tubería con nombre... • http://archives.neohapsis.com/archives/vulnwatch/2007-q1/0025.html •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2005-4151
https://notcve.org/view.php?id=CVE-2005-4151
10 Dec 2005 — The Wipe Free Space utility in PGP Desktop Home 8.0 and Desktop Professional 9.0.3 Build 2932 and earlier does not clear file slack space in the last cluster for the file, which allows local users to access the previous contents of the disk. • http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2002-0850
https://notcve.org/view.php?id=CVE-2002-0850
04 Oct 2002 — Buffer overflow in PGP Corporate Desktop 7.1.1 allows remote attackers to execute arbitrary code via an encrypted document that has a long filename when it is decrypted. Desbordamiento de búfer en PGP Corporate Desktop 7.1.1 permite a atacantes remotos ejecutar código arbitrario mediante un documento cifrado que tiene un nombre de archivo largo cuando es descifrado • http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0106.html •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2002-0788
https://notcve.org/view.php?id=CVE-2002-0788
12 Aug 2002 — An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files that cannot be wiped or deleted due to strong permissions, which could allow certain local users or attackers with physical access to obtain cleartext information. • http://archives.neohapsis.com/archives/bugtraq/2002-05/0052.html • CWE-459: Incomplete Cleanup •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2002-0685
https://notcve.org/view.php?id=CVE-2002-0685
23 Jul 2002 — Heap-based buffer overflow in the message decoding functionality for PGP Outlook Encryption Plug-In, as used in NAI PGP Desktop Security 7.0.4, Personal Security 7.0.3, and Freeware 7.0.3, allows remote attackers to modify the heap and gain privileges via a large, malformed mail message. Desbordamiento de búfer en el plug-in de cifrado PGP para Outlook, usado en NAI PGP Destokp Security 7.0.4, Personal Security 7.0.3 y Freeware 7.0.3 (Utilidades Norton), permite a atacantes remotos modificar el montón (heap... • http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.04/hotfix/ReadMe.txt •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2001-1016
https://notcve.org/view.php?id=CVE-2001-1016
04 Sep 2001 — PGP Corporate Desktop before 7.1, Personal Security before 7.0.3, Freeware before 7.0.3, and E-Business Server before 7.1 does not properly display when invalid userID's are used to sign a message, which could allow an attacker to make the user believe that the document has been signed by a trusted third party by adding a second, invalid user ID to a key which has already been signed by the third party, aka the "PGPsdk Key Validity Vulnerability." • http://www.osvdb.org/1946 •