CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 3CVE-2021-34557
https://notcve.org/view.php?id=CVE-2021-34557
10 Jun 2021 — XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. XScreenSaver versión 5.45 puede ser omitido si la máquina tiene más de diez salidas de vídeo desconectables. Un desbordamiento de búfer en la función update_screen_layout() permite a un atacante omitir el m... • http://www.openwall.com/lists/oss-security/2021/06/11/1 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-31523
https://notcve.org/view.php?id=CVE-2021-31523
21 Apr 2021 — The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency. El paquete Debian xscreensaver versión 5.42+dfsg1-1 para XScreenSaver presenta la función cap_net_raw habilitado para el archivo /usr/libexec/xscreensaver/sonar, lo que permite a usuarios locales alcanzar privilegios porque podría decirse... • http://www.openwall.com/lists/oss-security/2021/04/21/3 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 2CVE-2011-2187
https://notcve.org/view.php?id=CVE-2011-2187
27 Nov 2019 — xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication. xscreensaver versiones anteriores a la versión 5.14, se bloquea durante la activación y deja la pantalla desbloqueada cuando está en Modo Blank Only y cuando DPMS está desactivado, lo que permite a atacantes locales acceder a los recursos sin identificación • https://access.redhat.com/security/cve/cve-2011-2187 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2015-8025 – Debian Security Advisory 3438-1
https://notcve.org/view.php?id=CVE-2015-8025
04 Nov 2015 — driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors. driver/subprocs.c en XScreenSaver en versiones anteriores a 5.34 no lleva a cabo correctamente una comprobación de consistencia interna, lo que permite a atacantes físicamente próximos eludir la pantalla de bloqueo cambiando los monitores sin apagar el dispositivo. It was discovered that unplugging one of the mo... • http://lists.opensuse.org/opensuse-updates/2015-11/msg00102.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5585
https://notcve.org/view.php?id=CVE-2007-5585
19 Oct 2007 — xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-helper does not exist and a user attempts to unlock the screen, which allows attackers with physical access to gain access to the locked session. xscreensaver 5.03 y anteriores, cuando funciona sin las instalaciones xscreensaver-gl-extras (GL extras), caen cuando /usr/bin/xscreensaver-gl-helper no existe y un usuario intenta desbloquar la pantalla, lo cual permite a atacant... • http://secunia.com/advisories/27392 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 13EXPL: 0CVE-2007-1859 – xscreensaver authentication bypass
https://notcve.org/view.php?id=CVE-2007-1859
02 May 2007 — XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in drivers/lock.c when there is no network connectivity, which causes XScreenSaver to crash and unlock the screen and allows local users to bypass authentication. XScreenSaver versión 4.10, cuando está usando un servicio de directorio remoto para credenciales, no maneja apropiadamente los resultados de la función getpwuid en el archivo drivers/lock.c cuando no hay conecti... • http://osvdb.org/35531 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 0CVE-2004-2655
https://notcve.org/view.php?id=CVE-2004-2655
31 Dec 2004 — rdesktop 1.3.1 with xscreensaver 4.14, and possibly other versions, when running on Fedora and possibly other platforms, does not release the keyboard focus when xscreensaver starts, which causes the password to be entered into the active window when the user unlocks the screen. • ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2003-0885
https://notcve.org/view.php?id=CVE-2003-0885
31 Dec 2003 — Xscreensaver 4.14 contains certain debugging code that should have been omitted, which causes Xscreensaver to create temporary files insecurely in the (1) apple2, (2) xanalogtv, and (3) pong screensavers, and allows local users to overwrite arbitrary files via a symlink attack. • http://bugs.gentoo.org/show_bug.cgi?id=41253 •
CVSS: 5.5EPSS: 0%CPEs: 18EXPL: 0CVE-2003-1294
https://notcve.org/view.php?id=CVE-2003-1294
31 Dec 2003 — Xscreensaver before 4.15 creates temporary files insecurely in (1) driver/passwd-kerberos.c, (2) driver/xscreensaver-getimage-video, (3) driver/xscreensaver.kss.in, and the (4) vidwhacker and (5) webcollage screensavers, which allows local users to overwrite arbitrary files via a symlink attack. • ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc •