CWE-20 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-20/ Sun, 26 Feb 2023 09:11:58 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-20 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-20/ 32 32 CVE-2008-7312 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7312/ Sun, 26 Feb 2023 09:11:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7312/ The Filtering Service in Websense Enterprise 5.2 through 6.3 does not consider the IP address during URL categorization, which makes it easier for remote attackers to bypass filtering via an HTTP request, as demonstrated by a request to a compromised server associated with a specific IP address.

The post CVE-2008-7312 appeared first on CVE Vulnerability.

]]> The Filtering Service in Websense Enterprise 5.2 through 6.3 does not consider the IP address during URL categorization, which makes it easier for remote attackers to bypass filtering via an HTTP request, as demonstrated by a request to a compromised server associated with a specific IP address.

The post CVE-2008-7312 appeared first on CVE Vulnerability.

]]> CVE-2008-7316 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7316/ Sun, 26 Feb 2023 09:11:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7316/ mm/filemap.c in the Linux kernel before 2.6.25 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers an iovec of zero length, followed by a page fault for an iovec of nonzero length.

The post CVE-2008-7316 appeared first on CVE Vulnerability.

]]> mm/filemap.c in the Linux kernel before 2.6.25 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers an iovec of zero length, followed by a page fault for an iovec of nonzero length.

The post CVE-2008-7316 appeared first on CVE Vulnerability.

]]> CVE-2008-7269 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7269/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7269/ Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action.

The post CVE-2008-7269 appeared first on CVE Vulnerability.

]]> Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action.

The post CVE-2008-7269 appeared first on CVE Vulnerability.

]]> CVE-2008-7274 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7274/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7274/ IBM WebSphere Application Server (WAS) 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by (1) not providing a password or (2) providing an empty password.

The post CVE-2008-7274 appeared first on CVE Vulnerability.

]]> IBM WebSphere Application Server (WAS) 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by (1) not providing a password or (2) providing an empty password.

The post CVE-2008-7274 appeared first on CVE Vulnerability.

]]> CVE-2008-7278 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7278/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7278/ The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding […]

The post CVE-2008-7278 appeared first on CVE Vulnerability.

]]> The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.

The post CVE-2008-7278 appeared first on CVE Vulnerability.

]]> CVE-2008-7280 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7280/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7280/ Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.

The post CVE-2008-7280 appeared first on CVE Vulnerability.

]]> Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.

The post CVE-2008-7280 appeared first on CVE Vulnerability.

]]> CVE-2008-7286 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7286/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7286/ IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino does not properly handle URLs that request images, which allows remote authenticated users to cause a denial of service (daemon crash) via a request to resources.nsf, aka SPR XFXF7JDBCX.

The post CVE-2008-7286 appeared first on CVE Vulnerability.

]]> IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino does not properly handle URLs that request images, which allows remote authenticated users to cause a denial of service (daemon crash) via a request to resources.nsf, aka SPR XFXF7JDBCX.

The post CVE-2008-7286 appeared first on CVE Vulnerability.

]]> CVE-2008-7289 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7289/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7289/ IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table.

The post CVE-2008-7289 appeared first on CVE Vulnerability.

]]> IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table.

The post CVE-2008-7289 appeared first on CVE Vulnerability.

]]> CVE-2008-7299 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7299/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7299/ IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field.

The post CVE-2008-7299 appeared first on CVE Vulnerability.

]]> IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field.

The post CVE-2008-7299 appeared first on CVE Vulnerability.

]]> CVE-2008-7248 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7248/ Sun, 26 Feb 2023 09:11:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7248/ Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.

The post CVE-2008-7248 appeared first on CVE Vulnerability.

]]> Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.

The post CVE-2008-7248 appeared first on CVE Vulnerability.

]]>