CWE-255 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-255/ Sun, 26 Feb 2023 09:11:58 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-255 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-255/ 32 32 CVE-2008-7309 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7309/ Sun, 26 Feb 2023 09:11:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7309/ Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model’s attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a “mass assignment” vulnerability.

The post CVE-2008-7309 appeared first on CVE Vulnerability.

]]> Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model’s attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a “mass assignment” vulnerability.

The post CVE-2008-7309 appeared first on CVE Vulnerability.

]]> CVE-2008-7311 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7311/ Sun, 26 Feb 2023 09:11:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7311/ The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.

The post CVE-2008-7311 appeared first on CVE Vulnerability.

]]> The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.

The post CVE-2008-7311 appeared first on CVE Vulnerability.

]]> CVE-2008-7320 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7320/ Sun, 26 Feb 2023 09:11:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7320/ ** DISPUTED ** GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision.

The post CVE-2008-7320 appeared first on CVE Vulnerability.

]]> ** DISPUTED ** GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision.

The post CVE-2008-7320 appeared first on CVE Vulnerability.

]]> CVE-2008-7255 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7255/ Sun, 26 Feb 2023 09:11:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7255/ login_screen.tcl in aMSN (aka Alvaro’s Messenger) before 0.97.1 saves a password after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation.

The post CVE-2008-7255 appeared first on CVE Vulnerability.

]]> login_screen.tcl in aMSN (aka Alvaro’s Messenger) before 0.97.1 saves a password after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation.

The post CVE-2008-7255 appeared first on CVE Vulnerability.

]]> CVE-2008-7261 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7261/ Sun, 26 Feb 2023 09:11:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7261/ The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file.

The post CVE-2008-7261 appeared first on CVE Vulnerability.

]]> The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file.

The post CVE-2008-7261 appeared first on CVE Vulnerability.

]]> CVE-2008-7050 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7050/ Sun, 26 Feb 2023 09:11:50 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7050/ The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain […]

The post CVE-2008-7050 appeared first on CVE Vulnerability.

]]> The password_check function in auth/auth_phpbb3.php in WoW Raid Manager 3.5.1 before Patch 1, when using PHPBB3 authentication, (1) does not invoke the CheckPassword function with the required arguments, which always triggers an authentication failure, and (2) returns true instead of false when an authentication failure occurs, which allows remote attackers to bypass authentication and gain privileges with an arbitrary password.

The post CVE-2008-7050 appeared first on CVE Vulnerability.

]]> CVE-2008-6971 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6971/ Sun, 26 Feb 2023 09:11:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6971/ The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.

The post CVE-2008-6971 appeared first on CVE Vulnerability.

]]> The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges.

The post CVE-2008-6971 appeared first on CVE Vulnerability.

]]> CVE-2008-6817 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6817/ Sun, 26 Feb 2023 09:11:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6817/ Mole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6817 appeared first on CVE Vulnerability.

]]> Mole Group Lastminute Script 4.0 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6817 appeared first on CVE Vulnerability.

]]> CVE-2008-6818 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6818/ Sun, 26 Feb 2023 09:11:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6818/ Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6818 appeared first on CVE Vulnerability.

]]> Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6818 appeared first on CVE Vulnerability.

]]> CVE-2008-6577 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-6577/ Sun, 26 Feb 2023 09:11:36 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-6577/ Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges.

The post CVE-2008-6577 appeared first on CVE Vulnerability.

]]> Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges.

The post CVE-2008-6577 appeared first on CVE Vulnerability.

]]>