CWE-264 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-264/ Sun, 26 Feb 2023 09:11:57 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-264 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-264/ 32 32 CVE-2008-7276 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7276/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7276/ Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal value.

The post CVE-2008-7276 appeared first on CVE Vulnerability.

]]> Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal value.

The post CVE-2008-7276 appeared first on CVE Vulnerability.

]]> CVE-2008-7277 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7277/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7277/ Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.

The post CVE-2008-7277 appeared first on CVE Vulnerability.

]]> Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.

The post CVE-2008-7277 appeared first on CVE Vulnerability.

]]> CVE-2008-7279 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7279/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7279/ The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.

The post CVE-2008-7279 appeared first on CVE Vulnerability.

]]> The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.

The post CVE-2008-7279 appeared first on CVE Vulnerability.

]]> CVE-2008-7282 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7282/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7282/ Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.

The post CVE-2008-7282 appeared first on CVE Vulnerability.

]]> Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.

The post CVE-2008-7282 appeared first on CVE Vulnerability.

]]> CVE-2008-7283 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7283/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7283/ Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.

The post CVE-2008-7283 appeared first on CVE Vulnerability.

]]> Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.

The post CVE-2008-7283 appeared first on CVE Vulnerability.

]]> CVE-2008-7293 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7293/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7293/ Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7293 appeared first on CVE Vulnerability.

]]> Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7293 appeared first on CVE Vulnerability.

]]> CVE-2008-7294 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7294/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7294/ Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7294 appeared first on CVE Vulnerability.

]]> Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7294 appeared first on CVE Vulnerability.

]]> CVE-2008-7295 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7295/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7295/ Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7295 appeared first on CVE Vulnerability.

]]> Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7295 appeared first on CVE Vulnerability.

]]> CVE-2008-7296 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7296/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7296/ Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7296 appeared first on CVE Vulnerability.

]]> Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7296 appeared first on CVE Vulnerability.

]]> CVE-2008-7297 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7297/ Sun, 26 Feb 2023 09:11:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7297/ Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7297 appeared first on CVE Vulnerability.

]]> Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a “cookie forcing” issue.

The post CVE-2008-7297 appeared first on CVE Vulnerability.

]]>