CWE-310 Archives - CVE Vulnerability

CVE-2008-7270

Sun, 26 Feb 2023 09:11:57 +0000

OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.

The post CVE-2008-7270 appeared first on CVE Vulnerability.

CVE-2008-7252

Sun, 26 Feb 2023 09:11:56 +0000

libraries/File.class.php in phpMyAdmin 2.11.x before 2.11.10 uses predictable filenames for temporary files, which has unknown impact and attack vectors.

The post CVE-2008-7252 appeared first on CVE Vulnerability.

CVE-2008-7207

Sun, 26 Feb 2023 09:11:55 +0000

RivetTracker before 1.0 stores passwords in cleartext in config.php, which allows local users to discover passwords by reading config.php.

The post CVE-2008-7207 appeared first on CVE Vulnerability.

CVE-2008-7138

Sun, 26 Feb 2023 09:11:52 +0000

The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day, which allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce.

The post CVE-2008-7138 appeared first on CVE Vulnerability.

CVE-2008-7113

Sun, 26 Feb 2023 09:11:52 +0000

The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 uses a small space of predictable user identification numbers for access control, which allows remote attackers to upload documents via a brute force attack.

The post CVE-2008-7113 appeared first on CVE Vulnerability.

CVE-2008-7023

Sun, 26 Feb 2023 09:11:49 +0000

Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all installations, which allows remote attackers to bypass authentication. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product’s security documentation.

The post CVE-2008-7023 appeared first on CVE Vulnerability.

CVE-2008-7020

Sun, 26 Feb 2023 09:11:49 +0000

McAfee SafeBoot Device Encryption 4 build 4750 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not clear this buffer after use, which allows local users to obtain sensitive information by reading the physical memory locations associated with this buffer.

The post CVE-2008-7020 appeared first on CVE Vulnerability.

CVE-2008-6993

Sun, 26 Feb 2023 09:11:48 +0000

Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

The post CVE-2008-6993 appeared first on CVE Vulnerability.

CVE-2008-6909

Sun, 26 Feb 2023 09:11:46 +0000

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.

The post CVE-2008-6909 appeared first on CVE Vulnerability.

CVE-2008-6908

Sun, 26 Feb 2023 09:11:46 +0000

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges.

The post CVE-2008-6908 appeared first on CVE Vulnerability.