CWE-732 Archives - CVE Vulnerability

CVE-2008-4870

Sun, 26 Feb 2023 09:10:45 +0000

dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value.

The post CVE-2008-4870 appeared first on CVE Vulnerability.

CVE-2008-3789

Sun, 26 Feb 2023 09:10:11 +0000

Samba 3.2.0 uses weak permissions (0666) for the (1) group_mapping.tdb and (2) group_mapping.ldb files, which allows local users to modify the membership of Unix groups.

The post CVE-2008-3789 appeared first on CVE Vulnerability.

CVE-2008-0884

Sun, 26 Feb 2023 09:08:45 +0000

The Replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in Red Hat Enterprise Linux (RHEL) 5 uses lstat instead of stat to determine the /etc/pam.d/system-auth file permissions, leading to a change to world-writable permissions for the /etc/pam.d/system-auth-ac file, which allows local users to gain privileges by modifying this file.

The post CVE-2008-0884 appeared first on CVE Vulnerability.

CVE-2008-0662

Sun, 26 Feb 2023 09:08:39 +0000

The Auto Local Logon feature in Check Point VPN-1 SecuRemote/SecureClient NGX R60 and R56 for Windows caches credentials under the CheckpointSecuRemote registry key, which has Everyone/Full Control permissions, which allows local users to gain privileges by reading and reusing the credentials.

The post CVE-2008-0662 appeared first on CVE Vulnerability.

CVE-2007-6033

Sun, 26 Feb 2023 09:07:58 +0000

Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated attackers, and possibly anonymous users, to execute arbitrary programs.

The post CVE-2007-6033 appeared first on CVE Vulnerability.

CVE-2007-5743

Sun, 26 Feb 2023 09:07:50 +0000

viewvc 1.0.3 allows improper access control to files in a repository when using the “forbidden” configuration option.

The post CVE-2007-5743 appeared first on CVE Vulnerability.

CVE-2007-5544

Sun, 26 Feb 2023 09:07:44 +0000

IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:Full Control) for memory mapped files (shared memory) in IPC, which allows local users to obtain sensitive information, or inject Lotus Script or other character sequences into a session.

The post CVE-2007-5544 appeared first on CVE Vulnerability.

CVE-2018-9867

Sun, 26 Feb 2023 06:51:52 +0000

In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V).

The post CVE-2018-9867 appeared first on CVE Vulnerability.

CVE-2018-8931

Sun, 26 Feb 2023 06:51:40 +0000

The AMD Ryzen, Ryzen Pro, and Ryzen Mobile processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-1.

The post CVE-2018-8931 appeared first on CVE Vulnerability.

CVE-2018-8932

Sun, 26 Feb 2023 06:51:40 +0000

The AMD Ryzen and Ryzen Pro processor chips have insufficient access control for the Secure Processor, aka RYZENFALL-2, RYZENFALL-3, and RYZENFALL-4.

The post CVE-2018-8932 appeared first on CVE Vulnerability.