Code injection

Dave Nielsen and Patrick Breitenbach PayPal Web Services aka PHP Toolkit 0.50 and possibly earlier has 1 world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information payment data, and 2 world-writable permissions for ipn/logs, which allows local...

CVE-2006-0202

CVE-2006-0202 affects PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier. The issue is due to insecure filesystem permissions: ipn/logs/ipn_success.txt is world-readable, allowing local users to view payment data, and ipn/logs is world-writable, enabling local users to delete or repl...

CVE-2005-3088

CVE-2005-3088 affects fetchmail and its fetchmailconf component. The advisory describes that, in versions prior to the fixes noted in references, configuration files are created with insecure world-readable permissions, allowing local users to read sensitive data such as passwords. OpenVAS and di...

CVE-2005-3088: Exposure of Sensitive Information to an Unauthorized Actor

fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...

CVE-2005-3147

StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information...

CVE-2005-3147: Undefined Security Weakness

StoreBackup before 1.19 creates the backup root with world-readable permissions, which allows local users to obtain sensitive information...

CVE-2005-2962

The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password...

CVE-2005-2962

The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password...

CVE-2005-2962

The ntlmaps package is affected. The post-installation script for ntlmaps before version 0.9.9 changes the configuration file to world-readable, allowing local users to read the Windows NT username and password ntlmaps connects to. Debian advisories (DSA-830-1) state this has been fixed in 0.9.9-...

CVE-2005-2962

The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password...

CVE-2005-2962: Undefined Security Weakness

The post-installation script for ntlmaps before 0.9.9 sets world-readable permissions for the configuration file, which allows local users to obtain the username and password...

CVE-2005-2945

arc 5.21j and earlier create temporary files with world-readable permissions, which allows local users to read sensitive information from files created by 1 arc arc.c or 2 marc marc.c...

CVE-2005-2945: Undefined Security Weakness

arc 5.21j and earlier create temporary files with world-readable permissions, which allows local users to read sensitive information from files created by 1 arc arc.c or 2 marc marc.c...

CVE-2005-1855

Backup Manager backup-manager before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive information...

CVE-2005-1855: Undefined Security Weakness

Backup Manager backup-manager before 0.5.8 creates backup files with world-readable default permissions, which allows local users to obtain sensitive information...

CVE-2004-2398: Undefined Security Weakness

Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attacks by reading the file names from /var/lib/mysql, which is assigned world-readable permissions by cPanel 9.3.0 R5...

CVE-2004-2337

The CVE-2004-2337 entry concerns the file /.inlook/.crypt in inlook 0.7.3 and earlier, which is installed with world readable permissions. This allows local users to access POP3 credentials stored by the application. The root cause is improper permissions on the .crypt file, leading to confidenti...

CVE-2004-2337: Undefined Security Weakness

The /.inlook/.crypt file for inlook 0.7.3 and earlier is installed with world readable permissions, which allows local users to obtain user POP3 credentials...

CVE-2005-2136

Raritan Dominion SX DSX Console Servers DSX16, DSX32, DSX4, DSX8, and DSXA-48 set 1 world-readable permissions for /etc/shadow and 2 world-writable permissions for /bin/busybox, which allows local users to obtain hashed passwords or execute arbitrary code as other users...

CVE-2002-1970: Undefined Security Weakness

SnortCenter 0.9.5, when configured to push Snort rules, stores the rules in a temporary file with world-readable and world-writable permissions, which allows local users to obtain usernames and passwords for the alert database servers...