rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-2299 
Multiple SQL injection vulnerabilities in Frogss CMS 0.7 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) dzial parameter to (a) katalog.php, or the (2) t parameter to (b) forum.php or (c) forum/viewtopic.php, different vectors than CVE-2006-4536.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2300 
Multiple cross-site scripting (XSS) vulnerabilities in Endy Kristanto Surat kabar / News Management Online (aka phpwebnews) 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the m_txt parameter to (1) iklan.php, (2) index.php, or (3) bukutamu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2301 
Multiple PHP remote file inclusion vulnerabilities in audioCMS arash 0.1.4 allow remote attackers to execute arbitrary PHP code via a URL in the arashlib_dir parameter to (1) edit.inc.php and (2) list_features.inc.php in arash_lib/include, and (3) arash_gadmin.class.php and (4) arash_sadmin.class.php in arash_lib/class/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2302 
PHP remote file inclusion vulnerability in autoindex.php in Expow 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2303 
Directory traversal vulnerability in includes/footer.php in News Manager Deluxe (NMDeluxe) 1.0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2304 
Multiple directory traversal vulnerabilities in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the theme parameter to categories.php and other unspecified files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2305 
Multiple SQL injection vulnerabilities in authenticate.php in Quick and Dirty Blog (QDBlog) 0.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2306 
Multiple cross-site scripting (XSS) vulnerabilities in the Virtual War (VWar) 1.5.0 R15 and earlier module for PHP-Nuke, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) memberlist parameter to extra/login.php and the (2) title parameter to extra/today.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2307 
PHP remote file inclusion vulnerability in engine/engine.inc.php in WebKalk2 1.9.0 allows remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2308 
Cross-site scripting (XSS) vulnerability in cas.php in FloweRS 2.0 allows remote attackers to inject arbitrary web script or HTML via the rok parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2309 
Cross-site scripting (XSS) vulnerability in cas.php in FloweRS 2.0 allows remote attackers to inject arbitrary web script or HTML via the den parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2310 
Cross-site scripting (XSS) vulnerability in plugins/spaw/img_popup.php in BloofoxCMS 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the img_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2311 
PHP remote file inclusion vulnerability in install/index.php in BlooFoxCMS 0.2.2 allows remote attackers to execute arbitrary PHP code via a URL in the content_php parameter.  NOTE: this issue has been disputed by a reliable third party, stating that content_php is initialized before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2312 
Multiple SQL injection vulnerabilities in the Virtual War (VWar) 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/.  NOTE: this might be same vulnerability as CVE-2006-4142; however, there is an intervening vendor fix announcement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2313 
PHP remote file inclusion vulnerability in getinfo1.php in the Shotcast 1.0 RC2 module for mxBB allows remote attackers to execute arbitrary PHP code via a URL in the mx_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2314 
Multiple SQL injection vulnerabilities in Crea-Book 1.0, and possibly earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) pseudo or (2) passe parameter to (a) configurer.php, (b) connect.php, (c) delete.php, (d) delete2.php, (e) index.php, (f) infos.php, (g) membres.php, (h) modif-infos.php, (i) modif-message.php, (j) modif.php, (k) uninstall.php, or (l) uninstall_table.php in admin/, different vectors than CVE-2007-2000.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2315 
MiniShare 1.5.4, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a flood of requests for new connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2316 
Unspecified vulnerability in the admin script in Open Business Management (OBM) before 2.0.0 allows remote attackers to have an unknown impact by calling the script "in txt mode from a browser."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2317 
Multiple PHP remote file inclusion vulnerabilities in MiniBB Forum 1.5a and earlier, as used by TOSMO/Mambo 4.0.12 and probably other products, allow remote attackers to execute arbitrary PHP code via a URL in the absolute_path parameter to bb_plugins.php in (1) components/minibb/ or (2) components/com_minibb, or (3) configuration.php.  NOTE: the com_minibb.php vector is already covered by CVE-2006-3690.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2318 
Multiple format string vulnerabilities in FileZilla before 2.2.32 allow remote attackers to execute arbitrary code via format string specifiers in (1) FTP server responses or (2) data sent by an FTP server.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2319 
PHP remote file inclusion vulnerability in the AutoStand 1.1 and earlier module for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to mod_as_category.php in (1) modules/mod_as_category/ or (2) modules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2320 
SQL injection vulnerability in kontakt.php in Papoo 3.02 and earlier allows remote attackers to execute arbitrary SQL commands via the menuid parameter, a different vector than CVE-2005-4478.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-26T21:00:00.000Z
CVE-2007-2321 
Unspecified vulnerability in the search functionality in SilverStripe 2.0.0 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2322 
NMMediaServer.exe in Nero MediaHome 2.5.5.0 and CE 1.3.0.4 allows remote attackers to cause a denial of service (NULL dereference and application crash) via a crafted packet that contains two CRLF sequences.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2323 
Multiple buffer overflows in the WinDVDX ActiveX control in InterVideo Home Theater 2.1.13.0 and 2.5.13.58 allow remote attackers to execute arbitrary code via a long string argument to the (1) GetDiscType or (2) AddFileList method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2324 
Directory traversal vulnerability in file.php in JulmaCMS 1.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2325 
PHP remote file inclusion vulnerability in include.php in MyNewsGroups :) allows remote attackers to execute arbitrary PHP code via a URL in the myng_root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2326 
Multiple PHP remote file inclusion vulnerabilities in HYIP Manager Pro allow remote attackers to execute arbitrary PHP code via a URL in the plugin_file parameter to (1) Smarty.class.php and (2) Smarty_Compiler.class.php in inc/libs/; (3) core.display_debug_console.php, (4) core.load_plugins.php, (5) core.load_resource_plugin.php, (6) core.process_cached_inserts.php, (7) core.process_compiled_include.php, and (8) core.read_cache_file.php in inc/libs/core/; and other unspecified files.  NOTE: (1) and (2) might be incorrectly reported vectors in Smarty.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2327 
PHP remote file inclusion vulnerability in _editor.php in HTMLeditbox 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the settings[app_dir] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2328 
PHP remote file inclusion vulnerability in addvip.php in phpMYTGP 1.4b allows remote attackers to execute arbitrary PHP code via a URL in the msetstr[PROGSDIR] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2329 
PHP remote file inclusion vulnerability in searchbot.php in Searchactivity allows remote attackers to execute arbitrary PHP code via a URL in the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2330 
PHP remote file inclusion vulnerability in includes_handler.php in DynaTracker 151 allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2331 
PHP remote file inclusion vulnerability in cart.php in Shop-Script 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the lang_list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T00:00:00.000Z
CVE-2007-2332 
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 6_05.140 uses a fixed DES key to encrypt passwords, which allows remote authenticated users to obtain a password via a brute force attack on a hash from the LDAP store.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2333 
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 includes the FIPSecryptedtest1219 and FIPSunecryptedtest1219 default accounts in the LDAP template, which might allow remote attackers to access the private network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2334 
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via certain requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2335 
Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2336 
Unspecified vulnerability in InterVations NaviCOPA Web Server 2.01 20070323 allows remote attackers to cause a denial of service (daemon crash) via crafted HTTP requests, as demonstrated by long requests containing '\A' characters, probably a different issue than CVE-2006-5112 and CVE-2007-1733.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2337 
Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS 0.96.6 Alpha and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to (a) magpie_debug.php and (b) magpie_simple.php in external/magpierss/scripts/, the (2) rss_url parameter to (c) magpie_slashbox.php in external/magpierss/scripts/, and the (3) body parameter to the (d) weblogmodule (aka Weblog Comments) module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2338 
Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2339 
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2340 
Multiple PHP remote file inclusion vulnerabilities in inc/include_all.inc.php in phporacleview allow remote attackers to execute arbitrary PHP code via a URL in the (1) page_dir or (2) inc_dir parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2341 
PHP remote file inclusion vulnerability in suite/index.php in phpBandManager 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the pg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2342 
SQL injection vulnerability in error.asp in CreaScripts CreaDirectory 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2006-6083.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T16:00:00.000Z
CVE-2007-2343 
Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, allows remote attackers to execute arbitrary code via crafted request packets that contain long file names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T17:00:00.000Z
CVE-2007-2344 
The BOOTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, on Windows allows remote attackers to cause a denial of service (daemon crash) via a UDP packet that contains an invalid "packet type" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T17:00:00.000Z
CVE-2007-2345 
PHP remote file inclusion vulnerability in include/include_stream.inc.php in CodeWand phpBrowse allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T17:00:00.000Z
CVE-2007-2346 
Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary PHP code via a URL in the _APP_RELATIVE_PATH parameter to (1) include.php, (2) dbcommon/include.php, and (3) exception/include.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T17:00:00.000Z
CVE-2007-2347 
PHP remote file inclusion vulnerability in main/forum/komentar.php in OneClick CMS (aka Sisplet CMS) 05.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the site_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T17:00:00.000Z
CVE-2007-2348 
mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execute shell commands via a malicious script.  NOTE: it is not clear whether this issue crosses security boundaries, since the script already supports commands such as "get" which could overwrite executable files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-27T18:00:00.000Z
CVE-2007-2349 
Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2350 
admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the del parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2351 
Unspecified vulnerability in the HP Power Manager Remote Agent (RA) 4.0Build10 and earlier in HP-UX B.11.11 and B.11.23 allows local users to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2352 
Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, which are used in (1) warn and (2) err calls, possibly involving (a) lib/s3.cpp, (b) tools/afconvert.cpp, (c) tools/afcopy.cpp, (d) tools/afinfo.cpp, (e) aimage/imager.cpp, and (f) tools/afxml.cpp.  NOTE: this identifier is intended to address the vectors that were not fixed in CVE-2007-2054, but the unfixed vectors were not explicitly listed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2353 
Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2354 
Progress Webspeed Messenger allows remote attackers to obtain sensitive information via a WService parameter containing "wsbroker1/webutil/about.r", which reveals the operating system and product information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2355 
The get_url function in DODS_Dispatch.pm for the CGI_server in OPeNDAP 3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2356 
Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2357 
Cross-site scripting (XSS) vulnerability in mods/Core/result.php in SineCms 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the stringa parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2358 
Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) inc_path parameter to (a) a_noskin.php, (b) a_stub.php, (c) admin.php, (d) contact.php, (e) default.php, (f) index.php, and (g) multiblogs.php in blogs/; the (2) view_path and (3) control_path parameters to blogs/admin.php; and the (4) skins_path parameter to (h) blogs/contact.php and (i) blogs/multiblogs.php.  NOTE: this issue is disputed by CVE, since the inc_path, view_path, control_path, and skins_path variables are all initialized in conf/_advanced.php before they are used
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2359 
Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, allows local users to gain privileges via a long string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2360 
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the credentials by calculating the key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2007-2361 
Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions (world readable) for a configuration file with network share credentials, which allows local users to obtain the credentials by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z