9.3

CVE-2007-3572

Exploit
Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "`" (backtick) characters (%60 sequences).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Yoggie ≫ Pico
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 8.38% 0.943
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0020.html
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0092.html
http://osvdb.org/37808
http://secunia.com/advisories/25902
Vendor Advisory
Exploit
http://www.securityfocus.com/bid/24743
Exploit
http://www.vupen.com/english/advisories/2007/2417
https://exchange.xforce.ibmcloud.com/vulnerabilities/35208