CVE

Id
26612  
CVE No.
CVE-2007-3255  
Status
Candidate  
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via (1) a saved Workflow name or (2) the Content-Type HTTP header. NOTE: item 2 also affects the same version numbers of Xythos Digital Locker (XDL). One or both vectors might also affect Xythos WebFile Server.  
Phase
Assigned (20070619)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
270206 26612 CVE-2007-3255 BUGTRAQ:20070622 SYMSA-2007-004: Multiple Vulnerabilities in Xythos Server Products  View
270207 26612 CVE-2007-3255 URL:http://www.securityfocus.com/archive/1/archive/1/472275/100/0/threaded  View
270208 26612 CVE-2007-3255 MISC:http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-004.txt  View
270209 26612 CVE-2007-3255 BID:24521  View
270210 26612 CVE-2007-3255 URL:http://www.securityfocus.com/bid/24521  View
270211 26612 CVE-2007-3255 OSVDB:37615  View
270212 26612 CVE-2007-3255 URL:http://osvdb.org/37615  View
270213 26612 CVE-2007-3255 OSVDB:37616  View
270214 26612 CVE-2007-3255 URL:http://osvdb.org/37616  View
270215 26612 CVE-2007-3255 SECTRACK:1018291  View
270216 26612 CVE-2007-3255 URL:http://securitytracker.com/id?1018291  View
270217 26612 CVE-2007-3255 SECTRACK:1018292  View
270218 26612 CVE-2007-3255 URL:http://securitytracker.com/id?1018292  View
270219 26612 CVE-2007-3255 SECUNIA:25783  View
270220 26612 CVE-2007-3255 URL:http://secunia.com/advisories/25783  View
270221 26612 CVE-2007-3255 SREASON:2845  View
270222 26612 CVE-2007-3255 URL:http://securityreason.com/securityalert/2845  View
270223 26612 CVE-2007-3255 XF:xedm-multiple-csrf(35084)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
51809 JVNDB-2007-000472 GNOME Evolution Data Server における負の配列インデックスによるメモリアクセスの脆弱性 GNOME Evolution Data Server のメーラーコンポーネントである Camel(camel-imap-folder.c) には、IMAP サーバからのメッセージ処理に不備があり、SEQUENCE 変数を介して負の配列インデックスを使用してしまい、不正なメモリ参照が行われる問題があります。 CVE-2007-3257 26612 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-000472.html  View