CVE-2007-5320

Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via the CacheFile attribute in the ThumbnailXpres.1 ActiveX control (PegasusImaging.ActiveX.ThumnailXpress1.dll) or (2) overwrite arbitrary files via the CompactFile function in the ImagXpress.8 ActiveX control (PegasusImaging.ActiveX.ImagXpress8.dll).

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2007-10-09

Last modified

2024-08-07

Weaknesses

CWE-22

Affected products

• Imagxpress (Pegasus Imaging)

References

• http://osvdb.org/37959
• http://osvdb.org/37960
• http://secunia.com/advisories/27095
• http://shinnai.altervista.org/exploits/txt/TXT_3DQ1nIkI6zmWCek4zP5U.html
• http://shinnai.altervista.org/exploits/txt/TXT_wfv7ZG0G6KnQlk1SieLd.html
• http://www.securityfocus.com/bid/25948
• http://www.securityfocus.com/bid/25949
• http://www.vupen.com/english/advisories/2007/3388
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37012