CVE-2007-0389

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier, and ArsDigita Community Education Solution (ACES) 1.1, allows remote attackers to read arbitrary files via .%252e/ (double-encoded dot dot slash) sequences in the URI.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jan 19, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-03906.8Cross-site scripting (XSS) vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via th CVE-2007-03917.2Format string vulnerability in the log creation functionality of BitDefender Client Professional Plus 8.02 allows attackers to execute arbit CVE-2007-03924.6IBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by CVE-2007-03934.6Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges b CVE-2007-03944.6HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges CVE-2007-03957.5PHP remote file inclusion vulnerability in libraries/grab_globals.lib.php in ComVironment 4.0 allows remote attackers to execute arbitrary P CVE-2007-03967.1Unspecified vulnerability in HP-UX B.11.23, when running IPFilter in combination with PHNE_34474, allows remote attackers to cause a denial CVE-2007-03976.4The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.CVE-2007-03986.8Multiple cross-site scripting (XSS) vulnerabilities in forum.php3 in Arnaud Guyonne (aka Arnotic) a-forum allow remote attackers to inject a CVE-2007-03996.0Multiple cross-site scripting (XSS) vulnerabilities in index.php in Simple Machines Forum (SMF) 1.1 RC3 allow remote authenticated users to CVE-2007-04006.8Cross-site scripting (XSS) vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to inject ar CVE-2007-04017.5SQL injection vulnerability in admin/memberlist.php in Easebay Resources Login Manager 3.0 allows remote attackers to execute arbitrary SQL