CVE-2007-3787

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://labs.calyptix.com/CX-2007-05.phpPatch, Vendor Advisory
http://labs.calyptix.com/CX-2007-05.txtPatch, Vendor Advisory
http://osvdb.org/38175
http://secunia.com/advisories/26005
http://www.securityfocus.com/archive/1/473663/100/0/threaded
http://labs.calyptix.com/CX-2007-05.phpPatch, Vendor Advisory
http://labs.calyptix.com/CX-2007-05.txtPatch, Vendor Advisory
http://osvdb.org/38175
http://secunia.com/advisories/26005
http://www.securityfocus.com/archive/1/473663/100/0/threaded

Timeline

Published: Jul 15, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-37887.6The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document, which might allow context-dependent attacker CVE-2007-37897.5SQL injection vulnerability in admin/index.php in Inmostore 4.0 allows remote attackers to execute arbitrary SQL commands via the Password f CVE-2007-37905.8The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial of service via a long CVE-2007-37917.5Buffer overflow in the w_read function in sockets.c in Cami Sardinha and Nigel Kukard policyd before 1.81 for Postfix allows remote attacker CVE-2007-37924.3Multiple PHP remote file inclusion vulnerabilities in AzDG Dating Gold 3.0.5 allow remote attackers to execute arbitrary PHP code via a URL CVE-2007-37937.5SQL injection vulnerability in Job Management Partner 1/NETM/DM (JP1/NETM/DM) Manager on Windows before 20070413 allows remote attackers to CVE-2007-379410.0Buffer overflow in Hitachi Cosminexus V4 through V7, Processing Kit for XML before 20070511, Developer's Kit for Java before 20070312, and t CVE-2007-37957.1Unspecified vulnerability in Hitachi TP1/Server Base before 03-05-/P, 05-00-x before 05-00-/G, 05-01-x before 05-01-/A, and 05-02-x before 0 CVE-2007-37967.6The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify CVE-2007-37989.8Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via craf CVE-2007-37994.3The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes CVE-2007-38006.0Unspecified vulnerability in the Real-time scanner (RTVScan) component in Symantec AntiVirus Corporate Edition 9.0 through 10.1 and Client S