CVE-2007-6735

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

NWFTPD.nlm before 5.08.06 in the FTP server in Novell NetWare does not properly handle partial matches for container names in the FTPREST.TXT file, which allows remote attackers to bypass intended access restrictions via an FTP session.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Apr 5, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-67366.5Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary CVE-2007-67377.5FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, CVE-2007-67385.0pyftpdlib before 0.1.1 does not choose a random value for the port associated with the PASV command, which makes it easier for remote attack CVE-2007-67395.0FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.CVE-2007-67404.0The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which m CVE-2007-67416.5The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP a CVE-2007-67426.8The get_filter_list function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0006 does not properly perform certain sub f CVE-2007-67434.0Double free vulnerability in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0005 allows remote authenticated users to cause CVE-2007-67442.1Flexera Macrovision InstallShield before 2008 sends a digital-signature password to an unintended application during certain signature opera CVE-2007-67459.8clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.CVE-2007-67465.8telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA, (2) that the server hostname matches a domain name in the CVE-2007-67505.0The Apache HTTP Server 1.x and 2.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demons