CVE-2007-6506

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 16%

exploitation probability

16%top 3% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4, allows remote attackers to (1) overwrite and corrupt arbitrary files via arguments to the SaveToFile method, and possibly (2) access arbitrary files via the LoadDataFromFile method.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/4757unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://blogs.zdnet.com/security/?p=768 http://computerworld.com/action/article.do?command=viewArticleBasic&articleId=9053818 http://it.slashdot.org/it/07/12/20/2327242.shtml http://secunia.com/advisories/28177 https://exchange.xforce.ibmcloud.com/vulnerabilities/39153 https://www.exploit-db.com/exploits/4757 http://www.anspi.pl/~porkythepig/hp-issue/wyfukanyszynszyl.txt http://www.securityfocus.com/archive/1/485451/100/0/threaded http://www.securityfocus.com/archive/1/485734/100/0/threaded http://www.securityfocus.com/bid/26950 http://www.securitytracker.com/id?1019133 http://www.vupen.com/english/advisories/2007/4271