Unscored severity · published Jan 9, 2007
CVE-2007-0148
Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string…
–
CVSS
6.4%
EPSS
No
On KEV
Description
Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in the Javascript alert function.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OM
Omniweb · Omnigroup
5.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0148
blog.omnigroup.com
http://blog.omnigroup.com/2007/01/07/omniweb-552-now-available-and-more-secure/
osvdb.org
http://osvdb.org/31222
Vendor Advisory
http://projects.info-pull.com/moab/MOAB-07-01-2007.html
Patch
http://secunia.com/advisories/23624
www.digitalmunition.com
http://www.digitalmunition.com/DMA%5B2007-0107a%5D.txt
Patch
http://www.omnigroup.com/applications/omniweb/releasenotes/
More from Omniweb
7.5
CVE-2007-0342
WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD element with a large number in the…
–
CVE-2010-1102
Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data…
–
CVE-2005-0976
AppleWebKit (WebCore and WebKit), as used in multiple products such as Safari 1.2 and OmniGroup OmniWeb 5.1, allows remote attackers to read arbitrary files via the XMLHttpRequest…
–
CVE-2005-0236
The International Domain Name (IDN) support in Omniweb 5 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL…
–
CVE-2005-0238
The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL…