CVE-2007-3504

Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier, and Java Web Start in SDK and JRE 1.4.2_13 and earlier, for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.

• CWE-22

• http://docs.info.apple.com/article.html?artnum=307177
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
• http://osvdb.org/37755
• http://secunia.com/advisories/25823Vendor Advisory
• http://secunia.com/advisories/28115Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1Patch
• http://www.securityfocus.com/archive/1/472673/100/0/threaded
• http://www.securityfocus.com/bid/24695
• http://www.securitytracker.com/id?1018328
• http://www.vupen.com/english/advisories/2007/2384Vendor Advisory
• http://www.vupen.com/english/advisories/2007/4224Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35169
• http://docs.info.apple.com/article.html?artnum=307177
• http://lists.apple.com/archives/Security-announce/2007/Dec/msg00001.html
• http://osvdb.org/37755
• http://secunia.com/advisories/25823Vendor Advisory
• http://secunia.com/advisories/28115Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102957-1Patch
• http://www.securityfocus.com/archive/1/472673/100/0/threaded
• http://www.securityfocus.com/bid/24695
• http://www.securitytracker.com/id?1018328
• http://www.vupen.com/english/advisories/2007/2384Vendor Advisory
• http://www.vupen.com/english/advisories/2007/4224Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35169

Published

Jun 30, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-3498Cross-site scripting (XSS) vulnerability in smoketests/confi…
• CVE-2007-3499SlackRoll before 8 accepts gpg exit codes other than 0 and 1…
• CVE-2007-3500Xeweb XEForum allows remote attackers to gain privileges via…
• CVE-2007-3501Cross-site scripting (XSS) vulnerability in CMD_USER_STATS i…
• CVE-2007-3502Unspecified vulnerability in the web-based product configura…
• CVE-2007-3503The Javadoc tool in Sun JDK 6 and JDK 5.0 Update 11 can gene…
• CVE-2007-3505Multiple directory traversal vulnerabilities in QuickTalk fo…
• CVE-2007-3506The ft_bitmap_assure_buffer function in src/base/ftbimap.c i…
• CVE-2007-3507Stack-based buffer overflow in the local__vcentry_parse_valu…
• CVE-2007-3508Integer overflow in the process_envvars function in elf/rtld…
• CVE-2007-3509Heap-based buffer overflow in the RPC subsystem in Symantec …
• CVE-2007-3510Buffer overflow in the IMAP service in IBM Lotus Domino befo…