CVE-2007-3624

Heap-based buffer overflow in the Message HTTP Server in SAP Message Server allows remote attackers to execute arbitrary code via a long string in the group parameter to /msgserver/html/group.

• http://marc.info/?l=bugtraq&m=118365794615827&w=2
• http://osvdb.org/38096
• http://secunia.com/advisories/25966Patch, Vendor Advisory
• http://securitytracker.com/id?1018340
• http://www.kb.cert.org/vuls/id/305657US Government Resource
• http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-sap-message-server-heap-overflow/
• http://www.securityfocus.com/bid/24765Exploit
• http://www.vupen.com/english/advisories/2007/2451
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35279
• http://marc.info/?l=bugtraq&m=118365794615827&w=2
• http://osvdb.org/38096
• http://secunia.com/advisories/25966Patch, Vendor Advisory
• http://securitytracker.com/id?1018340
• http://www.kb.cert.org/vuls/id/305657US Government Resource
• http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-sap-message-server-heap-overflow/
• http://www.securityfocus.com/bid/24765Exploit
• http://www.vupen.com/english/advisories/2007/2451
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35279

Published

Jul 9, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-3618Stack-based buffer overflow in the NetWorker Remote Exec Ser…
• CVE-2007-3619Directory traversal vulnerability in login.php in Maia Mailg…
• CVE-2007-3620Multiple directory traversal vulnerabilities in Maia Mailgua…
• CVE-2007-3621Multiple CRLF injection vulnerabilities in callboth.php in A…
• CVE-2007-3622Unspecified vulnerability in DomainPOP in Alt-N Technologies…
• CVE-2007-3623Cross-site scripting (XSS) vulnerability in the Hitachi JP1/…
• CVE-2007-3625The Program Neighborhood Agent in Citrix Presentation Server…
• CVE-2007-3626Unspecified vulnerability in the ADM daemon in Hitachi TPBro…
• CVE-2007-3627Multiple SQL injection vulnerabilities in PHP Lite Calendar …
• CVE-2007-3628Unspecified vulnerability in the fetch function in MDB2.php …
• CVE-2007-3629SQL injection vulnerability in oku.asp in Levent Veysi Porta…
• CVE-2007-3630changePW.php in AV Tutorial Script (avtutorial) 1.0 does not…