CVE-2007-5626

make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.

• CWE-319

• http://bugs.bacula.org/view.php?id=990Permissions Required, Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446809Issue Tracking, Mailing List, Third Party Advisory
• http://osvdb.org/41861Broken Link
• http://secunia.com/advisories/27243Broken Link, Third Party Advisory
• http://secunia.com/advisories/31184Broken Link, Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200807-10.xmlThird Party Advisory
• http://www.securityfocus.com/bid/26156Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2007/3572Broken Link, Permissions Required, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37336Third Party Advisory, VDB Entry
• http://bugs.bacula.org/view.php?id=990Permissions Required, Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446809Issue Tracking, Mailing List, Third Party Advisory
• http://osvdb.org/41861Broken Link
• http://secunia.com/advisories/27243Broken Link, Third Party Advisory
• http://secunia.com/advisories/31184Broken Link, Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200807-10.xmlThird Party Advisory
• http://www.securityfocus.com/bid/26156Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2007/3572Broken Link, Permissions Required, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37336Third Party Advisory, VDB Entry

Published

Oct 23, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-5620Directory traversal vulnerability in admin/inc/help.php in Z…
• CVE-2007-5621Multiple cross-site scripting (XSS) vulnerabilities in the T…
• CVE-2007-5622Double free vulnerability in the ftpprchild function in ftpp…
• CVE-2007-5623Buffer overflow in the check_snmp function in Nagios Plugins…
• CVE-2007-5624Cross-site scripting (XSS) vulnerability in Nagios 2.x befor…
• CVE-2007-5625Cross-site scripting (XSS) vulnerability in filename.asp in …
• CVE-2007-5627PHP remote file inclusion vulnerability in content/fnc-readm…
• CVE-2007-5628PHP remote file inclusion vulnerability in src/scripture.php…
• CVE-2007-5629Cross-site scripting (XSS) vulnerability in admin/logon.asp …
• CVE-2007-5630SQL injection vulnerability in tnews.php in BBsProcesS BBPor…
• CVE-2007-5631Multiple PHP remote file inclusion vulnerabilities in People…
• CVE-2007-5632Multiple unspecified vulnerabilities in the kernel in Sun So…