CVE-2007-1406: PYSEC-2007-3 - Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unkn

CVE-2007-1406 · Severity: low · CVSS 3.1 · Published 2007-03-10

Technologies: trac (PyPI). Vendors: PyPI.

Executive brief

Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unknown impact and remote attack vectors.

Affected products

PyPI trac

Related threats

PYSEC-2009-7 - Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in
PYSEC-2008-6 - Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain
PYSEC-2008-7 - Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack
PYSEC-2008-5 - Cross-site scripting (XSS) vulnerability in the wiki engine in Trac before 0.10.5 allows remote attackers to inject arbitrary web script or
PYSEC-2008-4 - Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and