VDB
CVE-2007-6536
CVE-2007-6536
PUBLISHED
CVSS 6.800000190734863 MEDIUM
The Custom Button Installer dialog in Google Toolbar 4 and 5 beta presents certain domain names in the (1) "Downloaded from" and (2) "Privacy considerations" sections without verifying domain names, which makes it easier for remote attackers to spoof domain names and trick users into installing malicious button XML files, as demonstrated by presenting www.google.com when the button was downloaded from an arbitrary site through an open redirector on www.google.com.
EPSS 1.25% · 68.0th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
1.25%
68.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| toolbar | 4, 5 |
Timeline
- Dec 27, 2007 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Oct 29, 2022 EPSS Score
- Dec 21, 2022 EPSS Score
- Feb 12, 2023 EPSS Score
- Apr 6, 2023 EPSS Score
- May 29, 2023 EPSS Score
- Jul 21, 2023 EPSS Score
- Sep 12, 2023 EPSS Score
References
- 26923 vdb
- http://aviv.raffon.net/2007/12/18/GoogleToolbarDialogSpoofingVulnerability.aspx url
- googletoolbar-custombutton-spoofing(39164) vdb
- 39499 vdb
- 3491 third-party-advisory
- 28166 third-party-advisory
- 20071218 Google Toolbar Dialog Spoofing Vulnerability mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2007-6536 advisory