2007 CVEs (page 64)
Page 64 of 65 — CVEs published in 2007, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2007-0195 | | 2007-01-12 | my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid username than for those wi… | |
CVE-2007-0194 | | 2007-01-12 | admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MK_PATH=1 query string, which reveals the p… | |
CVE-2007-0193 | | 2007-01-12 | FON La Fonera routers do not properly limit DNS service access by unauthenticated clients, which allows remote attackers to tunnel traffic via DNS requests for… | |
CVE-2007-0192 | | 2007-01-12 | Cross-site request forgery (CSRF) vulnerability in the save_main operation in the ad_perms section in admin.php in MKPortal allows remote attackers to modify p… | |
CVE-2007-0191 | | 2007-01-12 | Cross-site scripting (XSS) vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a co… | |
CVE-2007-0190 | | 2007-01-12 | PHP remote file inclusion vulnerability in edit_address.php in edit-x ecommerce allows remote attackers to execute arbitrary PHP code via a URL in the include_… | |
CVE-2007-0189 | | 2007-01-12 | PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code via a URL in the ac… | |
CVE-2007-0188 | | 2007-01-12 | F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation of an IP address ("… | |
CVE-2007-0187 | | 2007-01-12 | F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading slashes, (3) Unicode… | |
CVE-2007-0186 | | 2007-01-12 | Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (1) the xcho param… | |
CVE-2007-0185 | | 2007-01-12 | Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors relate… | |
CVE-2007-0184 | | 2007-01-12 | Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the includ… | |
CVE-2007-0183 | | 2007-01-12 | Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML via the NS-max-rec… | |
CVE-2007-0182 | | 2007-01-12 | Multiple PHP remote file inclusion vulnerabilities in magic photo storage website allow remote attackers to execute arbitrary PHP code via a URL in the _config… | |
CVE-2007-0206 | | 2007-01-12 | Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to read arbitrary files via unknown v… | |
CVE-2007-0205 | | 2007-01-11 | Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via… | |
CVE-2007-0169 | | 2007-01-11 | Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection S… | |
CVE-2007-0168 | | 2007-01-11 | The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Sui… | |
CVE-2007-0166 | | 2007-01-11 | The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when file systems are m… | |
CVE-2007-0204 | | 2007-01-11 | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or HTML via unspecifie… | |
CVE-2007-0203 | | 2007-01-11 | Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors. | |
CVE-2007-0202 | | 2007-01-11 | SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary S… | |
CVE-2007-0201 | | 2007-01-11 | Buffer overflow in the cmd_usr function in ftp-gw in TIS Internet Firewall Toolkit (FWTK) allows remote attackers to execute arbitrary code via a long destinat… | |
CVE-2007-0200 | | 2007-01-11 | PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 allows remote attackers to execute arbit… | |
CVE-2007-0199 | | 2007-01-11 | The Data-link Switching (DLSw) feature in Cisco IOS 11.0 through 12.4 allows remote attackers to cause a denial of service (device reload) via "an invalid valu… | |
CVE-2007-0198 | | 2007-01-11 | The JTapi Gateway process in Cisco Unified Contact Center Enterprise, Unified Contact Center Hosted, IP Contact Center Enterprise, and Cisco IP Contact Center… | |
CVE-2007-0197 | | 2007-01-11 | Finder 10.4.6 on Apple Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long volume… | |
CVE-2007-0196 | | 2007-01-11 | SQL injection vulnerability in admin_check_user.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via… | |
CVE-2007-0181 | | 2007-01-11 | PHP remote file inclusion vulnerability in include/common_function.php in magic photo storage website allows remote attackers to execute arbitrary PHP code via… | |
CVE-2007-0180 | | 2007-01-11 | Stack-based buffer overflow in EF Commander 5.75 allows user-assisted attackers to execute arbitrary code via a crafted ISO file containing a file within sever… | |
CVE-2007-0179 | | 2007-01-11 | SQL injection vulnerability in comment.php in PHPKIT 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the subid parameter. | |
CVE-2007-0178 | | 2007-01-11 | PHP remote file inclusion vulnerability in info.php in Easy Banner Pro 2.8 allows remote attackers to execute arbitrary PHP code via a URL in the s[phppath] pa… | |
CVE-2007-0177 | | 2007-01-11 | Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseA… | |
CVE-2007-0176 | | 2007-01-11 | Cross-site scripting (XSS) vulnerability in search/advanced_search.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the… | |
CVE-2007-0175 | | 2007-01-11 | Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable… | |
CVE-2007-0174 | | 2007-01-11 | Multiple stack-based multiple buffer overflows in the BRWOSSRE2UC.dll ActiveX Control in Sina UC2006 and earlier allow remote attackers to execute arbitrary co… | |
CVE-2007-0173 | | 2007-01-11 | Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register_globals is enabled and magic_quotes is disabled, allows… | |
CVE-2007-0172 | | 2007-01-11 | Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the AMG_s… | |
CVE-2007-0171 | | 2007-01-11 | PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AML… | |
CVE-2007-0170 | | 2007-01-11 | PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary PHP code via a URL in the AMV_serverpa… | |
CVE-2007-0167 | | 2007-01-10 | Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to execute arbitrary… | |
CVE-2007-0165 | | 2007-01-10 | Unspecified vulnerability in libnsl in Sun Solaris 8 and 9 allows remote attackers to cause a denial of service (crash) via malformed RPC requests that trigger… | |
CVE-2007-0164 | | 2007-01-10 | Camouflage 1.2.1 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and decrypt embedded steg… | |
CVE-2007-0163 | | 2007-01-10 | SecureKit Steganography 1.7.1 and 1.8 embeds password information in the carrier file, which allows remote attackers to bypass authentication requirements and… | |
CVE-2007-0162 | | 2007-01-10 | Unsanity Application Enhancer (APE) 2.0.2 installs with insecure permissions for the (1) ApplicationEnhancer binary and the (2) /Library/Frameworks/Application… | |
CVE-2007-0161 | | 2007-01-10 | The PML Driver HPZ12 (HPZipm12.exe) in the HP all-in-one drivers, as used by multiple HP products, uses insecure SERVICE_CHANGE_CONFIG DACL permissions, which… | |
CVE-2007-0160 | | 2007-01-10 | Stack-based buffer overflow in the LiveJournal support (hooks/ljhook.cc) in CenterICQ 4.9.11 through 4.21.0, when using unofficial LiveJournal servers, allows… | |
CVE-2007-0159 | | 2007-01-10 | Directory traversal vulnerability in the GeoIP_update_database_general function in libGeoIP/GeoIPUpdate.c in GeoIP 1.4.0 allows remote malicious update servers… | |
CVE-2007-0034 | | 2007-01-09 | Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to execute arbitrar… | |
CVE-2007-0033 | | 2007-01-09 | Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal meeting request or IC… | |
CVE-2007-0031 | | 2007-01-09 | Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbi… | |
CVE-2007-0030 | | 2007-01-09 | Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via an Excel file w… | |
CVE-2007-0029 | | 2007-01-09 | Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code via a malformed str… | |
CVE-2007-0028 | | 2007-01-09 | Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted… | |
CVE-2007-0024 | | 2007-01-09 | Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 SP4, XP SP2, Server… | |
CVE-2007-0027 | | 2007-01-09 | Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed IMDATA records that… | |
CVE-2007-0157 | | 2007-01-09 | Array index error in the uri_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote malicious servers to… | |
CVE-2007-0156 | | 2007-01-09 | M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb. | |
CVE-2007-0155 | | 2007-01-09 | HarikaOnline 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database contain… | |
CVE-2007-0154 | | 2007-01-09 | Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passw… | |
CVE-2007-0153 | | 2007-01-09 | AJLogin 3.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing p… | |
CVE-2007-0152 | | 2007-01-09 | OhhASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwo… | |
CVE-2007-0151 | | 2007-01-09 | MitiSoft stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing pass… | |
CVE-2007-0150 | | 2007-01-09 | Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the (1) page… | |
CVE-2007-0149 | | 2007-01-09 | EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containi… | |
CVE-2007-0148 | | 2007-01-09 | Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via f… | |
CVE-2007-0147 | | 2007-01-09 | Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files whe… | |
CVE-2007-0146 | | 2007-01-09 | Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id param… | |
CVE-2007-0145 | | 2007-01-09 | PHP remote file inclusion vulnerability in bn_smrep1.php in BinGoPHP News (BP News) 3.01 allows remote attackers to execute arbitrary PHP code via a URL in the… | |
CVE-2007-0144 | | 2007-01-09 | Cross-site scripting (XSS) vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to inject arbitrary we… | |
CVE-2007-0143 | | 2007-01-09 | Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitrary PHP code via a URL in the custom_adm… | |
CVE-2007-0142 | | 2007-01-09 | SQL injection vulnerability in orange.asp in ShopStoreNow E-commerce Shopping Cart allows remote attackers to execute arbitrary SQL commands via the CatID para… | |
CVE-2007-0141 | | 2007-01-09 | Cross-site scripting (XSS) vulnerability in yald.php in Yet Another Link Directory 1.0 allows remote attackers to inject arbitrary web script or HTML via the s… | |
CVE-2007-0140 | | 2007-01-09 | SQL injection vulnerability in down.asp in Kolayindir Download (Yenionline) allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2007-0139 | | 2007-01-09 | Unspecified vulnerability in the DECnet-Plus 7.3-2 feature in DECnet/OSI 7.3-2 for OpenVMS ALPHA, and the DECnet-Plus 7.3 feature in DECnet/OSI 7.3 for OpenVMS… | |
CVE-2007-0138 | | 2007-01-09 | formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to cause a denial of s… | |
CVE-2007-0137 | | 2007-01-09 | Cross-site scripting (XSS) vulnerability in SimpleBoxes/SerendipityNZ Serene Bach 2.05R and earlier, and 2.08D and earlier in the 2.08 series; and (2) sb 1.13D… | |
CVE-2007-0136 | | 2007-01-09 | Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTM… | |
CVE-2007-0135 | | 2007-01-09 | PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register_globals is enabled, allows remote attackers to e… | |
CVE-2007-0134 | | 2007-01-09 | Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, which is supplied to… | |
CVE-2007-0133 | | 2007-01-09 | Multiple SQL injection vulnerabilities in display_review.php in iGeneric iG Shop 1.4 and earlier allow remote attackers to execute arbitrary SQL commands via t… | |
CVE-2007-0132 | | 2007-01-09 | SQL injection vulnerability in compare_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2007-0131 | | 2007-01-09 | JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to make unauthorized c… | |
CVE-2007-0130 | | 2007-01-09 | SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2007-0129 | | 2007-01-09 | SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatID parame… | |
CVE-2007-0128 | | 2007-01-09 | SQL injection vulnerability in info_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the book_id parameter. | |
CVE-2007-0127 | | 2007-01-09 | The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which allows remote attacker… | |
CVE-2007-0126 | | 2007-01-09 | Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index bytes in the Define… | |
CVE-2007-0125 | | 2007-01-09 | Kaspersky Labs Antivirus Engine 6.0 for Windows and 5.5-10 for Linux before 20070102 enter an infinite loop upon encountering an invalid NumberOfRvaAndSizes va… | |
CVE-2007-0124 | | 2007-01-09 | Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by… | |
CVE-2007-0123 | | 2007-01-09 | Unrestricted file upload vulnerability in Uber Uploader 4.2 allows remote attackers to upload and execute arbitrary PHP scripts by naming them with a .phtml ex… | |
CVE-2007-0122 | | 2007-01-09 | Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute arbitrary SQL comman… | |
CVE-2007-0121 | | 2007-01-09 | Cross-site scripting (XSS) vulnerability in search.asp in RI Blog 1.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter. | |
CVE-2007-0120 | | 2007-01-09 | Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service (application crash) via multiple H… | |
CVE-2007-0119 | | 2007-01-09 | Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the plain parameter to (1)… | |
CVE-2007-0118 | | 2007-01-09 | Multiple absolute path traversal vulnerabilities in EditTag 1.2 allow remote attackers to read arbitrary files via an absolute pathname in the file parameter t… | |
CVE-2007-0117 | | 2007-01-09 | DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which allows attackers to… | |
CVE-2007-0116 | | 2007-01-09 | Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows remote attackers to… | |
CVE-2007-0115 | | 2007-01-09 | Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arbitrary PHP code via… | |
CVE-2007-0114 | | 2007-01-09 | Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding "content details" via unspecified vec… |