CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-5768 310 +Info 2007-10-31 2008-11-15
5.0
 None Remote Low Not required Partial None None
The Globe7 soft phone client 7.3 sends username and password information in cleartext, which allows remote attackers to obtain sensitive information by sniffing the HTTP traffic.
2 CVE-2007-5754 94 Exec Code File Inclusion 2007-10-31 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the dir_ws parameter.
3 CVE-2007-5753 2007-10-31 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Light FMan PHP (lfman or lightfman) before 2.0rc1 has unknown impact and attack vectors related to "actions."
4 CVE-2007-5752 287 2007-10-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin (userlevel 4) privileges.
5 CVE-2007-5751 264 2007-10-31 2017-07-29
2.1
 None Local Low Not required Partial None None
Liferea before 1.4.6 uses weak permissions (0644) for the feedlist.opml backup file, which allows local users to obtain credentials.
6 CVE-2007-5740 134 Exec Code 2007-10-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the mechanism.
7 CVE-2007-5739 22 Dir. Trav. 2007-10-30 2018-10-15
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
8 CVE-2007-5738 20 Bypass 2007-10-30 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which allows remote attackers to bypass restrictions and upload arbitrary files via a modified copy of component/flashupload/upload.html.
9 CVE-2007-5737 94 2007-10-30 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspecified vectors, probably involving a direct request.
10 CVE-2007-5736 20 XSS 2007-10-30 2018-10-15
6.4
 None Remote Low Not required None Partial Partial
Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors. NOTE: these files are stored with .html extensions, so the scope of the attack might be limited to resource consumption and possibly XSS.
11 CVE-2007-5735 264 +Info 2007-10-30 2018-10-15
5.0
 None Remote Low Not required Partial None None
eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efileman_config.pm.
12 CVE-2007-5734 20 2007-10-30 2018-10-15
6.4
 None Remote Low Not required None Partial Partial
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload_file." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html.
13 CVE-2007-5733 94 Exec Code 2007-10-30 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath parameter specifying a filename with a double extension. NOTE: some of these details are obtained from third party information.
14 CVE-2007-5732 22 Dir. Trav. 2007-10-30 2018-10-15
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier, allows remote attackers to read arbitrary files via the file parameter. NOTE: this issue only occurs in environments where the system administrator has not followed the vendor recommendations that this product should only be used internally.
15 CVE-2007-5731 22 Dir. Trav. 2007-10-30 2017-09-29
3.5
 None Remote Medium ??? Partial None None
Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
16 CVE-2007-5730 787 Exec Code Overflow 2007-10-30 2020-12-15
7.2
 None Local Low Not required Complete Complete Complete
Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability.
17 CVE-2007-5729 119 Exec Code Overflow 2007-10-30 2020-12-15
7.2
 None Local Low Not required Complete Complete Complete
The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to the EN0_TCNT register, which triggers a heap-based buffer overflow in the slirp library, aka NE2000 "mtu" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the mtu overflow vulnerability.
18 CVE-2007-5728 79 XSS 2007-10-30 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web script or HTML via certain input available in PHP_SELF in (1) redirect.php, possibly related to (2) login.php, different vectors than CVE-2007-2865.
19 CVE-2007-5727 79 XSS 2007-10-30 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in the description parameter to (1) tcreate.php or (2) tupdate.php, as demonstrated using an onmouseover event in a b tag.
20 CVE-2007-5726 DoS 2007-10-30 2017-07-29
6.8
 None Remote Low ??? None None Complete
Unspecified vulnerability in the Stream Control Transmission Protocol (sctp) functionality in Sun Solaris 10, when at least one SCTP socket is in the LISTEN state, allows remote attackers to cause a denial of service (panic) via unspecified vectors related to "INIT processing."
21 CVE-2007-5725 79 XSS 2007-10-30 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Smart-Shop allow remote attackers to inject arbitrary web script or HTML via (1) the email parameter to index.php; or the command parameter to index.php in (2) the default action for the home page, (3) a currencies action, or (4) a basket action.
22 CVE-2007-5724 79 XSS 2007-10-30 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Omnistar Live allow remote attackers to inject arbitrary web script or HTML via (1) the category_id parameter to users/kb.php, and possibly (3) the Email Box field in profile.php.
23 CVE-2007-5723 119 DoS Overflow 2007-10-30 2017-07-29
5.0
 None Remote Low Not required None None Partial
Heap-based buffer overflow in the samp_send function in nuauth/sasl.c in NuFW before 2.2.7 allows remote attackers to cause a denial of service via unspecified input on which base64 encoding is performed. NOTE: some of these details are obtained from third party information.
24 CVE-2007-5722 119 Exec Code Overflow 2007-10-30 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8, as used in Ourgame GLWorld and possibly other products, allows remote attackers to execute arbitrary code via a long first argument to the ConnectAndEnterRoom method, possibly involving the GLCHAT.GLChatCtrl.1 control, as originally exploited in the wild in October 2007. NOTE: some of these details are obtained from third party information. NOTE: this was originally reported as a heap-based issue by some sources.
25 CVE-2007-5721 94 Exec Code File Inclusion 2007-10-30 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in _theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allows remote attackers to execute arbitrary PHP code via a URL in the rootBase parameter.
26 CVE-2007-5720 94 Exec Code 2007-10-30 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors involving creation of a profile.
27 CVE-2007-5719 89 Exec Code Sql 2007-10-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in bb_func_search.php in miniBB 2.1 allows remote attackers to execute arbitrary SQL commands via the table parameter to index.php.
28 CVE-2007-5718 59 2007-10-30 2017-07-29
4.9
 None Local Low Not required None Complete None
vobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new file, via a symlink attack on the (1) /tmp/vobcopy.bla or (2) /tmp/vobcopy_0.5.14.log temporary file.
29 CVE-2007-5717 Exec Code 2007-10-30 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in Sun Fire X2100 M2 and X2200 M2 Embedded Lights Out Manager (ELOM) on x86 before firmware 2.70 allows remote attackers to execute arbitrary commands as root on the Service Processor (SP) via unspecified vectors, a different vulnerability than CVE-2007-5170.
30 CVE-2007-5716 DoS 2007-10-30 2017-09-29
7.8
 None Remote Low Not required None None Complete
Unspecified vulnerability in the Internet Protocol (IP) functionality in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecified vectors, probably related to a UDP packet.
31 CVE-2007-5715 16 2007-10-30 2008-11-15
4.3
 None Remote Medium Not required None Partial None
DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP address, which might allow remote attackers to avoid detection and blocking when making invalid login attempts with a username not present in AllowUsers, as demonstrated by the root username, a different vulnerability than CVE-2007-4323.
32 CVE-2007-5714 287 Exec Code 2007-10-30 2008-09-05
6.8
 None Remote Medium Not required Partial Partial Partial
The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow remote attackers to obtain login access and execute arbitrary code.
33 CVE-2007-5713 189 DoS Exec Code Overflow 2007-10-30 2012-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Off-by-one error in the GeoIP module in the AMX Mod X 1.76d plugin for Half-Life Server might allow attackers to execute arbitrary code or cause a denial of service via unspecified input related to geolocation, which triggers an error message from the (1) geoip_code2 or (2) geoip_code3 function, leading to a buffer overflow.
34 CVE-2007-5712 399 DoS 2007-10-30 2017-07-29
2.6
 None Remote High Not required None None Partial
The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
35 CVE-2007-5711 20 DoS 2007-10-30 2017-07-29
5.0
 None Remote Low Not required None None Partial
Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon crash) via a large packet to TCP or UDP port 48000.
36 CVE-2007-5710 79 XSS 2007-10-30 2018-10-15
2.6
 None Remote High Not required None Partial None
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.
37 CVE-2007-5709 119 Exec Code Overflow 2007-10-30 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file name in an M3U file.
38 CVE-2007-5708 399 DoS 2007-10-30 2011-03-07
7.1
 None Remote Medium Not required None None Complete
slapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39, when running as a proxy-caching server, allocates memory using a malloc variant instead of calloc, which prevents an array from being initialized properly and might allow attackers to cause a denial of service (segmentation fault) via unknown vectors that prevent the array from being null terminated.
39 CVE-2007-5707 399 DoS 2007-10-30 2017-09-29
7.1
 None Remote Medium Not required None None Complete
OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses attribute. NOTE: this has been reported as a double free, but the reports are inconsistent.
40 CVE-2007-5706 22 Dir. Trav. 2007-10-29 2018-10-15
9.3
 None Remote Medium Not required Complete Complete Complete
Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitrary files via a full pathname in the query string. NOTE: some of these details are obtained from third party information.
41 CVE-2007-5705 94 Exec Code 2007-10-29 2017-07-29
6.0
 None Remote Medium ??? Partial Partial Partial
Unspecified vulnerability in the Settings component in the administration system in Jeebles Directory 2.9.60 allows remote authenticated administrators to execute arbitrary PHP code via unspecified vectors related to settings.inc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
42 CVE-2007-5704 89 Exec Code Sql 2007-10-29 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in CodeWidgets.com Online Event Registration Template allow remote attackers to execute arbitrary SQL commands via the (1) Email Address and (2) Password fields in (a) login.asp and (b) admin_login.asp.
43 CVE-2007-5703 79 XSS 2007-10-29 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in (1) Request-spk.xuda and (2) Add-msie-request.xuda in RSA KEON Registration Authority Web Interface 1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
44 CVE-2007-5702 79 XSS 2007-10-29 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in swamp/action/LoginActions (aka the login box) in the Novell OpenSUSE SWAMP Workflow Administration and Management Platform 1.x allows remote attackers to inject arbitrary web script or HTML via the username parameter. NOTE: some of these details are obtained from third party information.
45 CVE-2007-5701 310 Bypass +Info 2007-10-29 2017-07-29
2.1
 None Local Low Not required Partial None None
Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information (passwords) when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character, which bypasses a blacklist designed to suppress password logging, resulting in cleartext password disclosure in the console log and Admin panel.
46 CVE-2007-5700 +Priv +Info 2007-10-29 2017-07-29
6.3
 None Remote Medium ??? Complete None None
The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumstances, which might allow remote authenticated users to gain privileges and obtain sensitive information.
47 CVE-2007-5699 119 Exec Code Overflow 2007-10-29 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arbitrary code via certain data on TCP port 10616 that results in a long argument to the SEARCHREPORT command, a different vector than CVE-2007-2059.
48 CVE-2007-5698 79 XSS 2007-10-29 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in default.asp in CREApark GOLD KOY PORTALI allows remote attackers to inject arbitrary web script or HTML via the aranan parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
49 CVE-2007-5697 94 Exec Code File Inclusion 2007-10-29 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the xarg parameter to (1) xarg_corner.php, (2) xarg_corner_bottom.php, and (3) xarg_corner_top.php.
50 CVE-2007-5696 94 Exec Code File Inclusion 2007-10-29 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the root parameter, possibly related to the Music module.
Total number of vulnerabilities : 547   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.