Security Vulnerabilities Published In July 2007 (CVSS score >= 5)

2007 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2007-4116		Exec Code Sql	2007-07-31	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
SQL injection vulnerability in philboard_forum.asp in Metyus Forum Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter. NOTE: this might be related to CVE-2007-0920 or CVE-2007-3884.
2	CVE-2007-4114		Exec Code Sql	2007-07-31	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in unuttum.asp in SuskunDuygular Uyelik Sistemi 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) kadi or (2) email parameter. NOTE: some of these details are obtained from third party information.
3	CVE-2007-4112		Exec Code Sql XSS Bypass	2007-07-31	2017-07-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that "bypass AWBS's anti-XSS input validation."
4	CVE-2007-4111		Exec Code Sql	2007-07-31	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
SQL injection vulnerability in the login script in Real Estate listing website application template, when logging in as user or manager, allows remote attackers to execute arbitrary SQL commands via the Password parameter.
5	CVE-2007-4110		Exec Code Sql	2007-07-31	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in sign_in.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter.
6	CVE-2007-4109		Exec Code Sql	2007-07-31	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in sign_in.aspx in WebStore (Online Store Application Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
7	CVE-2007-4108		Exec Code Sql	2007-07-31	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in sign_in.aspx in WebEvents (Online Event Registration Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
8	CVE-2007-4107		Exec Code Sql	2007-07-31	2011-03-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in editpost.php in phpMyForum before 4.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information.
9	CVE-2007-4106		Exec Code Sql	2007-07-31	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
SQL injection vulnerability in login.asp in CodeWidgets Pay Roll - Time Sheet and Punch Card Application With Web Interface allows remote attackers to execute arbitrary SQL commands via the Password parameter.
10	CVE-2007-4105		Exec Code File Inclusion	2007-07-31	2018-10-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
A certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to download and a file to execute," possibly involving remote file inclusion.
11	CVE-2007-4103		DoS	2007-07-31	2018-10-15	7.8	None	Remote	Low	Not required	None	None	Complete
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
12	CVE-2007-4101		Exec Code File Inclusion	2007-07-31	2018-10-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in Madoa Poll 1.1 allow remote attackers to execute arbitrary PHP code via the Madoa parameter to (1) index.php, (2) vote.php, and (3) admin.php.
13	CVE-2007-4100		Bypass	2007-07-31	2017-07-29	5.0	None	Remote	Low	Not required	None	Partial	None
MLDonkey before 2.9.0 does not load certain code from $MLDONKEY/web_infos/ before the network modules become active, which allows remote attackers to bypass the IP blocklist.
14	CVE-2007-4099		+Info	2007-07-30	2011-03-08	5.8	None	Remote	Medium	Not required	Partial	None	Partial
Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with control of certain guard nodes to obtain sensitive information and possibly leverage further attacks.
15	CVE-2007-4098			2007-07-30	2011-03-08	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor routers to inject cells into arbitrary streams.
16	CVE-2007-4097		+Info	2007-07-30	2011-03-08	6.4	None	Remote	Low	Not required	Partial	None	Partial
Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitive information, contrary to specifications.
17	CVE-2007-4096		DoS Overflow	2007-07-30	2011-03-08	5.8	None	Remote	Medium	Not required	Partial	None	Partial
Buffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified vectors.
18	CVE-2007-4095	89	Exec Code Sql	2007-07-30	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp.
19	CVE-2007-4094		Exec Code File Inclusion	2007-07-30	2018-10-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.
20	CVE-2007-4093			2007-07-30	2018-10-15	7.8	None	Remote	Low	Not required	Complete	None	None
Minb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db.
21	CVE-2007-4092		Dir. Trav.	2007-07-30	2018-10-15	5.0	None	Remote	Low	Not required	Partial	None	None
Directory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibly download arbitrary photos, via a .. (dot dot) in the dir parameter.
22	CVE-2007-4086		Exec Code Sql	2007-07-30	2008-11-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) the gid parameter to gmembers.php, or (2) the UID parameter to (a) uvideos.php, (b) ugroups.php, (c) uprofile.php, (d) ufavour.php, (e) ufriends.php, or (f) uplaylist.php.
23	CVE-2007-4085		Exec Code Sql	2007-07-30	2009-04-14	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que_id parameter to forum_answer.php or (2) the cat_id parameter to search.php.
24	CVE-2007-4084		Exec Code Sql	2007-07-30	2008-11-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
25	CVE-2007-4080		XSS	2007-07-30	2008-11-15	6.4	None	Remote	Low	Not required	Partial	None	Partial
Cross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML via the p_id parameter in a people_card action. NOTE: this might overlap CVE-2006-2564.
26	CVE-2007-4076		Exec Code Sql	2007-07-30	2008-11-15	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
27	CVE-2007-4074	16	Exec Code	2007-07-30	2018-10-15	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956. NOTE: this issue is local in some environments, but remote on others.
28	CVE-2007-4073			2007-07-30	2018-10-15	5.0	None	Remote	Low	Not required	None	Partial	None
Webbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of forged e-mail. NOTE: this could be leveraged for spam or phishing attacks.
29	CVE-2007-4072		+Info	2007-07-30	2018-10-15	5.0	None	Remote	Low	Not required	Partial	None	None
Webbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obtain sensitive information by viewing the HTML source, as demonstrated by viewing the source generated from index.php.
30	CVE-2007-4069		Exec Code Sql	2007-07-30	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
31	CVE-2007-4068		Exec Code Sql	2007-07-30	2017-09-29	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat_id parameter to the default URI in a download action or (2) the id parameter to the default URI in a duyurular_detay action.
32	CVE-2007-4067			2007-07-30	2017-09-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method. NOTE: some of these details are obtained from third party information.
33	CVE-2007-4062	22	Dir. Trav.	2007-07-30	2017-07-29	7.8	None	Remote	Medium	Not required	None	Partial	Complete
The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.
34	CVE-2007-4061		Exec Code Dir. Trav.	2007-07-30	2017-09-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig method, possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. NOTE: this can be leveraged for code execution by writing to a Startup folder.
35	CVE-2007-4060		Exec Code Overflow	2007-07-30	2017-09-29	9.0	None	Remote	Low	Not required	Partial	Partial	Complete
Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.
36	CVE-2007-4059			2007-07-30	2017-09-29	5.8	None	Remote	Medium	Not required	None	Partial	Partial
Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SetLogFileName method.
37	CVE-2007-4057			2007-07-30	2017-09-29	6.5	None	Remote	Low	???	Partial	Partial	Partial
Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif, (2) .php.jpg, or (3) .php.png.
38	CVE-2007-4056	89	Exec Code Sql	2007-07-30	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. NOTE: the original report indicated that this was the "photo" SourceForge project (aka Maan Bsat Photo Collection), but that was incorrect.
39	CVE-2007-4055		Exec Code Sql	2007-07-30	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in comments_get.asp in SimpleBlog 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this may be related to CVE-2006-4300.
40	CVE-2007-4054		Exec Code Sql	2007-07-30	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL commands via the cat parameter.
41	CVE-2007-4053		Exec Code Sql	2007-07-30	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter to new_images.php.
42	CVE-2007-4050			2007-07-30	2017-07-29	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors.
43	CVE-2007-4047			2007-07-27	2018-10-15	6.4	None	Remote	Low	Not required	None	Partial	Partial
geoBlog (aka BitDamaged) 1 does not require authentication for (1) deletecomment.php, (2) deleteblog.php, and (3) listcomment.php in admin/, which allows remote attackers to delete arbitrary comments, delete arbitrary blogs, and have other unspecified impact via a request with a valid id parameter.
44	CVE-2007-4046		Exec Code Sql	2007-07-27	2017-09-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
45	CVE-2007-4045		DoS	2007-07-27	2020-12-23	5.0	None	Remote	Low	Not required	None	None	Partial
The CUPS service, as used in SUSE Linux before 20070720 and other Linux distributions, allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of service problem in SSL negotiation.
46	CVE-2007-4043	287	Bypass	2007-07-27	2008-09-05	5.0	None	Remote	Low	Not required	None	Partial	None
file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) before 4.6.3 allows remote attackers to bypass authentication via a name parameter ending with a "%00.gif" sequence. NOTE: a separate traversal vulnerability could be leveraged to download arbitrary files.
47	CVE-2007-4042		Exec Code	2007-07-27	2021-07-23	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
48	CVE-2007-4041	78	Exec Code	2007-07-27	2021-07-23	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
49	CVE-2007-4035			2007-07-27	2018-10-15	5.0	None	Remote	Low	Not required	None	Partial	None
DISPUTED Guidance Software EnCase does not properly handle (1) certain malformed MBR partition tables with many entries, which allows remote attackers to prevent logical collection of a disk image; (2) NTFS filesystems with directory loops, which allows remote attackers to prevent examination of certain directory contents; and (3) certain other malformed NTFS filesystems, which allows remote attackers to prevent examination of corrupted records. NOTE: the vendor disputes the significance of these issues, because physical collection can be used instead, because the vendor believes that relevant attackers typically do not corrupt an MBR or a filesystem, and because detection of a loop is valuable on its own.
50	CVE-2007-4034	119	Exec Code Overflow	2007-07-27	2011-03-07	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: some of these details are obtained from third party information.

Total number of vulnerabilities : 421 Page : 1 (This Page)2 3 4 5 6 7 8 9