CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2007 (CVSS score >= 7)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-4114 Exec Code Sql 2007-07-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in unuttum.asp in SuskunDuygular Uyelik Sistemi 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) kadi or (2) email parameter. NOTE: some of these details are obtained from third party information.
2 CVE-2007-4110 Exec Code Sql 2007-07-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in sign_in.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter.
3 CVE-2007-4109 Exec Code Sql 2007-07-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in sign_in.aspx in WebStore (Online Store Application Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
4 CVE-2007-4108 Exec Code Sql 2007-07-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in sign_in.aspx in WebEvents (Online Event Registration Template) allows remote attackers to execute arbitrary SQL commands via the Password parameter.
5 CVE-2007-4107 Exec Code Sql 2007-07-31 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in editpost.php in phpMyForum before 4.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some of these details are obtained from third party information.
6 CVE-2007-4105 Exec Code File Inclusion 2007-07-31 2018-10-15
9.3
 None Remote Medium Not required Complete Complete Complete
A certain ActiveX control in BaiduBar.dll in Baidu Soba Search Bar 5.4 allows remote attackers to execute arbitrary code via a request containing "a link to download and a file to execute," possibly involving remote file inclusion.
7 CVE-2007-4103 DoS 2007-07-31 2018-10-15
7.8
 None Remote Low Not required None None Complete
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released.
8 CVE-2007-4095 89 Exec Code Sql 2007-07-30 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username field in an unspecified component, probably the FrmUserName parameter in login.asp.
9 CVE-2007-4094 Exec Code File Inclusion 2007-07-30 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP code via a URL in the login_form parameter, a different vector than CVE-2006-3776.
10 CVE-2007-4093 2007-07-30 2018-10-15
7.8
 None Remote Low Not required Complete None None
Minb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing usernames and encrypted passwords via a direct request for db/users.db.
11 CVE-2007-4084 Exec Code Sql 2007-07-30 2008-11-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) the pgmid parameter in an uploadProducts action to merchants/index.php and possibly (2) the rowid parameter to merchants/temp.php.
12 CVE-2007-4076 Exec Code Sql 2007-07-30 2008-11-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via the (1) product_id or (2) cat_id parameter in a product mod action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
13 CVE-2007-4074 16 Exec Code 2007-07-30 2018-10-15
10.0
 None Remote Low Not required Complete Complete Complete
The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and possibly other distributions, is run locally with elevated privileges without requiring authentication, which allows local and remote attackers to execute arbitrary commands via the local daemon on port 1314, a different vulnerability than CVE-2001-0956. NOTE: this issue is local in some environments, but remote on others.
14 CVE-2007-4069 Exec Code Sql 2007-07-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in show_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
15 CVE-2007-4067 2007-07-30 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6.2 allows remote attackers to create or overwrite arbitrary files via a full pathname in the second argument to the GetToFile method. NOTE: some of these details are obtained from third party information.
16 CVE-2007-4062 22 Dir. Trav. 2007-07-30 2017-07-29
7.8
 None Remote Medium Not required None Partial Complete
The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via unspecified vectors involving the deleteNessusRC method, probably a directory traversal vulnerability.
17 CVE-2007-4061 Exec Code Dir. Trav. 2007-07-30 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in the argument to the saveNessusRC method, which writes text specified by the addsetConfig method, possibly related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll. NOTE: this can be leveraged for code execution by writing to a Startup folder.
18 CVE-2007-4060 Exec Code Overflow 2007-07-30 2017-09-29
9.0
 None Remote Low Not required Partial Partial Complete
Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbitrary code via a long string in the (1) method name or (2) URI in an HTTP request.
19 CVE-2007-4056 89 Exec Code Sql 2007-07-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. NOTE: the original report indicated that this was the "photo" SourceForge project (aka Maan Bsat Photo Collection), but that was incorrect.
20 CVE-2007-4055 Exec Code Sql 2007-07-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in comments_get.asp in SimpleBlog 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: this may be related to CVE-2006-4300.
21 CVE-2007-4054 Exec Code Sql 2007-07-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL commands via the cat parameter.
22 CVE-2007-4053 Exec Code Sql 2007-07-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in include/img_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter to new_images.php.
23 CVE-2007-4050 2007-07-30 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors.
24 CVE-2007-4046 Exec Code Sql 2007-07-27 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Pony Gallery (com_ponygallery) 1.5 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
25 CVE-2007-4042 Exec Code 2007-07-27 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.
26 CVE-2007-4034 119 Exec Code Overflow 2007-07-27 2011-03-07
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in the YDPCTL.YDPControl.1 (aka Yahoo! Installer Plugin for Widgets) ActiveX control before 2007.7.13.3 (20070620) in YDPCTL.dll in Yahoo! Widgets before 4.0.5 allows remote attackers to execute arbitrary code via a long argument to the GetComponentVersion method. NOTE: some of these details are obtained from third party information.
27 CVE-2007-4033 119 Exec Code Overflow 2007-07-27 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
28 CVE-2007-4031 22 Dir. Trav. 2007-07-27 2017-09-29
7.8
 None Remote Medium Not required None Partial Complete
Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary files via a .. (dot dot) in the argument to the deleteReport method, probably related to the SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll.
29 CVE-2007-4028 2007-07-26 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Absolute path traversal vulnerability in index.php in Webspell 4.01.02 allows remote attackers to include and execute arbitrary local files via a full pathname in the site parameter. NOTE: some of these details are obtained from third party information.
30 CVE-2007-4017 CSRF 2007-07-26 2017-07-29
7.6
 None Remote High Not required Complete Complete Complete
Cross-site request forgery (CSRF) vulnerability in the web-based administration console in Citrix Access Gateway before firmware 4.5.5 allows remote attackers to perform certain configuration changes as administrators.
31 CVE-2007-4013 Overflow 2007-07-26 2011-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple unspecified vulnerabilities in (1) Net6Helper.DLL (aka Net6Launcher Class) 4.5.2 and earlier, (2) npCtxCAO.dll (aka Citrix Endpoint Analysis Client) in a Firefox plugin directory, and (3) a second npCtxCAO.dll (aka CCAOControl Object) before 4.5.0.0 in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 have unknown impact and attack vectors, possibly related to buffer overflows. NOTE: vector 3 might overlap CVE-2007-3679.
32 CVE-2007-4012 DoS 2007-07-26 2018-10-30
7.1
 None Remote Medium Not required None None Complete
Cisco 4100 and 4400, Airespace 4000, and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (ARP storm) via a broadcast ARP packet that "targets the IP address of a known client context", aka CSCsj50374.
33 CVE-2007-4011 DoS 2007-07-26 2018-10-30
7.1
 None Remote Medium Not required None None Complete
Cisco 4100 and 4400, Airespace 4000, and Catalyst 6500 and 3750 Wireless LAN Controller (WLC) software before 3.2 20070727, 4.0 before 20070727, and 4.1 before 4.1.180.0 allows remote attackers to cause a denial of service (traffic amplification or ARP storm) via a crafted unicast ARP request that (1) has a destination MAC address unknown to the Layer-2 infrastructure, aka CSCsj69233; or (2) occurs during Layer-3 roaming across IP subnets, aka CSCsj70841.
34 CVE-2007-4009 94 Exec Code File Inclusion 2007-07-26 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in admin/business_inc/saveserver.php in SWSoft Confixx Pro 2.0.12 through 3.3.1 allows remote attackers to execute arbitrary PHP code via a URL in the thisdir parameter.
35 CVE-2007-4008 22 Dir. Trav. 2007-07-26 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in custom.php in Entertainment Media Sharing CMS allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagename parameter.
36 CVE-2007-4007 Exec Code File Inclusion 2007-07-26 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in index.php in Article Directory (Article Site Directory) allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
37 CVE-2007-3993 2007-07-25 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the attachment filter in Kerio MailServer before 6.4.1 has unknown impact and remote attack vectors.
38 CVE-2007-3992 Exec Code Sql 2007-07-25 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in vir_login.asp in iExpress Property Pro allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: the Username parameter is covered by CVE-2006-6029. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
39 CVE-2007-3990 Exec Code Sql 2007-07-25 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in default.asp in Dora Emlak 1.0, when the goster parameter is set to emlakdetay, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
40 CVE-2007-3987 Exec Code Sql 2007-07-25 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in SearchResults.asp in ImageRacer 1.0, when WordSearchCrit is enabled, allows remote attackers to execute arbitrary SQL commands via the SearchWord parameter.
41 CVE-2007-3984 Exec Code Overflow 2007-07-25 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChecker allows remote attackers to execute arbitrary code via a long argument to the Scan method. NOTE: this is probably a different issue than CVE-2007-2987.
42 CVE-2007-3981 Exec Code Sql 2007-07-25 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in WSN Links Basic Edition allows remote attackers to execute arbitrary SQL commands via the catid parameter in a displaycat action.
43 CVE-2007-3980 Exec Code File Inclusion 2007-07-25 2017-09-29
10.0
 None Remote Low Not required Complete Complete Complete
PHP remote file inclusion vulnerability in page.php in RCMS Pro RGameScript Pro allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
44 CVE-2007-3976 Exec Code Sql 2007-07-25 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in bwired allows remote attackers to execute arbitrary SQL commands via the newsID parameter.
45 CVE-2007-3974 2007-07-25 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot and droit parameters.
46 CVE-2007-3969 Exec Code Overflow 2007-07-25 2018-10-15
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in Panda Antivirus before 20070720 allows remote attackers to execute arbitrary code via a crafted EXE file, resulting from an "Integer Cast Around."
47 CVE-2007-3963 XSS 2007-07-25 2018-10-15
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple cross-site scripting (XSS) vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF) to (1) upgrade-0-2-3.php, (2) upgrade-0-3.php, or (3) upgrade-0-4.php in install/, a different vulnerability than CVE-2005-4193.
48 CVE-2007-3962 119 Exec Code Overflow 2007-07-25 2008-11-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple stack-based buffer overflows in fsplib.c in fsplib before 0.9 might allow remote attackers to execute arbitrary code via (1) a long filename that is not properly handled by the fsp_readdir_native function when MAXNAMLEN is greater than 255, or (2) a long d_name directory (dirent) field in the fsp_readdir function.
49 CVE-2007-3960 2007-07-24 2011-03-08
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple unspecified vulnerabilities in IBM WebSphere Application Server (WAS) before Fix Pack 21 (6.0.2.21) have unknown impact and attack vectors, aka (1) PK33799, or (2) a "Potential security exposure" in the Samples component (PK40213).
50 CVE-2007-3958 DoS 2007-07-24 2021-07-23
7.1
 None Remote Medium Not required None None Complete
Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain GIF file, as demonstrated by Art.gif.
Total number of vulnerabilities : 257   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.