CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2007-1030 DoS 2007-02-21 2018-10-16
7.8
 None Remote Low Not required None None Complete
Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset.
102 CVE-2007-1029 Exec Code Overflow 2007-02-21 2018-10-16
7.6
 None Remote High Not required Complete Complete Complete
Stack-based buffer overflow in the Connect method in the IMAP4 component in Quiksoft EasyMail Objects before 6.5 allows remote attackers to execute arbitrary code via a long host name.
103 CVE-2007-1028 XSS 2007-02-21 2017-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in the Barry Jaspan Image Pager 4.7.x-1.x-dev and 5.x-1.x-dev before 2007-02-08 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to HTML entities and the IMG element.
104 CVE-2007-1027 59 2007-02-21 2011-03-08
4.4
 None Local Medium Not required Partial Partial Partial
Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file.
105 CVE-2007-1026 89 Exec Code Sql 2007-02-21 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the album parameter in view mode. NOTE: some of these details are obtained from third party information.
106 CVE-2007-1025 Exec Code File Inclusion 2007-02-21 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in inc/functions_inc.php in VS-Link-Partner 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad, or possibly script_pfad, parameter.
107 CVE-2007-1024 Exec Code File Inclusion 2007-02-21 2018-10-16
10.0
 None Remote Low Not required Complete Complete Complete
PHP remote file inclusion vulnerability in include.php in Meganoide's news 1.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.
108 CVE-2007-1023 Exec Code Sql 2007-02-21 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in pop_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
109 CVE-2007-1022 Exec Code Sql 2007-02-21 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in h_goster.asp in Turuncu Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
110 CVE-2007-1021 Exec Code Sql 2007-02-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in inc_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the CAT_ID parameter.
111 CVE-2007-1020 XSS 2007-02-21 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the hier parameter.
112 CVE-2007-1019 Exec Code Sql 2007-02-21 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in news.php in webSPELL 4.01.02, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388.
113 CVE-2007-1018 Exec Code File Inclusion 2007-02-21 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
114 CVE-2007-1017 Exec Code File Inclusion 2007-02-21 2017-10-11
9.3
 None Remote Medium Not required Complete Complete Complete
PHP remote file inclusion vulnerability in show_news_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the newsordner parameter.
115 CVE-2007-1016 Exec Code Sql 2007-02-21 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via certain vectors related to the HaberDetay.asp and rss.asp components, and the id and kid parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the combination of the HaberDetay.asp component and the id parameter is already covered by another February 2007 CVE candidate.
116 CVE-2007-1015 Exec Code Sql 2007-02-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via the id parameter.
117 CVE-2007-1014 DoS Exec Code Overflow 2007-02-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long CWD command.
118 CVE-2007-1013 Exec Code File Inclusion 2007-02-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the ht_pfad parameter.
119 CVE-2007-1012 79 XSS 2007-02-21 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the article parameter.
120 CVE-2007-1011 Exec Code File Inclusion 2007-02-21 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in functions_inc.php in VS-Gastebuch 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the gb_pfad parameter.
121 CVE-2007-1010 Exec Code File Inclusion 2007-02-21 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in ZebraFeeds 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the zf_path parameter to (1) aggregator.php and (2) controller.php in newsfeeds/includes/.
122 CVE-2007-1008 DoS Mem. Corr. 2007-02-20 2018-10-16
2.6
 None Remote High Not required None None Partial
Apple iTunes 7.0.2 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted XML list of radio stations, which results in memory corruption. NOTE: iTunes retrieves the XML document from a static URL, which requires an attacker to perform DNS spoofing or man-in-the-middle attacks for exploitation.
123 CVE-2007-1007 DoS Exec Code 2007-02-20 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeeting_log_insert function.
124 CVE-2007-1006 134 DoS Exec Code 2007-02-20 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple format string vulnerabilities in the gm_main_window_flash_message function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.
125 CVE-2007-1004 2007-02-20 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Mozilla Firefox might allow remote attackers to conduct spoofing and phishing attacks by writing to an about:blank tab and overlaying the location bar.
126 CVE-2007-0996 XSS 2007-02-27 2018-10-16
5.8
 None Remote Medium Not required Partial Partial None
The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the parent window, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
127 CVE-2007-0995 79 XSS Bypass 2007-02-26 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 ignores trailing invalid HTML characters in attribute names, which allows remote attackers to bypass content filters that use regular expressions.
128 CVE-2007-0988 119 DoS Overflow 2007-02-20 2019-10-09
4.3
 None Remote Medium Not required None None Partial
The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:2147483649:{" argument.
129 CVE-2007-0987 Dir. Trav. 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot), or an absolute pathname, in the n parameter.
130 CVE-2007-0986 94 Exec Code File Inclusion 2007-02-16 2018-10-16
5.1
 None Remote High Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5, when PHP 5.0.0 or later is used, allows remote attackers to execute arbitrary PHP code via an ftp URL in the n parameter.
131 CVE-2007-0985 89 Exec Code Sql 2007-02-16 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in nickpage.php in phpCC 4.2 beta and earlier allows remote attackers to execute arbitrary SQL commands via the npid parameter in a sign_gb action.
132 CVE-2007-0984 89 Exec Code Sql 2007-02-16 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in admin_poll.asp in PollMentor 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to pollmentorres.asp.
133 CVE-2007-0983 94 Exec Code File Inclusion 2007-02-16 2017-10-19
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in _admin/nav.php in AT Contenator 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Root_To_Script parameter.
134 CVE-2007-0982 XSS 2007-02-16 2013-07-12
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in error.php in TaskFreak! 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the tznMessage parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
135 CVE-2007-0981 264 Bypass 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.
136 CVE-2007-0980 2007-02-16 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Serviceguard for Linux; packaged for SuSE SLES8 and United Linux 1.0 before SG A.11.15.07, SuSE SLES9 and SLES10 before SG A.11.16.10, and Red Hat Enterprise Linux (RHEL) before SG A.11.16.10; allows remote attackers to obtain unauthorized access via unspecified vectors.
137 CVE-2007-0979 200 +Info 2007-02-16 2011-03-08
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in LifeType before 1.1.6, and 1.2 before 1.2-beta2, allows remote attackers to obtain sensitive information (file contents) via a "crafted URL."
138 CVE-2007-0978 Overflow +Priv 2007-02-16 2017-07-29
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in swcons in IBM AIX 5.3 allows local users to gain privileges via long input data.
139 CVE-2007-0977 2007-02-16 2017-10-11
7.1
 None Remote Medium Not required Complete None None
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428.
140 CVE-2007-0976 Exec Code Overflow 2007-02-16 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the ActSoft DVD-Tools ActiveX control (dvdtools.ocx) allows remote attackers to execute arbitrary code via a long DVD_TOOLS.OpenDVD property value.
141 CVE-2007-0975 2007-02-16 2011-03-08
5.0
 None Remote Low Not required None None Partial
Variable extraction vulnerability in Ian Bezanson Apache Stats before 0.0.3 beta allows attackers to overwrite critical variables, with unknown impact, when the extract function is used on the _REQUEST superglobal array.
142 CVE-2007-0974 2007-02-16 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in Ian Bezanson DropBox before 0.0.4 beta have unknown impact and attack vectors, possibly related to a variable extraction vulnerability.
143 CVE-2007-0973 XSS 2007-02-16 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers, which are displayed without proper sanitization when an administrator performs a Logged Guest action.
144 CVE-2007-0972 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload arbitrary files by modifying the HTTP request to send an image content type, and to omit is_guest and is_user parameters. NOTE: this issue might be related to CVE-2006-4875.
145 CVE-2007-0971 Exec Code Sql 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the attack vector might involve _SERVER.
146 CVE-2007-0970 Exec Code Sql 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to execute arbitrary SQL commands via the testID parameter to directions.php, and unspecified parameters to other files that accept GET or POST input.
147 CVE-2007-0969 XSS 2007-02-16 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to POST parameters to multiple files.
148 CVE-2007-0968 Bypass 2007-02-16 2017-07-29
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in Cisco Firewall Services Module (FWSM) before 2.3(4.7) and 3.x before 3.1(3.1) causes the access control entries (ACE) in an ACL to be improperly evaluated, which allows remote authenticated users to bypass intended certain ACL protections.
149 CVE-2007-0967 DoS 2007-02-16 2017-07-29
7.8
 None Remote Low Not required None None Complete
Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.1) allows remote attackers to cause a denial of service (device reboot) via malformed SNMP requests.
150 CVE-2007-0966 DoS 2007-02-16 2017-07-29
7.8
 None Remote Low Not required None None Complete
Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.11), when the HTTPS server is enabled, allows remote attackers to cause a denial of service (device reboot) via certain HTTPS traffic.
Total number of vulnerabilities : 534   Page : 1 2 3 (This Page)4 5 6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.