CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In February 2007 (CVSS score >= 6)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
101 CVE-2007-0985 89 Exec Code Sql 2007-02-16 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in nickpage.php in phpCC 4.2 beta and earlier allows remote attackers to execute arbitrary SQL commands via the npid parameter in a sign_gb action.
102 CVE-2007-0984 89 Exec Code Sql 2007-02-16 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in admin_poll.asp in PollMentor 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to pollmentorres.asp.
103 CVE-2007-0983 94 Exec Code File Inclusion 2007-02-16 2017-10-19
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in _admin/nav.php in AT Contenator 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the Root_To_Script parameter.
104 CVE-2007-0981 264 Bypass 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code.
105 CVE-2007-0980 2007-02-16 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in HP Serviceguard for Linux; packaged for SuSE SLES8 and United Linux 1.0 before SG A.11.15.07, SuSE SLES9 and SLES10 before SG A.11.16.10, and Red Hat Enterprise Linux (RHEL) before SG A.11.16.10; allows remote attackers to obtain unauthorized access via unspecified vectors.
106 CVE-2007-0978 Overflow +Priv 2007-02-16 2017-07-29
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in swcons in IBM AIX 5.3 allows local users to gain privileges via long input data.
107 CVE-2007-0977 2007-02-16 2017-10-11
7.1
 None Remote Medium Not required Complete None None
IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner accessible through Readviewentries and OpenDocument requests to the defaultview view, a different vector than CVE-2005-2428.
108 CVE-2007-0976 Exec Code Overflow 2007-02-16 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the ActSoft DVD-Tools ActiveX control (dvdtools.ocx) allows remote attackers to execute arbitrary code via a long DVD_TOOLS.OpenDVD property value.
109 CVE-2007-0974 2007-02-16 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in Ian Bezanson DropBox before 0.0.4 beta have unknown impact and attack vectors, possibly related to a variable extraction vulnerability.
110 CVE-2007-0973 XSS 2007-02-16 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Jupiter CMS 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header and certain other HTTP headers, which are displayed without proper sanitization when an administrator performs a Logged Guest action.
111 CVE-2007-0972 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in modules/emoticons.php in Jupiter CMS 1.1.5 allows remote attackers to upload arbitrary files by modifying the HTTP request to send an image content type, and to omit is_guest and is_user parameters. NOTE: this issue might be related to CVE-2006-4875.
112 CVE-2007-0971 Exec Code Sql 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Jupiter CMS 1.1.5 allow remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header and certain other HTTP headers, which set the ip variable that is used in SQL queries performed by index.php and certain other PHP scripts. NOTE: the attack vector might involve _SERVER.
113 CVE-2007-0970 Exec Code Sql 2007-02-16 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to execute arbitrary SQL commands via the testID parameter to directions.php, and unspecified parameters to other files that accept GET or POST input.
114 CVE-2007-0969 XSS 2007-02-16 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in WebTester 5.0.20060927 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to POST parameters to multiple files.
115 CVE-2007-0968 Bypass 2007-02-16 2017-07-29
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in Cisco Firewall Services Module (FWSM) before 2.3(4.7) and 3.x before 3.1(3.1) causes the access control entries (ACE) in an ACL to be improperly evaluated, which allows remote authenticated users to bypass intended certain ACL protections.
116 CVE-2007-0967 DoS 2007-02-16 2017-07-29
7.8
 None Remote Low Not required None None Complete
Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.1) allows remote attackers to cause a denial of service (device reboot) via malformed SNMP requests.
117 CVE-2007-0966 DoS 2007-02-16 2017-07-29
7.8
 None Remote Low Not required None None Complete
Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.11), when the HTTPS server is enabled, allows remote attackers to cause a denial of service (device reboot) via certain HTTPS traffic.
118 CVE-2007-0965 DoS 2007-02-16 2011-03-08
7.8
 None Remote Low Not required None None Complete
Cisco FWSM 3.x before 3.1(3.2), when authentication is configured to use "aaa authentication match" or "aaa authentication include", allows remote attackers to cause a denial of service (device reboot) via a long HTTP request.
119 CVE-2007-0963 DoS 2007-02-16 2011-03-08
7.8
 None Remote Low Not required None None Complete
Unspecified vulnerability in Cisco Firewall Services Module (FWSM) 3.x before 3.1(3.3), when set to log at the "debug" level, allows remote attackers to cause a denial of service (device reboot) by sending packets that are not of a particular protocol such as TCP or UDP, which triggers the reboot during generation of Syslog message 710006.
120 CVE-2007-0962 DoS 2007-02-16 2018-10-30
7.8
 None Remote Low Not required None None Complete
Cisco PIX 500 and ASA 5500 Series Security Appliances 7.0 before 7.0(4.14) and 7.1 before 7.1(2.1), and the FWSM 2.x before 2.3(4.12) and 3.x before 3.1(3.24), when "inspect http" is enabled, allows remote attackers to cause a denial of service (device reboot) via malformed HTTP traffic.
121 CVE-2007-0961 DoS 2007-02-16 2018-10-30
7.8
 None Remote Low Not required None None Complete
Cisco PIX 500 and ASA 5500 Series Security Appliances 6.x before 6.3(5.115), 7.0 before 7.0(5.2), and 7.1 before 7.1(2.5), and the FWSM 3.x before 3.1(3.24), when the "inspect sip" option is enabled, allows remote attackers to cause a denial of service (device reboot) via malformed SIP packets.
122 CVE-2007-0960 +Priv 2007-02-16 2018-10-30
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2, when configured to use the LOCAL authentication method, allows remote authenticated users to gain privileges via unspecified vectors.
123 CVE-2007-0959 DoS 2007-02-16 2018-10-30
7.8
 None Remote Low Not required None None Complete
Cisco PIX 500 and ASA 5500 Series Security Appliances 7.2.2, when configured to inspect certain TCP-based protocols, allows remote attackers to cause a denial of service (device reboot) via malformed TCP packets.
124 CVE-2007-0955 DoS 2007-02-15 2019-10-02
7.8
 None Remote Low Not required None None Complete
The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable Professional 2.35 and earlier allows remote attackers to cause a denial of service (application crash) via certain base64-encoded data following an AUTHENTICATE NTLM command to the imap port (143/tcp), which results in an out-of-bounds read.
125 CVE-2007-0954 2007-02-15 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
MOHA Chat 0.1b7 and earlier does not require authentication for use of the plug in API, which has unknown impact and attack vectors.
126 CVE-2007-0952 XSS 2007-02-15 2017-07-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net Virtual Calendar allow remote attackers to inject arbitrary web script or HTML via the (1) t and (2) yr parameters, and the (3) sho parameter when the m parameter is outside the intended range.
127 CVE-2007-0951 Exec Code Sql 2007-02-15 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in listmain.asp in Fullaspsite ASP Hosting Site allows remote attackers to execute arbitrary SQL commands via the cat parameter.
128 CVE-2007-0950 XSS 2007-02-15 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in listmain.asp in Fullaspsite ASP Hosting Site allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
129 CVE-2007-0949 Exec Code Overflow 2007-02-15 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers to execute arbitrary code via a M3U playlist file that contains a long file name. NOTE: it was later reported that 1.20 and 1.30 are also affected.
130 CVE-2007-0932 264 2007-02-14 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
The (1) Aruba Mobility Controllers 200, 600, 2400, and 6000 and (2) Alcatel-Lucent OmniAccess Wireless 43xx and 6000 do not properly implement authentication and privilege assignment for the guest account, which allows remote attackers to access administrative interfaces or the WLAN.
131 CVE-2007-0931 DoS Exec Code Overflow 2007-02-14 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in the management interfaces in (1) Aruba Mobility Controllers 200, 800, 2400, and 6000 and (2) Alcatel-Lucent OmniAccess Wireless 43xx and 6000 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via long credential strings.
132 CVE-2007-0930 2007-02-14 2011-03-08
7.5
 None Remote Low Not required Partial Partial Partial
Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
133 CVE-2007-0927 Exec Code Overflow 2007-02-14 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in uTorrent 1.6 allows remote attackers to execute arbitrary code via a torrent file with a crafted announce header.
134 CVE-2007-0926 +Priv 2007-02-14 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
The dologin function in guestbook.php in KvGuestbook 1.0 Beta allows remote attackers to gain administrative privileges, probably via modified $mysql['pass'] and $gbpass variables.
135 CVE-2007-0924 Bypass 2007-02-14 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Till Gerken phpPolls 1.0.3 allows remote attackers to bypass authentication and perform certain administrative actions via a direct request to phpPollAdmin.php3. NOTE: this issue might subsume CVE-2006-3764.
136 CVE-2007-0923 +Info 2007-02-14 2018-10-16
7.8
 None Remote Low Not required Complete None None
buscador/buscador.htm in Portal Search allows remote attackers to obtain sensitive information (business logic) via a query string composed of a search for certain characters.
137 CVE-2007-0921 2007-02-14 2018-10-16
9.4
 None Remote Low Not required None Complete Complete
Portal Search allows remote attackers to redirect a URL to an arbitrary web site by placing the URL in the query string to the top-level URI.
138 CVE-2007-0920 Exec Code Sql 2007-02-14 2017-10-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in philboard_forum.asp in Philboard 1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
139 CVE-2007-0919 Dir. Trav. 2007-02-14 2018-10-16
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in Nickolas Grigoriadis Mini Web server (MiniWebsvr) 0.0.6 allows remote attackers to list the directory immediately above the web root via a ..%00 sequence in the URI.
140 CVE-2007-0918 DoS 2007-02-14 2022-06-02
7.1
 None Remote Medium Not required None None Complete
The ATOMIC.TCP signature engine in the Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XA, 12.3YA, 12.3T, and other trains allows remote attackers to cause a denial of service (IPS crash and traffic loss) via unspecified manipulations that are not properly handled by the regular expression feature, as demonstrated using the 3123.0 (Netbus Pro Traffic) signature.
141 CVE-2007-0917 Bypass 2007-02-14 2017-10-11
6.4
 None Remote Low Not required Partial Partial None
The Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XE to 12.3T allows remote attackers to bypass IPS signatures that use regular expressions via fragmented packets.
142 CVE-2007-0915 +Priv 2007-02-14 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Distributed SLS daemon (SLSd) on HP-UX B.11.11 allows remote attackers to overwrite arbitrary files and gain privileges via a crafted RPC request.
143 CVE-2007-0914 DoS 2007-02-14 2017-10-11
7.1
 None Remote Medium Not required None None Complete
Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of service (system panic) via unknown vectors.
144 CVE-2007-0913 Exec Code 2007-02-14 2008-11-15
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as exploited by Trojan.PPDropper.G. NOTE: as of 20070213, it is not clear whether this is the same issue as CVE-2006-5296, CVE-2006-4694, CVE-2006-3876, CVE-2006-3877, or older issues.
145 CVE-2007-0912 CSRF 2007-02-13 2018-10-16
9.3
 None Remote Medium Not required Complete Complete Complete
Cross-Site Request Forgery (CSRF) vulnerability in admin/admin.adm.php in Jportal 2.3.1, and possibly earlier, allows remote attackers to perform privileged actions as administrators by tricking the admin into accessing a URL with modified arguments to admin/admin.adm.php.
146 CVE-2007-0911 DoS 2007-02-13 2018-10-16
7.8
 None Remote Low Not required None None Complete
Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).
147 CVE-2007-0910 2007-02-13 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors.
148 CVE-2007-0909 Exec Code 2007-02-13 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.
149 CVE-2007-0906 119 DoS Exec Code Overflow 2007-02-13 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions. NOTE: vector 6 might actually be an integer overflow (CVE-2007-1885). NOTE: as of 20070411, vector (3) might involve the imap_mail_compose function (CVE-2007-1825).
150 CVE-2007-0905 Bypass 2007-02-13 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
Total number of vulnerabilities : 389   Page : 1 2 3 (This Page)4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.