CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
151 CVE-2007-1586 DoS 2007-03-21 2018-10-16
7.8
 None Remote Low Not required None None Complete
ZynOS 3.40 allows remote attackers to cause a denial of service (link restart) by sending a request for the name \M via the SMB Mail Slot Protocol.
152 CVE-2007-1585 +Info 2007-03-21 2018-10-16
5.0
 None Remote Low Not required Partial None None
The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information.
153 CVE-2007-1584 Exec Code Bypass 2007-03-21 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer underflow in the header function in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by passing an all-whitespace string to this function, which causes it to write '\0' characters in whitespace that precedes the string.
154 CVE-2007-1583 2007-03-21 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.
155 CVE-2007-1582 Exec Code 2007-03-21 2018-10-30
6.8
 None Remote Medium Not required Partial Partial Partial
The resource system in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting certain functions in the GD (ext/gd) extension and unspecified other extensions via a userspace error handler, which can be used to destroy and modify internal resources.
156 CVE-2007-1581 94 Exec Code 2007-03-21 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.
157 CVE-2007-1580 119 DoS Overflow 2007-03-21 2017-10-11
6.3
 None Remote Medium ??? None None Complete
FTPDMIN 0.96 allows remote attackers to cause a denial of service (daemon crash) via a LIST command for a Windows drive letter, as demonstrated using "//A:". NOTE: this has been reported as a buffer overflow by some sources, but there is not a long argument.
158 CVE-2007-1579 119 Overflow 2007-03-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command.
159 CVE-2007-1578 Exec Code Overflow 2007-03-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, allow remote attackers to execute arbitrary code via a long NTLMSSP argument that triggers a stack-based buffer overflow.
160 CVE-2007-1577 Dir. Trav. 2007-03-21 2017-10-11
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in index.php in GeBlog 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the GLOBALS[tplname] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by index.php.
161 CVE-2007-1576 79 XSS 2007-03-21 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the (1) Projects, (2) Contacts, (3) Helpdesk, (4) Search (only Gecko engine driven Browsers), and (5) Notes modules; the (6) Mail summary page; and unspecified other files.
162 CVE-2007-1575 Exec Code Sql 2007-03-21 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via (1) unspecified vectors to the (a) calendar and (2) search modules, and an (2) unspecified cookie when the user logs out.
163 CVE-2007-1574 +Info 2007-03-21 2008-11-13
5.0
 None Remote Low Not required Partial None None
CARE2X 2.2, and possibly earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
164 CVE-2007-1573 89 Exec Code Sql 2007-03-21 2018-10-16
6.0
 None Remote Medium ??? Partial Partial Partial
SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field.
165 CVE-2007-1572 Exec Code Sql 2007-03-21 2011-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in search.asp in JGBBS 3.0 Beta 1 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter, a different vector than CVE-2007-1440. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
166 CVE-2007-1571 Exec Code File Inclusion 2007-03-21 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in includes/base.php in Radical Designs Activist Mobilization Platform (AMP) 3.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.
167 CVE-2007-1569 DoS Exec Code Overflow 2007-03-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in NewsBin Pro 4.32 allows remote attackers to cause a denial of service or execute arbitrary code via a yEnc (yEncode) encoded article with a long filename, as demonstrated using a .nzb file. NOTE: some of these details are obtained from third party information.
168 CVE-2007-1568 Exec Code Overflow 2007-03-21 2017-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in DaanSystems NewsReactor 20070220.21 allows remote attackers to execute arbitrary code via a yEnc (yEncode) encoded article with a long filename.
169 CVE-2007-1567 DoS Exec Code Overflow 2007-03-21 2011-03-08
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors, as demonstrated by warftp_165.tar by Immunity. NOTE: this might be the same issue as CVE-1999-0256, CVE-2000-0131, or CVE-2006-2171, but due to Immunity's lack of details, this cannot be certain.
170 CVE-2007-1566 Exec Code Sql 2007-03-21 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in News/page.asp in NetVIOS Portal allows remote attackers to execute arbitrary SQL commands via the NewsID parameter. NOTE: this issue might be the same as CVE-2006-5954.
171 CVE-2007-1565 DoS 2007-03-21 2008-09-05
7.8
 None Remote Low Not required None None Complete
Konqueror 3.5.5 allows remote attackers to cause a denial of service (crash) by using JavaScript to read a child iframe having an ftp:// URI.
172 CVE-2007-1564 200 +Info 2007-03-21 2017-10-11
6.8
 None Remote Medium Not required Partial Partial Partial
The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
173 CVE-2007-1563 200 +Info 2007-03-21 2011-07-08
6.8
 None Remote Medium Not required Partial Partial Partial
The FTP protocol implementation in Opera 9.10 allows remote attackers to allows remote servers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
174 CVE-2007-1562 200 +Info 2007-03-21 2020-12-09
6.8
 None Remote Medium Not required Partial Partial Partial
The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to connect to other servers, perform a proxied port scan, or obtain sensitive information by specifying an alternate server address in an FTP PASV response.
175 CVE-2007-1561 DoS 2007-03-21 2018-10-16
7.8
 None Remote Low Not required None None Complete
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address.
176 CVE-2007-1560 DoS 2007-03-21 2017-10-11
5.0
 None Remote Low Not required None None Partial
The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of service (daemon crash) via crafted TRACE requests that trigger an assertion error.
177 CVE-2007-1557 DoS +Priv 2007-03-21 2018-10-16
7.2
 None Local Low Not required Complete Complete Complete
Format string vulnerability in F-Secure Anti-Virus Client Security 6.02 allows local users to cause a denial of service and possibly gain privileges via format string specifiers in the Management Server name field on the Communication settings page.
178 CVE-2007-1556 Exec Code Sql 2007-03-21 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in kommentare.php in Creative Files 1.2 allows remote attackers to execute arbitrary SQL commands via the dlid parameter.
179 CVE-2007-1555 Exec Code Sql 2007-03-20 2017-10-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the c parameter.
180 CVE-2007-1554 2007-03-20 2011-03-08
6.8
 None Remote Medium Not required Partial Partial Partial
Direct static code injection vulnerability in admin/configuration.php in Guestbara 1.2 and earlier allows remote authenticated users to inject arbitrary PHP code into config.php via the (1) admin_mail, (2) emotpatch, (3) login, (4) pass, and unspecified other parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
181 CVE-2007-1553 2007-03-20 2017-10-11
5.0
 None Remote Low Not required None Partial None
admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of the admin account by setting the zapis parameter to "ok" and providing modified admin_mail, login, and pass parameters.
182 CVE-2007-1552 2007-03-20 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type in the Content-type HTTP header, which allows remote attackers to upload and execute arbitrary scripts via an image MIME type with a filename containing an executable extension such as .php.
183 CVE-2007-1551 XSS 2007-03-20 2018-10-16
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in phpx 3.5.15 allow remote attackers to inject arbitrary web script or HTML via (1) the signature in "dans profile," or (2) search.php.
184 CVE-2007-1550 Exec Code Sql 2007-03-20 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image_id or (2) cat_id parameter to (a) gallery.php; the (3) news_id parameter to (b) news.php or (c) print.php; (4) the news_cat_id parameter to news.php; the (5) cat_id, (6) topic_id, or (7) post_id parameter to (d) forums.php; or (8) the user_id parameter to (e) users.php.
185 CVE-2007-1549 2007-03-20 2018-10-16
6.8
 None Remote Medium Not required Partial Partial Partial
Unrestricted file upload vulnerability in gallery.php in phpx 3.5.15 allows remote attackers to upload and execute arbitrary PHP scripts via an addImage action, which places scripts into the gallery/shelties/ directory.
186 CVE-2007-1548 89 Exec Code Sql 2007-03-20 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in functions/functions_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certain characters in SQL commands, which allows remote attackers to execute arbitrary SQL commands via \"' (backslash double-quote quote) sequences, which are collapsed into \'', as demonstrated via the name parameter to forum/pop_up_member_search.asp.
187 CVE-2007-1547 DoS 2007-03-20 2018-10-16
7.8
 None Remote Low Not required None None Complete
The ReadRequestFromClient function in server/os/io.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via multiple simultaneous connections, which triggers a NULL pointer dereference.
188 CVE-2007-1546 DoS 2007-03-20 2018-10-16
5.0
 None Remote Low Not required None None Partial
Array index error in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via (1) large num_action values in the ProcAuSetElements function in server/dia/audispatch.c or (2) a large inputNum parameter to the compileInputs function in server/dia/auutil.c.
189 CVE-2007-1545 DoS 2007-03-20 2018-10-16
5.0
 None Remote Low Not required None None Partial
The AddResource function in server/dia/resource.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (server crash) via a nonexistent client ID.
190 CVE-2007-1544 DoS Exec Code Overflow 2007-03-20 2018-10-16
5.0
 None Remote Low Not required None None Partial
Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large max_samples value.
191 CVE-2007-1543 Exec Code Overflow 2007-03-20 2018-10-16
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the accept_att_local function in server/os/connection.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection.
192 CVE-2007-1542 DoS 2007-03-20 2017-07-29
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in the Cisco IP Phone 7940 and 7960 running firmware before POS8-6-0 allows remote attackers to cause a denial of service via the Remote-Party-ID sipURI field in a SIP INVITE request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
193 CVE-2007-1541 Dir. Trav. Bypass 2007-03-20 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against directory traversal attacks, which allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence in the login parameter.
194 CVE-2007-1540 Dir. Trav. Bypass 2007-03-20 2018-10-16
4.3
 None Remote Medium Not required Partial None None
Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.
195 CVE-2007-1539 Dir. Trav. 2007-03-20 2017-10-19
4.3
 None Remote Medium Not required Partial None None
Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the module_name parameter, as demonstrated via a static PHP code injection attack in an Apache log file.
196 CVE-2007-1538 Bypass 2007-03-20 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** McAfee VirusScan Enterprise 8.5.0.i uses insecure permissions for certain Windows Registry keys, which allows local users to bypass local password protection via the UIP value in (1) HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\DesktopProtection or (2) HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates\TVD\VirusScan Entreprise\CurrentVersion. NOTE: this issue has been disputed by third-party researchers, stating that the default permissions for HKEY_LOCAL_MACHINE\SOFTWARE does not allow for write access and the product does not modify the inherited permissions. There might be an interaction error with another product.
197 CVE-2007-1537 DoS 2007-03-20 2018-10-16
3.6
 None Local Low Not required None Partial Partial
\Device\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions, which allows local users to write to the device and cause a denial of service, as demonstrated by using an IRQL to acquire a spinlock on paged memory via the NdisTapiDispatch function.
198 CVE-2007-1536 189 Exec Code Overflow 2007-03-20 2018-10-16
9.3
 None Remote Medium Not required Complete Complete Complete
Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via a file that triggers a heap-based buffer overflow.
199 CVE-2007-1535 2007-03-20 2018-10-16
7.5
 None Remote Low Not required Partial Partial Partial
Microsoft Windows Vista establishes a Teredo address without user action upon connection to the Internet, contrary to documentation that Teredo is inactive without user action, which increases the attack surface and allows remote attackers to communicate via Teredo.
200 CVE-2007-1534 2007-03-20 2018-10-16
9.3
 None Remote Medium Not required Complete Complete Complete
DFSR.exe in Windows Meeting Space in Microsoft Windows Vista remains available for remote connections on TCP port 5722 for 2 minutes after Windows Meeting Space is closed, which allows remote attackers to have an unknown impact by connecting to this port during the time window.
Total number of vulnerabilities : 704   Page : 1 2 3 4 (This Page)5 6 7 8 9 10 11 12 13 14 15
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.