CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In September 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2007-4832 134 Exec Code 2007-09-12 2017-07-29
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in CellFactor Revolution 1.03 and earlier allows remote attackers to execute arbitrary code via format string specifiers in a malformed nickname.
252 CVE-2007-4831 79 XSS 2007-09-12 2017-07-29
2.6
 None Remote High Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in account_settings.php in TorrentTrader 1.07 allow remote attackers to inject arbitrary web script or HTML via the (1) avatar and (2) title parameters.
253 CVE-2007-4830 79 XSS 2007-09-12 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in CMD_BANDWIDTH_BREAKDOWN in DirectAdmin 1.30.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the user parameter.
254 CVE-2007-4828 79 XSS 2007-09-12 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
255 CVE-2007-4827 119 Exec Code Overflow 2007-09-19 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Modbus/TCP Diagnostic function in MiniHMI.exe for the Automated Solutions Modbus Slave ActiveX Control before 1.5 allows remote attackers to corrupt the heap and possibly execute arbitrary code via malformed Modbus requests to TCP port 502.
256 CVE-2007-4826 DoS 2007-09-12 2017-07-29
3.5
 None Remote Medium ??? None None Partial
bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (2) a COMMUNITY attribute, which triggers a NULL pointer dereference. NOTE: vector 2 only exists when debugging is enabled.
257 CVE-2007-4825 22 Exec Code Dir. Trav. Bypass 2007-09-12 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a .. (dot dot) in the dl function.
258 CVE-2007-4824 2007-09-11 2008-11-15
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple cross-application scripting (XAS) vulnerabilities in Google Picasa have unspecified attack vectors and impact. NOTE: this information is based upon a vague pre-advisory.
259 CVE-2007-4823 119 Overflow 2007-09-11 2013-07-05
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in Google Picasa have unspecified attack vectors and impact. NOTE: this information is based upon a vague pre-advisory.
260 CVE-2007-4822 352 CSRF 2007-09-11 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Cross-site request forgery (CSRF) vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as demonstrated by accessing (1) ap.html and (2) filter_ip.html.
261 CVE-2007-4821 119 Exec Code Overflow 2007-09-11 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in a certain ActiveX control in officeviewer.ocx 5.2.218.1 in EDraw Office Viewer Component 5.2 allows remote attackers to execute arbitrary code via a long first argument to the HttpDownloadFileToTempDir method, a different vulnerability than CVE-2007-3169.
262 CVE-2007-4820 22 Dir. Trav. 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and possibly execute local PHP scripts, via the nmf parameter.
263 CVE-2007-4819 79 XSS 2007-09-11 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Txx CMS 0.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
264 CVE-2007-4818 94 Exec Code File Inclusion 2007-09-11 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Txx CMS 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) addons/plugin.php, (2) addons/sidebar.php, (3) mail/index.php, or (4) mail/mailbox.php in modules/.
265 CVE-2007-4817 94 Exec Code 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in the Restaurante (com_restaurante) component for Joomla! allows remote attackers to upload and execute arbitrary PHP code via an upload action specifying a filename with a double extension such as .php.jpg, which creates an accessible file under img_original/.
266 CVE-2007-4816 119 Overflow 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown impact via a long (1) URL, (2) backImage, or (3) titleImage property value; (4) a long first argument to the advancedOpen method; a long argument to the (5) isDVDPath or (6) rawParse method; or (7) a .smpl file with a long path attribute in an item element in a PlayList.
267 CVE-2007-4815 94 Exec Code File Inclusion 2007-09-11 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in WebED in Markus Iser ED Engine 0.8999 alpha allow remote attackers to execute arbitrary PHP code via a URL in the Codebase parameter to (1) channeledit.php, (2) post.php, (3) view.php, or (4) viewitem.php in source/mod/rss/.
268 CVE-2007-4814 119 Exec Code Overflow 2007-09-11 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the SQLServer ActiveX control in the Distributed Management Objects OLE DLL (sqldmo.dll) 2000.085.2004.00 in Microsoft SQL Server Enterprise Manager 8.05.2004 allows remote attackers to execute arbitrary code via a long second argument to the Start method.
269 CVE-2007-4813 79 XSS 2007-09-11 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Domino Blogsphere 3.01 Beta 7 allows remote attackers to inject arbitrary web script or HTML via the name field. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
270 CVE-2007-4812 119 DoS Overflow 2007-09-11 2018-10-15
5.0
 None Remote Low Not required None None Partial
Buffer overflow in Apple Safari 3.0.3 522.15.5, and other versions before Beta Update 3.0.4, allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact by setting document.location.hash to a long string. NOTE: the crash might actually occur in the alert method.
271 CVE-2007-4811 79 XSS 2007-09-11 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to inject arbitrary web script or HTML via (1) the val parameter to alphabet.php in an alpha.albums action, or the PATH_INFO to (2) random.php or (3) admin/hidden.php.
272 CVE-2007-4810 89 Exec Code Sql 2007-09-11 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to execute arbitrary SQL commands via (1) the ge_id parameter in a list.artists action to explore.php or (2) the id parameter in a show.tracks action to xml.php.
273 CVE-2007-4809 94 Exec Code File Inclusion 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 allow remote attackers to execute arbitrary PHP code via a URL in the DOC_ROOT parameter to (1) lib/functions.php or (2) lib/header.php.
274 CVE-2007-4808 89 Exec Code Sql 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in TLM CMS 3.2 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to news.php in a lirenews action, (2) the idnews parameter to goodies.php in a lire action, (3) the id parameter to file.php in a voir action, (4) the ID parameter to affichage.php, (5) the id_sal parameter to mod_forum/afficher.php, or (6) the id_sujet parameter to mod_forum/messages.php. NOTE: it was later reported that goodies.php and affichage.php scripts are reachable through index.php, and 1.1 is also affected. NOTE: it was later reported that the goodies.php vector also affects 3.1.
275 CVE-2007-4807 94 Exec Code File Inclusion 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Focus/SIS 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the staticpath parameter to (1) modules/Discipline/CategoryBreakdownTime.php or (2) modules/Discipline/StudentFieldBreakdown.php.
276 CVE-2007-4806 94 Exec Code File Inclusion 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in modules/Discipline/CategoryBreakdownTime.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter.
277 CVE-2007-4805 22 Dir. Trav. 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Directory traversal vulnerability in getgalldata.php in fuzzylime (cms) 3.0 and earlier allows remote attackers to include arbitrary local files via a .. (dot dot) in the p parameter.
278 CVE-2007-4804 89 Exec Code Sql 2007-09-11 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) hal.php, (2) cetak.php, (3) lihat.php, (4) pesan.php, and (5) teman.php, different vectors than CVE-2007-4171. NOTE: the scripts may be accessed through requests to the product's top-level default URI, using the pilih parameter, in some circumstances.
279 CVE-2007-4803 119 Exec Code Overflow 2007-09-11 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
Buffer overflow in AtomixMP3 2.3 allows user-assisted remote attackers to execute arbitrary code via long strings in file and title fields in a .pls file, as demonstrated by the (1) File1 and (2) Title1 fields, different vectors than CVE-2006-6287 and CVE-2007-2487.
280 CVE-2007-4802 119 Exec Code Overflow 2007-09-11 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
Multiple heap-based buffer overflows in GlobalLink 2.7.0.8 allow remote attackers to execute arbitrary code via (1) a long eighth argument to the SetInfo method in a certain ActiveX control in glItemCom.dll or (2) a long second argument to the SetClientInfo method in a certain ActiveX control in glitemflat.dll.
281 CVE-2007-4799 264 DoS 2007-09-10 2011-03-08
4.9
 None Local Low Not required None None Complete
The perfstat kernel extension in bos.perf.perfstat in AIX 5.3 does not verify privileges when processing a SET call, which allows local users to cause a denial of service (system hang or crash) via unspecified SET operations.
282 CVE-2007-4798 264 2007-09-10 2017-07-29
6.6
 None Local Low Not required None Complete Complete
Unspecified vulnerability in invscout in Inventory Scout in invscout.rte in IBM AIX 5.2 and 5.3 allows local users to delete system files that have names matching the final substring of a hostname alias, as demonstrated by hostnames ending in "unix".
283 CVE-2007-4797 119 Overflow +Priv 2007-09-10 2011-03-08
7.2
 None Local Low Not required Complete Complete Complete
Multiple buffer overflows in unspecified svprint (System V print) commands in bos.svprint.rte in IBM AIX 5.2 and 5.3 allow local users to gain privileges via unspecified vectors.
284 CVE-2007-4796 119 Overflow +Priv 2007-09-10 2011-03-08
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in uucp in bos.net.uucp in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
285 CVE-2007-4795 119 Overflow +Priv 2007-09-10 2011-03-08
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in mkpath in bos.rte.methods in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long ODM name.
286 CVE-2007-4794 119 Overflow +Priv 2007-09-10 2017-07-29
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in fcstat in devices.common.IBM.fc.rte in IBM AIX 5.2 and 5.3 allows local users to gain privileges via a long input parameter.
287 CVE-2007-4793 119 Overflow +Priv 2007-09-10 2011-03-08
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in xlplm in plm.server.rte in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
288 CVE-2007-4792 119 Overflow +Priv 2007-09-10 2017-07-29
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in ibstat in devices.common.IBM.ib.rte in IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.
289 CVE-2007-4791 119 Overflow +Priv 2007-09-10 2012-11-06
7.2
 None Local Low Not required Complete Complete Complete
Buffer overflow in the swcons command in bos.rte.console in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2005-3504 and CVE-2007-0978.
290 CVE-2007-4790 119 Exec Code Overflow 2007-09-10 2021-07-23
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx, as used in the Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library; and Internet Explorer 5.01, 6 SP1 and SP2, and 7; allows remote attackers to execute arbitrary code via a long first argument to the FoxDoCmd function.
291 CVE-2007-4789 16 DoS 2007-09-10 2017-07-29
7.8
 None Remote Low Not required None None Complete
Cisco Content Switching Modules (CSM) 4.2 before 4.2.7, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.6, when service termination is enabled, allow remote attackers to cause a denial of service (reboot) via unspecified vectors related to high network utilization, aka CSCsh57876.
292 CVE-2007-4788 DoS 2007-09-10 2017-07-29
7.8
 None Remote Low Not required None None Complete
Cisco Content Switching Modules (CSM) 4.2 before 4.2.3a, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.2a, allow remote attackers to cause a denial of service (CPU consumption or reboot) via sets of out-of-order TCP packets with unspecified characteristics, aka CSCsd27478.
293 CVE-2007-4787 20 Bypass 2007-09-10 2017-07-29
5.0
 None Remote Low Not required None Partial None
The virus detection engine in Sophos Anti-Virus before 2.49.0 does not properly process malformed (1) CAB, (2) LZH, and (3) RAR files with modified headers, which might allow remote attackers to bypass malware detection.
294 CVE-2007-4786 255 +Info 2007-09-10 2018-10-30
4.3
 None Local Network High ??? Complete None None
Cisco Adaptive Security Appliance (ASA) running PIX 7.0 before 7.0.7.1, 7.1 before 7.1.2.61, 7.2 before 7.2.2.34, and 8.0 before 8.0.2.11, when AAA is enabled, composes %ASA-5-111008 messages from the "test aaa" command with cleartext passwords and sends them over the network to a remote syslog server or places them in a local logging buffer, which allows context-dependent attackers to obtain sensitive information.
295 CVE-2007-4785 Bypass 2007-09-10 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
Sony Micro Vault Fingerprint Access Software, as distributed with Sony Micro Vault USM-F USB flash drives, installs a driver that hides a directory under %WINDIR%, which might allow remote attackers to bypass malware detection by placing files in this directory.
296 CVE-2007-4784 20 DoS Exec Code 2007-09-10 2018-10-15
5.0
 None Remote Low Not required None None Partial
The setlocale function in PHP before 5.2.4 allows context-dependent attackers to cause a denial of service (application crash) via a long string in the locale parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
297 CVE-2007-4783 20 DoS Exec Code 2007-09-10 2018-10-15
5.0
 None Remote Low Not required None None Partial
The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
298 CVE-2007-4782 94 DoS Exec Code 2007-09-10 2018-10-15
5.0
 None Remote Low Not required None None Partial
PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined characteristics, as demonstrated by a "*[1]e" value. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
299 CVE-2007-4781 20 2007-09-10 2017-09-29
6.6
 None Remote High ??? None Complete Complete
administrator/index.php in the installer component (com_installer) in Joomla! 1.5 Beta1, Beta2, and RC1 allows remote authenticated administrators to upload arbitrary files to tmp/ via the "Upload Package File" functionality, which is accessible when com_installer is the value of the option parameter.
300 CVE-2007-4780 20 +Info 2007-09-10 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
Joomla! 1.5 before RC2 (aka Endeleo) allows remote attackers to obtain sensitive information (the full path) via unspecified vectors, probably involving direct requests to certain PHP scripts in tmpl/ directories.
Total number of vulnerabilities : 434   Page : 1 2 3 4 5 6 (This Page)7 8 9
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.