Security Vulnerabilities Published In February 2007

2007 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
401	CVE-2007-0456		DoS	2007-02-02	2017-10-11	4.3	None	Remote	Medium	Not required	None	None	Partial
Unspecified vulnerability in the LLT dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
402	CVE-2007-0454	134	Exec Code	2007-02-06	2018-10-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.
403	CVE-2007-0453		Exec Code Overflow	2007-02-06	2018-10-16	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Buffer overflow in the nss_winbind.so.1 library in Samba 3.0.21 through 3.0.23d, as used in the winbindd daemon on Solaris, allows attackers to execute arbitrary code via the (1) gethostbyname and (2) getipnodebyname functions.
404	CVE-2007-0452		DoS	2007-02-06	2018-10-16	6.8	None	Remote	Low	???	None	None	Complete
smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.
405	CVE-2007-0451	399	DoS	2007-02-16	2017-10-11	4.3	None	Remote	Medium	Not required	None	None	Partial
Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
406	CVE-2007-0446		Exec Code Overflow	2007-02-08	2018-10-16	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent 8.0 and 8.1, Performance Center Agent 8.0 and 8.1, and Monitor over Firewall 8.1 allows remote attackers to execute arbitrary code via a packet with a long server_ip_name field to TCP port 54345, which triggers the overflow in mchan.dll.
407	CVE-2007-0436	264	+Priv	2007-02-04	2011-05-18	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Barron McCann X-Kryptor Driver BMS1446HRR (Xgntr BMS1351 Install BMS1472) in X-Kryptor Secure Client does not drop privileges when launching an Explorer window in response to a help command, which allows local users to gain LocalSystem privileges via interactive use of Explorer.
408	CVE-2007-0325	119	Exec Code Overflow	2007-02-20	2011-03-08	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in OfficeScan 7.0 before Build 1344, OfficeScan 7.3 before Build 1241, and Client / Server / Messaging Security 3.0 before Build 1197, allow remote attackers to execute arbitrary code via a crafted HTML document.
409	CVE-2007-0324		Exec Code Overflow	2007-02-15	2018-10-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple buffer overflows in the LizardTech DjVu Browser Plug-in before 6.1.1 allow remote attackers to execute arbitrary code via unspecified vectors.
410	CVE-2007-0321		Exec Code Overflow	2007-02-23	2017-07-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Buffer overflow in the Update Service Agent ActiveX Control in isusweb.dll for Macrovision FLEXnet Connect (formerly InstallShield Update Service) allows remote attackers to execute arbitrary code via the Download method.
411	CVE-2007-0320	119	Exec Code Overflow	2007-02-23	2017-07-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Multiple buffer overflows in (a) an ActiveX control (iftw.dll) and (b) Netscape plug-in (npiftw32.dll) for Macrovision (formerly InstallShield) InstallFromTheWeb allow remote attackers to execute arbitrary code via crafted HTML documents.
412	CVE-2007-0219		Exec Code	2007-02-13	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX controls, which allows remote attackers to execute arbitrary code via unspecified vectors, a different issue than CVE-2006-4697.
413	CVE-2007-0217		Exec Code	2007-02-13	2021-07-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP server response of a specific length that causes a terminating null byte to be written outside of a buffer, which causes heap corruption.
414	CVE-2007-0214		Exec Code	2007-02-13	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functions, related to uninitialized parameters.
415	CVE-2007-0211		+Priv	2007-02-13	2018-10-12	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The hardware detection functionality in the Windows Shell in Microsoft Windows XP SP2 and Professional, and Server 2003 SP1 allows local users to gain privileges via an unvalidated parameter to a function related to the "detection and registration of new hardware."
416	CVE-2007-0210		Overflow +Priv	2007-02-13	2018-10-12	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Window Image Acquisition (WIA) Service in Microsoft Windows XP SP2 allows local users to gain privileges via unspecified vectors involving an "unchecked buffer," probably a buffer overflow.
417	CVE-2007-0209	94	Exec Code Mem. Corr.	2007-02-13	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac allows user-assisted remote attackers to execute arbitrary code via a Word file with a malformed drawing object, which leads to memory corruption.
418	CVE-2007-0208	20	Exec Code	2007-02-13	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac does not correctly check the properties of certain documents and warn the user of macro content, which allows user-assisted remote attackers to execute arbitrary code.
419	CVE-2007-0026		Exec Code Mem. Corr.	2007-02-13	2018-10-12	7.6	None	Remote	High	Not required	Complete	Complete	Complete
The OLE Dialog component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption.
420	CVE-2007-0025	94	Exec Code Overflow Mem. Corr.	2007-02-13	2018-10-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code via an RTF file with a malformed OLE object that triggers memory corruption. NOTE: this might be due to a stack-based buffer overflow in the AfxOleSetEditMenu function in MFC42u.dll.
421	CVE-2007-0009	119	Exec Code Overflow	2007-02-26	2019-10-09	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, Thunderbird before 1.5.0.10, SeaMonkey before 1.0.8, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via invalid "Client Master Key" length values.
422	CVE-2007-0008	189	Exec Code Overflow	2007-02-26	2018-10-16	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Integer underflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.10 and 2.x before 2.0.0.2, SeaMonkey before 1.0.8, Thunderbird before 1.5.0.10, and certain Sun Java System server products before 20070611, allows remote attackers to execute arbitrary code via a crafted SSLv2 server message containing a public key that is too short to encrypt the "Master Secret", which results in a heap-based overflow.
423	CVE-2007-0007			2007-02-20	2017-07-29	3.6	None	Local	Low	Not required	None	Partial	Partial
gnucash 2.0.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on the (1) gnucash.trace, (2) qof.trace, and (3) qof.trace.[PID] temporary files.
424	CVE-2007-0006		DoS	2007-02-06	2017-10-11	1.9	None	Local	Medium	Not required	None	None	Partial
The key serial number collision avoidance code in the key_alloc_serial function in Linux kernel 2.6.9 up to 2.6.20 allows local users to cause a denial of service (crash) via vectors that trigger a null dereference, as originally reported as "spinlock CPU recursion."
425	CVE-2006-7064		XSS	2007-02-24	2017-07-29	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Cross-site scripting (XSS) vulnerability in forum/admin.php for Invision Power Board (IPB) 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML as the administrator via the phpinfo parameter.
426	CVE-2006-7063		Dir. Trav.	2007-02-24	2017-10-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in profile.php in TinyPHPforum 3.6 and earlier allows remote attackers to include and execute arbitrary files via ".." sequences in the uname parameter.
427	CVE-2006-7062			2007-02-24	2017-07-29	7.8	None	Remote	Low	Not required	Complete	None	None
calendar.php in Kamgaing Email System (kmail) 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message.
428	CVE-2006-7061		XSS	2007-02-24	2008-09-05	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Scriptsez.net E-Dating System stores data files with predictable names under the web document root with insufficient access control, which allows remote attackers to read private messages and leverage them for cross-site scripting (XSS) attacks.
429	CVE-2006-7060			2007-02-24	2008-09-05	5.0	None	Remote	Low	Not required	Partial	None	None
cindex.php in Scriptsez.net E-Dating System allows remote attackers to obtain the full path via an invalid id parameter in a dologin action, which leaks the path in an error message.
430	CVE-2006-7059	79	XSS	2007-02-24	2017-07-29	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net E-Dating System allow remote attackers to inject arbitrary web script or HTML via encoded entities (&#0000039) in IMG tags to (1) messages, (2) profile fields, or (3) the id parameter in a dologin operation to cindex.php.
431	CVE-2006-7058		XSS	2007-02-24	2011-03-08	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Sphider before 1.3.1c allow remote attackers to inject arbitrary web script or HTML via the catid parameter to (1) templates/standard/search_form.html and (2) templates/dark/search_form.html. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
432	CVE-2006-7057		Exec Code Sql	2007-02-24	2011-03-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
SQL injection vulnerability in search.php in Sphider before 1.3.1c allows remote attackers to execute arbitrary SQL commands via the category parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this issue might be primary to CVE-2006-2506.2.
433	CVE-2006-7056		Exec Code File Inclusion	2007-02-24	2018-10-16	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in DreamCost HostAdmin 3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) functions.php and (2) members.php. NOTE: the index.php vector is covered by CVE-2006-0791.
434	CVE-2006-7055		Exec Code File Inclusion	2007-02-24	2018-10-16	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in index.php in TotalCalendar 2.30 and earlier allows remote attackers to execute arbitrary code via a URL in the inc_dir parameter, a different vector than CVE-2006-1922.
435	CVE-2006-7054		DoS	2007-02-24	2017-07-29	7.8	None	Remote	Low	Not required	None	None	Complete
The DNS module in Arkoon FAST360 UTM appliances 3.0 up to 3.0/29, 3.1 through 3.3, and 4.0 allows remote attackers to cause a denial of service (reboot) via a malformed DNS message, as demonstrated by the PROTOS DNS testing suite.
436	CVE-2006-7053		Bypass	2007-02-24	2017-07-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in Arkoon FAST360 UTM appliances 3.0 through 3.0/29, 3.1, 3.2, and 3.3 allows remote attackers to bypass keyword filtering in the FAST HTTP module, and signatures in the IDPS HTTP module, via crafted URLs that are "misinterpreted."
437	CVE-2006-7052		Exec Code File Inclusion	2007-02-24	2017-07-29	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php, (b) showcatpicks.php, and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php, (e) admin/index.php, (f) admin/categories.php, (g) admin/editconfig.php, and (h) admin/articles.php.
438	CVE-2006-7051		DoS Bypass	2007-02-24	2018-10-30	4.9	None	Local	Low	Not required	None	None	Complete
The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x allows local users to cause a denial of service (memory consumption) and possibly bypass memory limits or cause other processes to be killed by creating a large number of posix timers, which are allocated in kernel memory but are not treated as part of the process' memory.
439	CVE-2006-7050		XSS	2007-02-24	2017-07-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php, and possibly (2) other vectors in wikka.php.
440	CVE-2006-7049		Bypass	2007-02-24	2017-07-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files.
441	CVE-2006-7048		Exec Code File Inclusion	2007-02-24	2008-09-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter to (a) atutor.inc.php (b) db-generic.inc.php (c) docebo.inc.php (d) dokeos.1.6.inc.php (e) dokeos.inc.php (f) ganesha.inc.php (g) mambo.inc.php (h) moodle.inc.php (i) phpnuke.inc.php (j) postnuke.inc.php and (k) spip.inc.php in claroline/auth/extauth/drivers/; (2) includePath parameter in mambo.inc.php, postnuke.inc.php, and (l) inc/lib/event/init_event_manager.inc.php; and (3) rootSys parameter in (m) inc/lib/export_exe_tracking.class.php, a different set of vectors than CVE-2006-2284.
442	CVE-2006-7047	264	Exec Code Bypass File Inclusion	2007-02-24	2018-10-16	5.0	None	Remote	Low	Not required	None	Partial	None
include.php in Shoutpro 1.0 might allow remote attackers to bypass IP ban restrictions via a URL in the path parameter that points to an alternate bannedips.php file. NOTE: this issue was originally reported as remote file inclusion, but CVE analysis suggests that this cannot be used for code execution.
443	CVE-2006-7046	94	Exec Code File Inclusion	2007-02-24	2008-09-05	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
PHP remote file inclusion vulnerability in cmpro.intern/login.inc.php for Clan Manager Pro (CMPRO) 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
444	CVE-2006-7045		Exec Code File Inclusion	2007-02-24	2011-03-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in Clan Manager Pro (CMPRO) 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the (1) rootpath and possibly (2) sitepath parameters to (a) cmpro.ext/comment.core.inc.php and (b) cmpro.intern/comment.core.inc.php. NOTE: the provenance of this information is unknown; details are obtained from third party sources.
445	CVE-2006-7044		Exec Code File Inclusion	2007-02-24	2017-07-29	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP remote file inclusion vulnerability in comment.core.inc.php in Clan Manager Pro (CMPRO) 1.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the sitepath parameter.
446	CVE-2006-7043		XSS	2007-02-24	2017-07-29	3.5	None	Remote	Medium	???	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Chipmunk Blogger allow remote authenticated users to inject arbitrary web script or HTML via script tags in (1) posts and (2) profile names; and (3) a javascript URI in a URL argument in the photo gallery.
447	CVE-2006-7042		XSS	2007-02-24	2018-10-16	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site scripting (XSS) vulnerability in directory/index.php in Chipmunk directory allows remote attackers to inject arbitrary web script or HTML via the start parameter.
448	CVE-2006-7041		DoS	2007-02-23	2017-07-29	7.8	None	Remote	Low	Not required	None	None	Complete
The SMTP service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (infinite loop) via a message in which neither the originator nor recipient address is known.
449	CVE-2006-7040		DoS	2007-02-23	2017-07-29	7.8	None	Remote	Low	Not required	None	None	Complete
Unspecified vulnerability in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a TOP command to the POP3 service.
450	CVE-2006-7039		DoS	2007-02-23	2017-07-29	5.0	None	Remote	Low	Not required	None	None	Partial
The IMAP4 service in MERCUR Messaging 2005 before Service Pack 4 allows remote attackers to cause a denial of service (crash) via a message with a long subject field.

Total number of vulnerabilities : 534 Page : 1 2 3 4 5 6 7 8 9 (This Page)10 11