CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In March 2007

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
401 CVE-2007-1302 89 Exec Code Sql 2007-03-07 2018-10-16
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in guestbook.php in LI-Guestbook 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the country parameter. NOTE: it was later reported that 1.2 is also affected.
402 CVE-2007-1301 Exec Code Overflow 2007-03-07 2017-10-11
9.0
None Remote Low ??? Complete Complete Complete
Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authenticated users to execute arbitrary code via a long argument to the APPEND command. NOTE: this is probably different than CVE-2006-6423.
403 CVE-2007-1300 +Info 2007-03-07 2017-07-29
7.8
None Remote Low Not required Complete None None
DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and reseller data via a direct request for scripts/activesessions.ini. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
404 CVE-2007-1299 Exec Code File Inclusion 2007-03-07 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in index.php in Mani Stats Reader 1.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ipath parameter.
405 CVE-2007-1298 Exec Code Sql 2007-03-07 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in subcat.php in AJ Auction 1.0 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
406 CVE-2007-1297 Exec Code Sql 2007-03-07 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view_profile.php in AJDating 1.0 allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
407 CVE-2007-1296 Exec Code Sql 2007-03-07 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in postingdetails.php in AJ Classifieds 1.0 allows remote attackers to execute arbitrary SQL commands via the postingid parameter.
408 CVE-2007-1295 Exec Code Sql 2007-03-07 2017-10-19
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in topic_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the td_id parameter.
409 CVE-2007-1294 DoS 2007-03-07 2017-10-11
7.8
None Remote Low Not required None None Complete
A certain ActiveX control in the DivXBrowserPlugin (npdivx32.dll) in DivX Web Player, as distributed with DivX Player 1.3.0, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via large values to DivxWP.Resize, related to resizing images.
410 CVE-2007-1293 Exec Code Sql 2007-03-07 2018-10-16
5.8
None Remote Medium Not required Partial Partial None
SQL injection vulnerability in Rigter Portal System (RPS) 6.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categoria parameter to the top-level URI (index.php), possibly related to ver_descarga.php.
411 CVE-2007-1292 Exec Code Sql 2007-03-07 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almost impossible to achieve."
412 CVE-2007-1291 XSS 2007-03-07 2018-10-16
5.8
None Remote Medium Not required Partial Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Tyger Bug Tracking System (TygerBT) 1.1.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) Login.php and (2) Register.php.
413 CVE-2007-1290 Exec Code Sql 2007-03-07 2017-07-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ViewReport.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the bug parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
414 CVE-2007-1289 Exec Code Sql 2007-03-07 2018-10-16
6.4
None Remote Low Not required Partial Partial None
SQL injection vulnerability in ViewBugs.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL commands via the s parameter.
415 CVE-2007-1288 Exec Code File Inclusion 2007-03-07 2018-10-16
10.0
None Remote Low Not required Complete Complete Complete
Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the config[installdir] parameter to (1) comment.php, (2) themes.php, (3) directory.php, and (4) sendmsg.php in admin/.
416 CVE-2007-1287 XSS 2007-03-06 2011-03-08
4.3
None Remote Medium Not required None Partial None
A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388.
417 CVE-2007-1286 Exec Code Overflow 2007-03-06 2018-10-16
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
418 CVE-2007-1285 119 DoS Overflow 2007-03-06 2018-10-30
5.0
None Remote Low Not required None None Partial
The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
419 CVE-2007-1282 Exec Code Overflow 2007-03-06 2017-10-11
9.3
None Remote Medium Not required Complete Complete Complete
Integer overflow in Mozilla Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8 allows remote attackers to trigger a buffer overflow and possibly execute arbitrary code via a text/enhanced or text/richtext e-mail message with an extremely long line.
420 CVE-2007-1281 DoS 2007-03-06 2017-07-29
7.8
None Remote Low Not required None None Complete
Kaspersky AntiVirus Engine 6.0.1.411 for Windows and 5.5-10 for Linux allows remote attackers to cause a denial of service (CPU consumption) via a crafted UPX compressed file with a negative offset, which triggers an infinite loop during decompression.
421 CVE-2007-1278 DoS 2007-03-16 2019-07-03
4.3
None Remote Medium Not required None None Partial
Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.
422 CVE-2007-1277 20 Exec Code 2007-03-05 2018-10-16
7.5
None Remote Low Not required Partial Partial Partial
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php.
423 CVE-2007-1276 352 XSS 2007-03-05 2017-07-29
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename.
424 CVE-2007-1273 DoS Overflow +Priv 2007-03-10 2009-10-14
6.9
None Local Medium Not required Complete Complete Complete
Integer overflow in the ktruser function in NetBSD-current before 20061022, NetBSD 3 and 3-0 before 20061024, and NetBSD 2 before 20070209, when the kernel is built with the COMPAT_FREEBSD or COMPAT_DARWIN option, allows local users to cause a denial of service and possibly gain privileges.
425 CVE-2007-1269 2007-03-06 2018-10-16
5.0
None Remote Low Not required None Partial None
GNUMail 1.1.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents GNUMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
426 CVE-2007-1268 2007-03-06 2018-10-16
5.0
None Remote Low Not required None Partial None
Mutt 1.5.13 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Mutt from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
427 CVE-2007-1267 2007-03-06 2018-10-16
5.0
None Remote Low Not required None Partial None
Sylpheed 2.2.7 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Sylpheed from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
428 CVE-2007-1266 2007-03-06 2018-10-16
5.0
None Remote Low Not required None Partial None
Evolution 2.8.1 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Evolution from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
429 CVE-2007-1265 2007-03-06 2018-10-16
7.8
None Remote Low Not required None Complete None
KMail 1.9.5 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents KMail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
430 CVE-2007-1264 2007-03-06 2018-10-16
5.0
None Remote Low Not required None Partial None
Enigmail 0.94.2 and earlier does not properly use the --status-fd argument when invoking GnuPG, which prevents Enigmail from visually distinguishing between signed and unsigned portions of OpenPGP messages with multiple components, which allows remote attackers to forge the contents of a message without detection.
431 CVE-2007-1263 2007-03-06 2018-10-16
5.0
None Remote Low Not required None Partial None
GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection.
432 CVE-2007-1261 264 +Priv 2007-03-03 2017-07-29
7.5
None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors.
433 CVE-2007-1260 Exec Code Overflow 2007-03-03 2017-10-11
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via a long string in the Content-Length HTTP header.
434 CVE-2007-1259 2007-03-03 2011-09-01
7.5
None Remote Low Not required Partial Partial Partial
Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors.
435 CVE-2007-1258 DoS 2007-03-03 2017-10-11
6.1
None Local Network Low Not required None None Complete
Unspecified vulnerability in Cisco IOS 12.2SXA, SXB, SXD, and SXF; and the MSFC2, MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst 6000, 6500 and Cisco 7600 series systems; allows remote attackers on a local network segment to cause a denial of service (software reload) via a certain MPLS packet.
436 CVE-2007-1257 20 Exec Code 2007-03-03 2017-10-11
10.0
None Remote Low Not required Complete Complete Complete
The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via certain SNMP packets that are spoofed from the NAM's own IP address.
437 CVE-2007-1256 119 Overflow 2007-03-03 2018-10-16
6.8
None Remote Medium Not required Partial Partial Partial
Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context of arbitrary websites, by repeatedly setting document.location in the onunload attribute when linking to another website, a variant of CVE-2007-1092.
438 CVE-2007-1255 Exec Code Sql 2007-03-03 2018-10-16
6.0
None Remote Medium ??? Partial Partial Partial
Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to execute arbitrary PHP code by uploading a crafted GIF smiley image with a .php extension via the uploadimage parameter to admin.php, which can be later accessed via a direct request for the file in smileys/. NOTE: this can be leveraged with a separate SQL injection issue for remote unauthenticated attacks.
439 CVE-2007-1254 Exec Code Sql 2007-03-03 2018-10-16
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated users to execute arbitrary SQL commands and obtain privileges via the p_skin parameter to index.php.
440 CVE-2007-1253 94 Exec Code 2007-03-03 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
Eval injection vulnerability in the (a) kmz_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-assisted remote attackers to execute arbitrary Python code by importing a crafted (1) KML or (2) KMZ file.
441 CVE-2007-1252 DoS Exec Code Overflow 2007-03-03 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Symantec Mail Security for SMTP 5.0 before Patch 175 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted headers in an e-mail message. NOTE: some information was obtained from third party sources.
442 CVE-2007-1251 134 DoS Exec Code 2007-03-03 2018-10-16
9.3
None Remote Medium Not required Complete Complete Complete
Format string vulnerability in the new_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in the message handling.
443 CVE-2007-1250 89 Exec Code Sql 2007-03-03 2018-10-16
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
444 CVE-2007-1249 362 2007-03-03 2017-07-29
6.8
None Remote Medium Not required Partial Partial Partial
MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," which allows remote attackers with write permissions to reorder components.
445 CVE-2007-1248 79 XSS 2007-03-03 2018-10-16
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) cid, (2) uid, and (3) nid parameters to (a) news.php, and the nid parameter to (b) rating.php.
446 CVE-2007-1247 94 Exec Code File Inclusion 2007-03-03 2018-10-16
6.8
None Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in aWeb Labs aWebNews 1.5 allow remote attackers to execute arbitrary PHP code via a URL in the path_to_news parameter to (1) listing.php or (2) visview.php.
447 CVE-2007-1246 119 Exec Code Overflow 2007-03-03 2018-10-16
7.6
None Remote High Not required Complete Complete Complete
The DMO_VideoDecoder_Open function in loader/dmo/DMO_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biSize before use in a memcpy, which allows user-assisted remote attackers to cause a buffer overflow and possibly execute arbitrary code, a different vulnerability than CVE-2007-1387.
448 CVE-2007-1245 119 DoS Overflow 2007-03-03 2018-10-16
4.3
None Remote Medium Not required None None Partial
IrfanView 3.99 allows remote attackers to cause a denial of service (application crash) via a malformed WMF file.
449 CVE-2007-1244 XSS CSRF 2007-03-03 2018-10-16
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.
450 CVE-2007-1243 Bypass 2007-03-03 2017-07-29
7.5
None Remote Low Not required Partial Partial Partial
Audins Audiens 3.3 allows remote attackers to bypass authentication and perform certain privileged actions, possibly an uninstall of the product, by calling unistall.php with the values cnf=disinstalla and status=on. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Total number of vulnerabilities : 704   Page : 1 2 3 4 5 6 7 8 9 (This Page)10 11 12 13 14 15
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.