# CVEs published 2007-06-26

47 CVEs were published on June 26, 2007: 0 critical, 1 high. Days are UTC.

- [CVE-2006-7208](https://cve.now/CVE-2006-7208.md): PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com\_forum) component (aka phpBB component) 1.2.4RC3… (no CVSS)
- [CVE-2007-3411](https://cve.now/CVE-2007-3411.md): SQL injection vulnerability in edit\_image.asp in ClickGallery Server 5.1 and earlier allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2007-3412](https://cve.now/CVE-2007-3412.md): Cross-site scripting (XSS) vulnerability in edit\_image.asp in ClickGallery Server 5.1 and earlier allows remote attackers to inject… (no CVSS)
- [CVE-2007-3413](https://cve.now/CVE-2007-3413.md): Multiple cross-site scripting (XSS) vulnerabilities in bosDataGrid 2.50 and earlier allow remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2007-3414](https://cve.now/CVE-2007-3414.md): Multiple cross-site scripting (XSS) vulnerabilities in access2asp 4.5 and earlier allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2007-3415](https://cve.now/CVE-2007-3415.md): Multiple SQL injection vulnerabilities in index.php in phpRaider 1.0.0 rc8 allow remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2007-3416](https://cve.now/CVE-2007-3416.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the administration of (1) polls, (2) profiles, (3) IP bans, and (4) forums… (no CVSS)
- [CVE-2007-3417](https://cve.now/CVE-2007-3417.md): Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/cgi-lib/search.pl in web-app.org WebAPP before 0.9.9.7 allow remote… (no CVSS)
- [CVE-2007-3418](https://cve.now/CVE-2007-3418.md): The displaypost function in cgi-bin/cgi-lib/forum\_display.pl in web-app.org WebAPP before 0.9.9.7 does not display usernames in… (no CVSS)
- [CVE-2007-3419](https://cve.now/CVE-2007-3419.md): The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the (1) themes.dat, (2)… (no CVSS)
- [CVE-2007-3420](https://cve.now/CVE-2007-3420.md): The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not… (no CVSS)
- [CVE-2007-3421](https://cve.now/CVE-2007-3421.md): The (1) login, (2) admin profile edit, (3) reminder, (4) edit profile, (5) profile view, (6) gallery view, (7) gallery comment, and (8)… (no CVSS)
- [CVE-2007-3422](https://cve.now/CVE-2007-3422.md): The getcgi function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 attempts to parse query strings that contain (1)… (no CVSS)
- [CVE-2007-3423](https://cve.now/CVE-2007-3423.md): cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the… (no CVSS)
- [CVE-2007-3424](https://cve.now/CVE-2007-3424.md): The moveim function in cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the tocat parameter as a subdirectory… (no CVSS)
- [CVE-2007-2442](https://cve.now/CVE-2007-2442.md): The gssrpc\_\_svcauth\_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute… (no CVSS)
- [CVE-2007-2443](https://cve.now/CVE-2007-2443.md): Integer signedness error in the gssrpc\_\_svcauth\_unix function in svc\_auth\_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and… (no CVSS)
- [CVE-2007-2798](https://cve.now/CVE-2007-2798.md): Stack-based buffer overflow in the rename\_principal\_2\_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows… (no CVSS)
- [CVE-2007-3410](https://cve.now/CVE-2007-3410.md): Stack-based buffer overflow in the SmilTimeValue::parseWallClockValue function in smlprstime.cpp in RealNetworks RealPlayer 10, 10.1, and… (no CVSS)
- [CVE-2007-0773](https://cve.now/CVE-2007-0773.md): The Linux kernel before 2.6.9-42.0.8 in Red Hat 4.4 allows local users to cause a denial of service (kernel OOPS from null dereference)… (no CVSS)
- [CVE-2007-2951](https://cve.now/CVE-2007-2951.md): The parseIrcUrl function in src/kvirc/kernel/kvi\_ircurl.cpp in KVIrc 3.2.0 allows user-assisted remote attackers to execute arbitrary… (no CVSS)
- [CVE-2007-3104](https://cve.now/CVE-2007-3104.md): The sysfs\_readdir function in the Linux kernel 2.6, as used in Red Hat Enterprise Linux (RHEL) 4.5 and other distributions, allows users… (no CVSS)
- [CVE-2007-3406](https://cve.now/CVE-2007-3406.md): Multiple absolute path traversal vulnerabilities in Microsoft Internet Explorer 6 on Windows XP SP2 allow remote attackers to access… (no CVSS)
- [CVE-2007-3407](https://cve.now/CVE-2007-3407.md): Sergey Lyubka Simple HTTPD (shttpd) 1.38 allows remote attackers to obtain sensitive information (script source code) via a URL with a… (no CVSS)
- [CVE-2007-3408](https://cve.now/CVE-2007-3408.md): Multiple unspecified vulnerabilities in Dia before 0.96.1-6 have unspecified attack vectors and impact, probably involving the use of… (no CVSS)
- [CVE-2007-3409](https://cve.now/CVE-2007-3409.md): Net::DNS before 0.60, a Perl module, allows remote attackers to cause a denial of service (stack consumption) via a malformed compressed… (CVSS 7.5)
- [CVE-2007-2520](https://cve.now/CVE-2007-2520.md): SQL injection vulnerability in admin.php in MyNews 0.10, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2007-3182](https://cve.now/CVE-2007-3182.md): Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register\_globals is enabled, allow remote attackers… (no CVSS)
- [CVE-2007-3183](https://cve.now/CVE-2007-3183.md): Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magic\_quotes\_gpc is disabled, allow remote attackers to execute… (no CVSS)
- [CVE-2007-3259](https://cve.now/CVE-2007-3259.md): Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via (1) an invalid month\[\] parameter to calendar.php, (2)… (no CVSS)
- [CVE-2007-3394](https://cve.now/CVE-2007-3394.md): Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the (1) artid… (no CVSS)
- [CVE-2007-3396](https://cve.now/CVE-2007-3396.md): Cross-site scripting (XSS) vulnerability in index.wkf in KeyFocus (KF) web server 3.1.0 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2007-3397](https://cve.now/CVE-2007-3397.md): The web container in IBM WebSphere Application Server (WAS) before 6.0.2.21, and 6.1.x before 6.1.0.9, sends response data intended for a… (no CVSS)
- [CVE-2007-3398](https://cve.now/CVE-2007-3398.md): LiteWEB 2.7 allows remote attackers to cause a denial of service (hang) via a large number of requests for nonexistent pages. (no CVSS)
- [CVE-2007-3399](https://cve.now/CVE-2007-3399.md): SQL injection vulnerability in include/get\_userdata.php in Power Phlogger (PPhlogger) 2.2.5 and earlier allows remote attackers to execute… (no CVSS)
- [CVE-2007-3400](https://cve.now/CVE-2007-3400.md): The NCTAudioEditor2 ActiveX control in NCTWMAFile2.dll 2.6.2.157, as distributed in NCTAudioEditor and NCTAudioStudio 2.7, allows remote… (no CVSS)
- [CVE-2007-3401](https://cve.now/CVE-2007-3401.md): PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a… (no CVSS)
- [CVE-2007-3402](https://cve.now/CVE-2007-3402.md): SQL injection vulnerability in index.php in pagetool 1.07 allows remote attackers to execute arbitrary SQL commands via the news\_id… (no CVSS)
- [CVE-2007-3403](https://cve.now/CVE-2007-3403.md): Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload and execute… (no CVSS)
- [CVE-2007-3404](https://cve.now/CVE-2007-3404.md): Directory traversal vulnerability in ShowImage.php in SiteDepth CMS 3.44 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-3405](https://cve.now/CVE-2007-3405.md): Multiple cross-site scripting (XSS) vulnerabilities in defter\_yaz.asp in Lebisoft zdefter 4.0 allow remote attackers to inject arbitrary… (no CVSS)
- [CVE-2003-1332](https://cve.now/CVE-2003-1332.md): Stack-based buffer overflow in the reply\_nttrans function in Samba 2.2.7a and earlier allows remote attackers to execute arbitrary code… (no CVSS)
- [CVE-2007-3389](https://cve.now/CVE-2007-3389.md): Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via a crafted chunked encoding in an HTTP response… (no CVSS)
- [CVE-2007-3390](https://cve.now/CVE-2007-3390.md): Wireshark 0.99.5 and 0.10.x up to 0.10.14, when running on certain systems, allows remote attackers to cause a denial of service (crash)… (no CVSS)
- [CVE-2007-3391](https://cve.now/CVE-2007-3391.md): Wireshark 0.99.5 allows remote attackers to cause a denial of service (memory consumption) via a malformed DCP ETSI packet that triggers… (no CVSS)
- [CVE-2007-3392](https://cve.now/CVE-2007-3392.md): Wireshark before 0.99.6 allows remote attackers to cause a denial of service via malformed (1) SSL or (2) MMS packets that trigger an… (no CVSS)
- [CVE-2007-3393](https://cve.now/CVE-2007-3393.md): Off-by-one error in the DHCP/BOOTP dissector in Wireshark before 0.99.6 allows remote attackers to cause a denial of service (crash) via… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2007-06-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.