# CVEs published 2007-01-23

44 CVEs were published on January 23, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-0003](https://cve.now/CVE-2007-0003.md): pam\_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or / (no CVSS)
- [CVE-2007-0449](https://cve.now/CVE-2007-0449.md): Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r (no CVSS)
- [CVE-2007-0441](https://cve.now/CVE-2007-0441.md): Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2007-0442](https://cve.now/CVE-2007-0442.md): Unspecified vulnerability in IBM OS/400 R530 and R535 has unknown impact and remote attack vectors, related to an "Integrity Problem" involv (no CVSS)
- [CVE-2006-6946](https://cve.now/CVE-2006-6946.md): The web server in the NEC MultiWriter 1700C allows remote attackers to modify the device configuration via unspecified vectors. (no CVSS)
- [CVE-2006-6947](https://cve.now/CVE-2006-6947.md): The FTP server in the NEC MultiWriter 1700C allows remote attackers to redirect traffic to other sites (aka FTP bounce) via the PORT command (no CVSS)
- [CVE-2006-6948](https://cve.now/CVE-2006-6948.md): MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.50.25 allows remote attackers to cause a denial of service via a certain string i (no CVSS)
- [CVE-2006-6949](https://cve.now/CVE-2006-6949.md): Conti FTPServer 1.0 Build 2.8 stores user passwords in cleartext in MyServerSettings.ini, which allows local users to obtain sensitive infor (no CVSS)
- [CVE-2006-6950](https://cve.now/CVE-2006-6950.md): Directory traversal vulnerability in Conti FTPServer 1.0 Build 2.8 allows remote attackers to read arbitrary files and list arbitrary direct (no CVSS)
- [CVE-2006-6951](https://cve.now/CVE-2006-6951.md): Cross-site scripting (XSS) vulnerability in blog.php in OdysseusBlog allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-0428](https://cve.now/CVE-2007-0428.md): Unspecified vulnerability in the chtbl\_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2007-0429](https://cve.now/CVE-2007-0429.md): DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2007-0430](https://cve.now/CVE-2007-0430.md): The shared\_region\_map\_file\_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial of service (memory c (no CVSS)
- [CVE-2007-0431](https://cve.now/CVE-2007-0431.md): AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP application crash) via a z (no CVSS)
- [CVE-2007-0432](https://cve.now/CVE-2007-0432.md): BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote (no CVSS)
- [CVE-2007-0433](https://cve.now/CVE-2007-0433.md): Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Director (no CVSS)
- [CVE-2007-0434](https://cve.now/CVE-2007-0434.md): BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events (no CVSS)
- [CVE-2007-0435](https://cve.now/CVE-2007-0435.md): T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TE (no CVSS)
- [CVE-2007-0021](https://cve.now/CVE-2007-0021.md): Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and applicat (no CVSS)
- [CVE-2007-0022](https://cve.now/CVE-2007-0022.md): Untrusted search path vulnerability in writeconfig in Apple Mac OS X 10.4.8 allows local users to gain privileges via a modified PATH that p (no CVSS)
- [CVE-2007-0404](https://cve.now/CVE-2007-0404.md): bin/compile-messages.py in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, wh (no CVSS, django)
- [CVE-2007-0405](https://cve.now/CVE-2007-0405.md): The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remot (no CVSS, django)
- [CVE-2007-0406](https://cve.now/CVE-2007-0406.md): Multiple buffer overflows in the (1) main function in (a) client.c, and the (2) server\_setup and (3) server\_client\_connect functions in (b) (no CVSS)
- [CVE-2007-0407](https://cve.now/CVE-2007-0407.md): Cross-site scripting (XSS) vulnerability in Operation/User.pm in Plain Black WebGUI before 7.3.5 (beta) allows remote attackers to inject ar (no CVSS)
- [CVE-2007-0408](https://cve.now/CVE-2007-0408.md): BEA Weblogic Server 8.1 through 8.1 SP4 does not properly validate client certificates when reusing cached connections, which allows remote (no CVSS)
- [CVE-2007-0409](https://cve.now/CVE-2007-0409.md): BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP4, and 9.0 initial release does not encrypt passwords stored in the JDBCDataSourceFactor (no CVSS)
- [CVE-2007-0410](https://cve.now/CVE-2007-0410.md): Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentic (no CVSS)
- [CVE-2007-0411](https://cve.now/CVE-2007-0411.md): BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which al (no CVSS)
- [CVE-2007-0412](https://cve.now/CVE-2007-0412.md): BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside (no CVSS)
- [CVE-2007-0413](https://cve.now/CVE-2007-0413.md): BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to o (no CVSS)
- [CVE-2007-0414](https://cve.now/CVE-2007-0414.md): BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2007-0415](https://cve.now/CVE-2007-0415.md): BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an appli (no CVSS)
- [CVE-2007-0416](https://cve.now/CVE-2007-0416.md): The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which (no CVSS)
- [CVE-2007-0417](https://cve.now/CVE-2007-0417.md): BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows a (no CVSS)
- [CVE-2007-0418](https://cve.now/CVE-2007-0418.md): BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for (no CVSS)
- [CVE-2007-0419](https://cve.now/CVE-2007-0419.md): The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows rem (no CVSS)
- [CVE-2007-0420](https://cve.now/CVE-2007-0420.md): BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal (no CVSS)
- [CVE-2007-0421](https://cve.now/CVE-2007-0421.md): BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via (no CVSS)
- [CVE-2007-0422](https://cve.now/CVE-2007-0422.md): BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccess (no CVSS)
- [CVE-2007-0423](https://cve.now/CVE-2007-0423.md): BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which causes other role entitlements (no CVSS)
- [CVE-2007-0424](https://cve.now/CVE-2007-0424.md): Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterpr (no CVSS)
- [CVE-2007-0425](https://cve.now/CVE-2007-0425.md): Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to g (no CVSS)
- [CVE-2007-0426](https://cve.now/CVE-2007-0426.md): BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propa (no CVSS)
- [CVE-2007-0427](https://cve.now/CVE-2007-0427.md): Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.