# CVEs published 2007-01-31

37 CVEs were published on January 31, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-0634](https://cve.now/CVE-2007-0634.md): Unspecified vulnerability in Sun Solaris 10 before 20070130 allows remote attackers to cause a denial of service (system crash) via certain (no CVSS)
- [CVE-2007-0635](https://cve.now/CVE-2007-0635.md): Multiple PHP remote file inclusion vulnerabilities in EncapsCMS 0.3.6 allow remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2007-0636](https://cve.now/CVE-2007-0636.md): Unspecified vulnerability in inotify before 0.3.5 has unknown impact and attack vectors, related to "access rights to watched files." (no CVSS)
- [CVE-2007-0637](https://cve.now/CVE-2007-0637.md): Directory traversal vulnerability in zd\_numer.php in Galeria Zdjec 3.0 and earlier allows remote attackers to include and execute arbitrary (no CVSS)
- [CVE-2007-0638](https://cve.now/CVE-2007-0638.md): show.php in Vlad Alexa Mancini PHPFootball 1.6 allows remote attackers to obtain sensitive information (database contents) via a % (percent) (no CVSS)
- [CVE-2007-0639](https://cve.now/CVE-2007-0639.md): Multiple static code injection vulnerabilities in error.php in GuppY 4.5.16 and earlier allow remote attackers to inject arbitrary PHP code (no CVSS)
- [CVE-2007-0640](https://cve.now/CVE-2007-0640.md): Buffer overflow in ZABBIX before 1.1.5 has unknown impact and attack vectors related to "SNMP IP addresses." (no CVSS)
- [CVE-2007-0641](https://cve.now/CVE-2007-0641.md): Buffer overflow in the EnumPrintersA function in dapcnfsd.dll 0.6.4.0 in Shaffer Solutions (SSC) DiskAccess NFS Client allows remote attacke (no CVSS)
- [CVE-2007-0642](https://cve.now/CVE-2007-0642.md): SQL injection vulnerability in tForum 2.00 in the Raymond BERTHOU script collection (aka RBL - ASP) allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-0643](https://cve.now/CVE-2007-0643.md): Stack-based buffer overflow in Bloodshed Dev-C++ 4.9.9.2 allows user-assisted remote attackers to cause a denial of service (application cra (no CVSS)
- [CVE-2007-0622](https://cve.now/CVE-2007-0622.md): Cross-site request forgery (CSRF) vulnerability in MyBB (aka MyBulletinBoard) 1.2.2 allows remote attackers to send messages to arbitrary us (no CVSS)
- [CVE-2007-0623](https://cve.now/CVE-2007-0623.md): SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow p (no CVSS)
- [CVE-2007-0624](https://cve.now/CVE-2007-0624.md): user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' (quote) character, and possibly other invalid values (no CVSS)
- [CVE-2007-0625](https://cve.now/CVE-2007-0625.md): nxconfigure.sh in NoMachine NX Server before 2.1.0-18 does not validate the invoking user, which allows local users to modify server configu (no CVSS)
- [CVE-2007-0626](https://cve.now/CVE-2007-0626.md): The comment\_form\_add\_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers wi (no CVSS)
- [CVE-2007-0627](https://cve.now/CVE-2007-0627.md): Michael Still gtalkbot before 1.2 places username and password arguments on the command line, which allows local users to obtain sensitive i (no CVSS)
- [CVE-2007-0628](https://cve.now/CVE-2007-0628.md): Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Access Manager 6.1, 6.2, 6 2005Q1 (6.3), and 7 2005Q4 (7.0) before 20 (no CVSS)
- [CVE-2007-0629](https://cve.now/CVE-2007-0629.md): The www\_purgeList method in Plain Black WebGUI before 7.3.8 does not properly check user permissions, which allows attackers to delete unaut (no CVSS)
- [CVE-2007-0630](https://cve.now/CVE-2007-0630.md): Multiple SQL injection vulnerabilities in the generate\_csv function in classes/class.news.php in X-dev xNews 1.3 and earlier allow remote at (no CVSS)
- [CVE-2007-0631](https://cve.now/CVE-2007-0631.md): SQL injection vulnerability in index.php in Eclectic Designs CascadianFAQ 4.1 and earlier allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2007-0632](https://cve.now/CVE-2007-0632.md): SQL injection vulnerability in artreplydelete.asp in ASP EDGE 1.3a and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-0633](https://cve.now/CVE-2007-0633.md): PHP remote file inclusion vulnerability in include/themes/themefunc.php in MyNews 4.2.2 and earlier allows remote attackers to execute arbit (no CVSS)
- [CVE-2005-4826](https://cve.now/CVE-2005-4826.md): Unspecified vulnerability in the VLAN Trunking Protocol (VTP) feature in Cisco IOS 12.1(22)EA3 on Catalyst 2950T switches allows remote atta (no CVSS)
- [CVE-2007-0612](https://cve.now/CVE-2007-0612.md): Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Expl (no CVSS)
- [CVE-2007-0613](https://cve.now/CVE-2007-0613.md): The Bonjour functionality in mDNSResponder, iChat 3.1.6, and InstantMessage framework 428 in Apple Mac OS X 10.4.8 does not check for duplic (no CVSS)
- [CVE-2007-0614](https://cve.now/CVE-2007-0614.md): The Bonjour functionality in mDNSResponder, iChat 3.1.6, and InstantMessage framework 428 in Apple Mac OS X 10.4.8 allows remote attackers t (no CVSS)
- [CVE-2007-0615](https://cve.now/CVE-2007-0615.md): Unspecified vulnerability in Hitachi JP1/HIBUN Advanced Edition Management Server and Log Server before 20070124 allows remote attackers to (no CVSS)
- [CVE-2007-0616](https://cve.now/CVE-2007-0616.md): Directory traversal vulnerability in zen/template-functions.php in zenphoto 1.0.4 up to 1.0.6 allows remote attackers to list arbitrary dire (no CVSS)
- [CVE-2007-0617](https://cve.now/CVE-2007-0617.md): The SpamBlocker.dll ActiveX control in Earthlink TotalAccess is marked "safe for scripting," which allows remote attackers to add arbitrary (no CVSS)
- [CVE-2007-0618](https://cve.now/CVE-2007-0618.md): Unspecified vulnerability in (1) pop3d, (2) pop3ds, (3) imapd, and (4) imapds in IBM AIX 5.3.0 has unspecified impact and attack vectors, in (no CVSS)
- [CVE-2007-0619](https://cve.now/CVE-2007-0619.md): chmlib before 0.39 allows user-assisted remote attackers to execute arbitrary code via a crafted page block length in a CHM file, which trig (no CVSS)
- [CVE-2007-0620](https://cve.now/CVE-2007-0620.md): download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensi (no CVSS)
- [CVE-2007-0467](https://cve.now/CVE-2007-0467.md): crashdump in Apple Mac OS X 10.4.8 allows local users in the admin group to modify arbitrary files or gain privileges via a symlink attack o (no CVSS)
- [CVE-2007-0465](https://cve.now/CVE-2007-0465.md): Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2007-0466](https://cve.now/CVE-2007-0466.md): Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF\_File (no CVSS)
- [CVE-2007-0610](https://cve.now/CVE-2007-0610.md): Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-0611](https://cve.now/CVE-2007-0611.md): Multiple cross-site scripting (XSS) vulnerabilities in Free LAN In(tra|ter)net Portal (FLIP) before 1.0-RC2 allow remote attackers to inject (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.