# CVEs published 2007-02-12

44 CVEs were published on February 12, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-7003](https://cve.now/CVE-2006-7003.md): PHP remote file inclusion vulnerability in admin/index.php in Fusion Polls allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2006-7004](https://cve.now/CVE-2006-7004.md): Cross-site scripting (XSS) vulnerability in email\_request.php in PSY Auction allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2006-7005](https://cve.now/CVE-2006-7005.md): SQL injection vulnerability in item.php in PSY Auction allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2006-7006](https://cve.now/CVE-2006-7006.md): PHP remote file inclusion vulnerability in upload/admin/team.php in Robin de Graff Somery 0.4.4 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-7007](https://cve.now/CVE-2006-7007.md): Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long USER command, a (no CVSS)
- [CVE-2006-7008](https://cve.now/CVE-2006-7008.md): Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it (no CVSS)
- [CVE-2006-7009](https://cve.now/CVE-2006-7009.md): Joomla! before 1.0.10 allows remote attackers to spoof the frontend submission forms, which has unknown impact and attack vectors. (no CVSS)
- [CVE-2006-7010](https://cve.now/CVE-2006-7010.md): The mosgetparam implementation in Joomla! before 1.0.10, does not set a variable's data type to integer when the variable's default value is (no CVSS)
- [CVE-2007-0886](https://cve.now/CVE-2007-0886.md): Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (application crash) and pos (no CVSS)
- [CVE-2007-0887](https://cve.now/CVE-2007-0887.md): axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial of service (NULL der (no CVSS)
- [CVE-2007-0888](https://cve.now/CVE-2007-0888.md): Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and (no CVSS)
- [CVE-2007-0889](https://cve.now/CVE-2007-0889.md): Kiwi CatTools before 3.2.0 beta uses weak encryption ("reversible encoding") for passwords, account names, and IP addresses in kiwidb-cattoo (no CVSS)
- [CVE-2007-0890](https://cve.now/CVE-2007-0890.md): Cross-site scripting (XSS) vulnerability in scripts/passwdmysql in cPanel WebHost Manager (WHM) 11.0.0 and earlier allows remote attackers t (no CVSS)
- [CVE-2007-0891](https://cve.now/CVE-2007-0891.md): Cross-site scripting (XSS) vulnerability in the GetCurrentCompletePath function in phpmyvisites.php in phpMyVisites before 2.2 allows remote (no CVSS)
- [CVE-2007-0892](https://cve.now/CVE-2007-0892.md): CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response s (no CVSS)
- [CVE-2007-0893](https://cve.now/CVE-2007-0893.md): Directory traversal vulnerability in phpMyVisites before 2.2 allows remote attackers to include arbitrary files via leading ".." sequences o (no CVSS)
- [CVE-2007-0894](https://cve.now/CVE-2007-0894.md): MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php, (2) MonoBook.dep (no CVSS)
- [CVE-2007-0770](https://cve.now/CVE-2007-0770.md): Buffer overflow in GraphicsMagick and ImageMagick allows user-assisted remote attackers to cause a denial of service and possibly execute ar (no CVSS)
- [CVE-2007-0878](https://cve.now/CVE-2007-0878.md): Unspecified vulnerability in Microsoft Internet Explorer on Windows Mobile 5.0 allows remote attackers to cause a denial of service (loss of (no CVSS)
- [CVE-2007-0879](https://cve.now/CVE-2007-0879.md): Buffer overflow in SmidgeonSoft PEBrowse Professional 8.2.1.0 allows user-assisted remote attackers to execute arbitrary code via certain ex (no CVSS)
- [CVE-2007-0880](https://cve.now/CVE-2007-0880.md): Capital Request Forms stores sensitive information under the web root with insufficient access control, which allows remote attackers to obt (no CVSS)
- [CVE-2007-0881](https://cve.now/CVE-2007-0881.md): PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-0882](https://cve.now/CVE-2007-0882.md): Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client " (no CVSS)
- [CVE-2007-0883](https://cve.now/CVE-2007-0883.md): Directory traversal vulnerability in portalgroups/portalgroups/getfile.cgi in IP3 NetAccess before firmware 4.1.9.6 allows remote attackers (no CVSS)
- [CVE-2007-0884](https://cve.now/CVE-2007-0884.md): Buffer overflow in Roaring Penguin MIMEDefang 2.59 and 2.60 allows remote attackers to cause a denial of service (application crash) and pos (no CVSS)
- [CVE-2007-0885](https://cve.now/CVE-2007-0885.md): Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote att (no CVSS)
- [CVE-2006-7001](https://cve.now/CVE-2006-7001.md): Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2006-7002](https://cve.now/CVE-2006-7002.md): Cross-site scripting (XSS) vulnerability in add\_comment.php in Wheatblog (wB) 1.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-0871](https://cve.now/CVE-2007-0871.md): Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filenam (no CVSS)
- [CVE-2007-0872](https://cve.now/CVE-2007-0872.md): Directory traversal vulnerability in the Plain Old Webserver (POW) add-on before 0.0.9 for Mozilla Firefox allows remote attackers to read a (no CVSS)
- [CVE-2007-0873](https://cve.now/CVE-2007-0873.md): nabopoll 1.1.2 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for (1) (no CVSS)
- [CVE-2007-0874](https://cve.now/CVE-2007-0874.md): Allons\_voter 1.0 allows remote attackers to bypass authentication and access certain administrative functionality via a direct request for ( (no CVSS)
- [CVE-2007-0875](https://cve.now/CVE-2007-0875.md): SQL injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS)
- [CVE-2007-0876](https://cve.now/CVE-2007-0876.md): Cross-site scripting (XSS) vulnerability in Quick Digital Image Gallery (Qdig) 1.2.9.3 and devel-20060624 allows remote attackers to inject (no CVSS)
- [CVE-2007-0877](https://cve.now/CVE-2007-0877.md): Unspecified vulnerability in March Networks DVR 3000 and 4000 Digital Video Recorders allows attackers to cause an unspecified denial of ser (no CVSS)
- [CVE-2006-6998](https://cve.now/CVE-2006-6998.md): install/loader\_help.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERY\_STR (no CVSS)
- [CVE-2006-6999](https://cve.now/CVE-2006-6999.md): attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified (no CVSS)
- [CVE-2006-7000](https://cve.now/CVE-2006-7000.md): Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to (1) email/mail.php, (2) includes/init.php (no CVSS)
- [CVE-2005-4828](https://cve.now/CVE-2005-4828.md): Kolab Server 2.0.0 and 2.0.1 does not properly handle when a large email is sent with a "." in the wrong place, which causes kolabfilter to (no CVSS)
- [CVE-2006-6993](https://cve.now/CVE-2006-6993.md): Multiple SQL injection vulnerabilities in pages/addcomment2.php in Neuron Blog 1.1 allow remote attackers to inject arbitrary SQL commands v (no CVSS)
- [CVE-2006-6994](https://cve.now/CVE-2006-6994.md): Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execu (no CVSS)
- [CVE-2006-6995](https://cve.now/CVE-2006-6995.md): mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter. (no CVSS)
- [CVE-2006-6996](https://cve.now/CVE-2006-6996.md): Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via (no CVSS)
- [CVE-2006-6997](https://cve.now/CVE-2006-6997.md): Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enter (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.