# CVEs published 2007-02-21

50 CVEs were published on February 21, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1050](https://cve.now/CVE-2007-1050.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in AbleDesign MyCalendar allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2007-1051](https://cve.now/CVE-2007-1051.md): Comodo Firewall Pro (formerly Comodo Personal Firewall) 2.4.17.183 and earlier uses a weak cryptographic hashing function (CRC32) to identif (no CVSS)
- [CVE-2007-1052](https://cve.now/CVE-2007-1052.md): PHP remote file inclusion vulnerability in index.php in PBLang (PBL) 4.60 and earlier allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-1053](https://cve.now/CVE-2007-1053.md): Multiple PHP remote file inclusion vulnerabilities in phpXmms 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the tcmd (no CVSS)
- [CVE-2007-1054](https://cve.now/CVE-2007-1054.md): Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, all (no CVSS)
- [CVE-2007-1055](https://cve.now/CVE-2007-1055.md): Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows (no CVSS)
- [CVE-2007-1056](https://cve.now/CVE-2007-1056.md): VMware Workstation 5.5.3 build 34685 does not provide per-user restrictions on certain privileged actions, which allows local users to perfo (no CVSS)
- [CVE-2007-1057](https://cve.now/CVE-2007-1057.md): The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and exec (no CVSS)
- [CVE-2007-1058](https://cve.now/CVE-2007-1058.md): SQL injection vulnerability in user\_pages/page.asp in Online Web Building 2.0 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-1037](https://cve.now/CVE-2007-1037.md): Stack-based buffer overflow in News File Grabber 4.1.0.1 and earlier allows remote attackers to execute arbitrary code via a .nzb file with (no CVSS)
- [CVE-2007-1038](https://cve.now/CVE-2007-1038.md): Shemes.com Grabit 1.5.3, and possibly earlier, allows remote attackers to cause a denial of service (application crash) via a .nzb file with (no CVSS)
- [CVE-2007-1039](https://cve.now/CVE-2007-1039.md): Unspecified vulnerability in Peanut Knowledge Base (PeanutKB) 0.0.3 and earlier has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-1040](https://cve.now/CVE-2007-1040.md): Directory traversal vulnerability in archives.php in Xpression News (X-News) 1.0.1 allows remote attackers to include arbitrary files or obt (no CVSS)
- [CVE-2007-1041](https://cve.now/CVE-2007-1041.md): Multiple stack-based buffer overflows in S&H Computer Systems News Rover 12.1 Rev 1 allow remote attackers to execute arbitrary code via a . (no CVSS)
- [CVE-2007-1042](https://cve.now/CVE-2007-1042.md): Directory traversal vulnerability in news.php in Xpression News (X-News) 1.0.1, when magic\_quotes\_gpc is disabled, allows remote attackers t (no CVSS)
- [CVE-2007-1043](https://cve.now/CVE-2007-1043.md): Ezboo webstats, possibly 3.0.3, allows remote attackers to bypass authentication and gain access via a direct request to (1) update.php and (no CVSS)
- [CVE-2007-1044](https://cve.now/CVE-2007-1044.md): Pearson Education PowerSchool 4.3.6 allows remote attackers to list the contents of the admin folder via a URI composed of the admin/ direct (no CVSS)
- [CVE-2007-1045](https://cve.now/CVE-2007-1045.md): mAlbum 0.3 has default accounts (1) "login"/"pass" for its administrative account and (2) "dqsfg"/"sdfg", which allows remote attackers to g (no CVSS)
- [CVE-2007-1046](https://cve.now/CVE-2007-1046.md): Dem\_trac allows remote attackers to read log file contents via a direct request for /anc\_sit.txt. (no CVSS)
- [CVE-2007-1047](https://cve.now/CVE-2007-1047.md): Unspecified vulnerability in Distributed Checksum Clearinghouse (DCC) before 1.3.51 allows remote attackers to delete or add hosts in /var/d (no CVSS)
- [CVE-2007-1048](https://cve.now/CVE-2007-1048.md): PHP remote file inclusion vulnerability in admin\_rebuild\_search.php in phpbb\_wordsearch allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2007-1049](https://cve.now/CVE-2007-1049.md): Cross-site scripting (XSS) vulnerability in the wp\_explain\_nonce function in the nonce AYS functionality (wp-includes/functions.php) for Wor (no CVSS)
- [CVE-2007-1010](https://cve.now/CVE-2007-1010.md): Multiple PHP remote file inclusion vulnerabilities in ZebraFeeds 1.0, when register\_globals is enabled, allow remote attackers to execute ar (no CVSS)
- [CVE-2007-1011](https://cve.now/CVE-2007-1011.md): PHP remote file inclusion vulnerability in functions\_inc.php in VS-Gastebuch 1.5.3 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-1012](https://cve.now/CVE-2007-1012.md): Cross-site scripting (XSS) vulnerability in faq.php in DeskPRO 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-1013](https://cve.now/CVE-2007-1013.md): PHP remote file inclusion vulnerability in generate.php in VirtualSystem Htaccess Passwort Generator 1.1 allows remote attackers to execute (no CVSS)
- [CVE-2007-1014](https://cve.now/CVE-2007-1014.md): Stack-based buffer overflow in VicFTPS before 5.0 allows remote attackers to cause a denial of service (application crash) and possibly exec (no CVSS)
- [CVE-2007-1015](https://cve.now/CVE-2007-1015.md): SQL injection vulnerability in HaberDetay.asp in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2007-1016](https://cve.now/CVE-2007-1016.md): SQL injection vulnerability in Aktueldownload Haber script allows remote attackers to execute arbitrary SQL commands via certain vectors rel (no CVSS)
- [CVE-2007-1017](https://cve.now/CVE-2007-1017.md): PHP remote file inclusion vulnerability in show\_news\_inc.php in VirtualSystem VS-News-System 1.2.1 and earlier allows remote attackers to ex (no CVSS)
- [CVE-2007-1018](https://cve.now/CVE-2007-1018.md): PHP remote file inclusion vulnerability in tpl/header.php in VirtualSystem VS-News-System 1.2.1 and earlier, when register\_globals is enable (no CVSS)
- [CVE-2007-1019](https://cve.now/CVE-2007-1019.md): SQL injection vulnerability in news.php in webSPELL 4.01.02, when register\_globals is enabled, allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-1020](https://cve.now/CVE-2007-1020.md): Cross-site scripting (XSS) vulnerability in index.php in CedStat 1.31 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-1021](https://cve.now/CVE-2007-1021.md): SQL injection vulnerability in inc\_listnews.asp in CodeAvalanche News 1.x allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-1022](https://cve.now/CVE-2007-1022.md): SQL injection vulnerability in h\_goster.asp in Turuncu Portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id param (no CVSS)
- [CVE-2007-1023](https://cve.now/CVE-2007-1023.md): SQL injection vulnerability in pop\_profile.asp in Snitz Forums 2000 3.1 SR4 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2007-1024](https://cve.now/CVE-2007-1024.md): PHP remote file inclusion vulnerability in include.php in Meganoide's news 1.1.1 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-1025](https://cve.now/CVE-2007-1025.md): PHP remote file inclusion vulnerability in inc/functions\_inc.php in VS-Link-Partner 2.1 and earlier allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-1026](https://cve.now/CVE-2007-1026.md): SQL injection vulnerability in view.php in XLAtunes 0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the album (no CVSS)
- [CVE-2007-1027](https://cve.now/CVE-2007-1027.md): Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink a (no CVSS)
- [CVE-2007-1028](https://cve.now/CVE-2007-1028.md): Cross-site scripting (XSS) vulnerability in the Barry Jaspan Image Pager 4.7.x-1.x-dev and 5.x-1.x-dev before 2007-02-08 module for Drupal a (no CVSS)
- [CVE-2007-1029](https://cve.now/CVE-2007-1029.md): Stack-based buffer overflow in the Connect method in the IMAP4 component in Quiksoft EasyMail Objects before 6.5 allows remote attackers to (no CVSS)
- [CVE-2007-1030](https://cve.now/CVE-2007-1030.md): Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a labe (no CVSS)
- [CVE-2007-1031](https://cve.now/CVE-2007-1031.md): Directory traversal vulnerability in include/db\_conn.php in SpoonLabs Vivvo Article Management CMS 3.4 allows remote attackers to include an (no CVSS)
- [CVE-2007-1032](https://cve.now/CVE-2007-1032.md): Unspecified vulnerability in phpMyFAQ 1.6.9 and earlier, when register\_globals is enabled, allows remote attackers to "gain the privilege fo (no CVSS)
- [CVE-2007-1033](https://cve.now/CVE-2007-1033.md): Unspecified vulnerability in the Secure site 4.7.x-1.x-dev and 5.x-1.x-dev module for Drupal allows remote attackers to bypass access restri (no CVSS)
- [CVE-2007-1034](https://cve.now/CVE-2007-1034.md): SQL injection vulnerability in the category file in modules.php in the Emporium 2.3.0 and earlier module for PHP-Nuke allows remote attacker (no CVSS)
- [CVE-2007-1035](https://cve.now/CVE-2007-1035.md): Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows r (no CVSS)
- [CVE-2007-1036](https://cve.now/CVE-2007-1036.md): The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attack (no CVSS)
- [CVE-2007-1070](https://cve.now/CVE-2007-1070.md): Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62, (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.