# CVEs published 2007-03-03

45 CVEs were published on March 3, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2005-1730](https://cve.now/CVE-2005-1730.md): Multiple vulnerabilities in the OpenSSL ASN.1 parser, as used in Novell iManager 2.0.2, allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2006-7100](https://cve.now/CVE-2006-7100.md): PHP remote file inclusion vulnerability in includes/functions\_mod\_user.php in phpBB Insert User 0.1.2 and earlier allows remote attackers to (no CVSS)
- [CVE-2006-7101](https://cve.now/CVE-2006-7101.md): SQL injection vulnerability in admin.php in PHPWind 5.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the Admi (no CVSS)
- [CVE-2006-7102](https://cve.now/CVE-2006-7102.md): Multiple PHP remote file inclusion vulnerabilities in phpBurningPortal quiz-modul 1.0.1, and possibly earlier, allow remote attackers to exe (no CVSS)
- [CVE-2006-7103](https://cve.now/CVE-2006-7103.md): Multiple directory traversal vulnerabilities in EZOnlineGallery 1.3 and earlier, and possibly other versions before 1.3.2 Beta, allow remote (no CVSS)
- [CVE-2006-7104](https://cve.now/CVE-2006-7104.md): PHP remote file inclusion vulnerability in htmltemplate.php in the Chad Auld MOStlyContent Editor (MOStlyCE) as created on May 2006, a compo (no CVSS)
- [CVE-2006-7105](https://cve.now/CVE-2006-7105.md): PHP remote file inclusion vulnerability in libs/Smarty.class.php in Smarty 2.6.9 allows remote attackers to execute arbitrary PHP code via a (CVSS 9.8)
- [CVE-2006-7106](https://cve.now/CVE-2006-7106.md): PHP remote file inclusion vulnerability in config.inc.php3 in Power Phlogger 2.0.9 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-7107](https://cve.now/CVE-2006-7107.md): PHP remote file inclusion vulnerability in upgrade.php in Coalescent Systems freePBX 2.1.3 allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-1260](https://cve.now/CVE-2007-1260.md): Stack-based buffer overflow in the connectHandle function in server.cpp in WebMod 0.48 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2007-1261](https://cve.now/CVE-2007-1261.md): Unspecified vulnerability in the reports system in OpenBiblio before 0.6.0 allows attackers to gain privileges via unspecified vectors. (no CVSS)
- [CVE-2005-4832](https://cve.now/CVE-2005-4832.md): SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with eleva (no CVSS)
- [CVE-2007-1247](https://cve.now/CVE-2007-1247.md): Multiple PHP remote file inclusion vulnerabilities in aWeb Labs aWebNews 1.5 allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-1248](https://cve.now/CVE-2007-1248.md): Multiple cross-site scripting (XSS) vulnerabilities in built2go News Manager Blog 1.0 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-1249](https://cve.now/CVE-2007-1249.md): MoveSortedContentAction in C1 Financial Services Contelligent 9.1.4 does not check "the additional environment security configuration," whic (no CVSS)
- [CVE-2007-1250](https://cve.now/CVE-2007-1250.md): SQL injection vulnerability in section/default.asp in ANGEL Learning Management Suite (LMS) 7.1 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-1251](https://cve.now/CVE-2007-1251.md): Format string vulnerability in the new\_warning function in ntserv/warning.c for Netrek Vanilla Server 2.12.0, when EVENTLOG is enabled, allo (no CVSS)
- [CVE-2007-1252](https://cve.now/CVE-2007-1252.md): Buffer overflow in Symantec Mail Security for SMTP 5.0 before Patch 175 allows remote attackers to cause a denial of service (crash) and pos (no CVSS)
- [CVE-2007-1253](https://cve.now/CVE-2007-1253.md): Eval injection vulnerability in the (a) kmz\_ImportWithMesh.py Script for Blender 0.1.9h, as used in (b) Blender before 2.43, allows user-ass (no CVSS)
- [CVE-2007-1254](https://cve.now/CVE-2007-1254.md): SQL injection vulnerability in part.userprofile.php in Connectix Boards 0.7 and earlier allows remote authenticated users to execute arbitra (no CVSS)
- [CVE-2007-1255](https://cve.now/CVE-2007-1255.md): Unrestricted file upload vulnerability in admin.bbcode.php in Connectix Boards 0.7 and earlier allows remote authenticated administrators to (no CVSS)
- [CVE-2007-1256](https://cve.now/CVE-2007-1256.md): Mozilla Firefox 2.0.0.2 allows remote attackers to spoof the address bar, favicons, and document source, and perform updates in the context (no CVSS)
- [CVE-2007-1257](https://cve.now/CVE-2007-1257.md): The Network Analysis Module (NAM) in Cisco Catalyst Series 6000, 6500, and 7600 allows remote attackers to execute arbitrary commands via ce (no CVSS)
- [CVE-2007-1258](https://cve.now/CVE-2007-1258.md): Unspecified vulnerability in Cisco IOS 12.2SXA, SXB, SXD, and SXF; and the MSFC2, MSFC2a and MSFC3 running in Hybrid Mode on Cisco Catalyst (no CVSS)
- [CVE-2007-1259](https://cve.now/CVE-2007-1259.md): Multiple unspecified vulnerabilities in WebAPP before 0.9.9.6 have unknown impact and attack vectors. (no CVSS)
- [CVE-2005-4830](https://cve.now/CVE-2005-4830.md): CRLF injection vulnerability in viewcvs in ViewCVS 0.9.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response (no CVSS)
- [CVE-2005-4831](https://cve.now/CVE-2005-4831.md): viewcvs in ViewCVS 0.9.2 allows remote attackers to set the Content-Type header to arbitrary values via the content-type parameter, which ca (no CVSS)
- [CVE-2006-7098](https://cve.now/CVE-2006-7098.md): The Debian GNU/Linux 033\_-F\_NO\_SETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty (no CVSS)
- [CVE-2006-7099](https://cve.now/CVE-2006-7099.md): Directory traversal vulnerability in index.php in SolarPay allows remote attackers to read certain files via a .. (no CVSS)
- [CVE-2007-1231](https://cve.now/CVE-2007-1231.md): Multiple cross-site scripting (XSS) vulnerabilities in SQLiteManager 1.2.0 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-1232](https://cve.now/CVE-2007-1232.md): Directory traversal vulnerability in SQLiteManager 1.2.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-1233](https://cve.now/CVE-2007-1233.md): PHP remote file inclusion vulnerability in downloadcounter.php in STWC-Counter 3.4.0.0 and earlier allows remote attackers to execute arbitr (no CVSS)
- [CVE-2007-1234](https://cve.now/CVE-2007-1234.md): Multiple cross-site scripting (XSS) vulnerabilities in sitex allow remote attackers to inject arbitrary web script or HTML via (1) the sxYea (no CVSS)
- [CVE-2007-1235](https://cve.now/CVE-2007-1235.md): Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double ex (no CVSS)
- [CVE-2007-1236](https://cve.now/CVE-2007-1236.md): sitex allows remote attackers to obtain sensitive information via a request with a numerical value for the (1) sxMonth\[\] or (2) sxYear\[\] par (no CVSS)
- [CVE-2007-1237](https://cve.now/CVE-2007-1237.md): sitex allows remote attackers to obtain potentially sensitive information via a ' (quote) value for certain parameters, as demonstrated by p (no CVSS)
- [CVE-2007-1238](https://cve.now/CVE-2007-1238.md): Microsoft Office 2003 allows user-assisted remote attackers to cause a denial of service (application crash) by attempting to insert a corru (no CVSS)
- [CVE-2007-1239](https://cve.now/CVE-2007-1239.md): Microsoft Excel 2003 does not properly parse .XLS files, which allows remote attackers to cause a denial of service (application crash) via (no CVSS)
- [CVE-2007-1240](https://cve.now/CVE-2007-1240.md): Multiple cross-site scripting (XSS) vulnerabilities in Docebo CMS 3.0.3 through 3.0.5 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-1241](https://cve.now/CVE-2007-1241.md): Cross-site scripting (XSS) vulnerability in setup.php in Audins Audiens 3.3 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2007-1242](https://cve.now/CVE-2007-1242.md): SQL injection vulnerability in system/index.php in Audins Audiens 3.3 allows remote attackers to execute arbitrary SQL commands via the PHPS (no CVSS)
- [CVE-2007-1243](https://cve.now/CVE-2007-1243.md): Audins Audiens 3.3 allows remote attackers to bypass authentication and perform certain privileged actions, possibly an uninstall of the pro (no CVSS)
- [CVE-2007-1244](https://cve.now/CVE-2007-1244.md): Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileg (no CVSS)
- [CVE-2007-1245](https://cve.now/CVE-2007-1245.md): IrfanView 3.99 allows remote attackers to cause a denial of service (application crash) via a malformed WMF file. (no CVSS)
- [CVE-2007-1246](https://cve.now/CVE-2007-1246.md): The DMO\_VideoDecoder\_Open function in loader/dmo/DMO\_VideoDecoder.c in MPlayer 1.0rc1 and earlier, as used in xine-lib, does not set the biS (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.