# CVEs published 2007-03-07

60 CVEs were published on March 7, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1338](https://cve.now/CVE-2007-1338.md): The default configuration of the AirPort utility in Apple AirPort Extreme creates an IPv6 tunnel but does not enable the "Block incoming IPv (no CVSS)
- [CVE-2006-7162](https://cve.now/CVE-2006-7162.md): PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs creat (no CVSS)
- [CVE-2007-1324](https://cve.now/CVE-2007-1324.md): SnapGear 560, 585, 580, 640, 710, and 720 appliances before the 3.1.4u5 firmware allow remote attackers to cause a denial of service (comple (no CVSS)
- [CVE-2007-1325](https://cve.now/CVE-2007-1325.md): The PMA\_ArrayWalkRecursive function in libraries/common.lib.php in phpMyAdmin before 2.10.0.2 does not limit recursion on arrays provided by (no CVSS)
- [CVE-2007-1326](https://cve.now/CVE-2007-1326.md): SQL injection vulnerability in index.php in Serendipity 1.1.1 allows remote attackers to execute arbitrary SQL commands via the serendipity\[ (no CVSS)
- [CVE-2007-1327](https://cve.now/CVE-2007-1327.md): The SILC\_SERVER\_CMD\_FUNC function in apps/silcd/command.c in silc-server 1.0.2 allows remote attackers to cause a denial of service (NULL de (no CVSS)
- [CVE-2007-1328](https://cve.now/CVE-2007-1328.md): Cross-site scripting (XSS) vulnerability in formulaire.php in Bernard JOLY BJ Webring allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-1329](https://cve.now/CVE-2007-1329.md): Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows remote attackers to read and overwrite arbitrary files, (no CVSS)
- [CVE-2007-1330](https://cve.now/CVE-2007-1330.md): Comodo Firewall Pro (CFP) (formerly Comodo Personal Firewall) 2.4.18.184 and earlier allows local users to bypass driver protections on the (no CVSS)
- [CVE-2007-1331](https://cve.now/CVE-2007-1331.md): Multiple cross-site scripting (XSS) vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-1332](https://cve.now/CVE-2007-1332.md): Multiple cross-site request forgery (CSRF) vulnerabilities in TKS Banking Solutions ePortfolio 1.0 Java allow remote attackers to perform un (no CVSS)
- [CVE-2006-7138](https://cve.now/CVE-2006-7138.md): SQL injection vulnerability in wwv\_flow\_utilities.gen\_popup\_list in the WWV\_FLOW\_UTILITIES package for Oracle APEX/HTMLDB before 2.2 allows (no CVSS)
- [CVE-2006-7139](https://cve.now/CVE-2006-7139.md): Kmail 1.9.1 on KDE 3.5.2, with "Prefer HTML to Plain Text" enabled, allows remote attackers to cause a denial of service (crash) via an HTML (no CVSS)
- [CVE-2006-7140](https://cve.now/CVE-2006-7140.md): The libike library, as used by in.iked, elfsign, and kcfd in Sun Solaris 9 and 10, when using an RSA key with exponent 3, removes PKCS-1 pad (no CVSS)
- [CVE-2006-7141](https://cve.now/CVE-2006-7141.md): Absolute path traversal vulnerability in Oracle Database Server, when utl\_file\_dir is set to a wildcard value or "CREATE ANY DIRECTORY to PU (no CVSS)
- [CVE-2006-7142](https://cve.now/CVE-2006-7142.md): The centralized management feature for Utimaco Safeguard stores hard-coded cryptographic keys in executable programs for encrypted configura (no CVSS)
- [CVE-2006-7143](https://cve.now/CVE-2006-7143.md): Cross-site scripting (XSS) vulnerability in Call Center Software 0.93 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-7144](https://cve.now/CVE-2006-7144.md): SQL injection vulnerability in Call Center Software 0.93 and earlier allows remote attackers to execute arbitrary SQL commands and bypass au (no CVSS)
- [CVE-2006-7145](https://cve.now/CVE-2006-7145.md): edit\_user.php in Call Center Software 0.93 and earlier allows remote attackers to obtain sensitive information such as account passwords via (no CVSS)
- [CVE-2006-7146](https://cve.now/CVE-2006-7146.md): PHP remote file inclusion vulnerability in bug.php in Leicestershire communityPortals 1.0 build 20051018 and earlier allows remote attackers (no CVSS)
- [CVE-2006-7147](https://cve.now/CVE-2006-7147.md): PHP remote file inclusion vulnerability in includes/functions\_mod\_user.php in phpBB Import Tools Mod 0.1.4 and earlier allows remote attacke (no CVSS)
- [CVE-2006-7148](https://cve.now/CVE-2006-7148.md): PHP remote file inclusion vulnerability in includes/bb\_usage\_stats.php in maluinfo 206.2.38 for Brazilian PHPBB allows remote attackers to e (no CVSS)
- [CVE-2006-7149](https://cve.now/CVE-2006-7149.md): Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the (no CVSS)
- [CVE-2006-7150](https://cve.now/CVE-2006-7150.md): Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to ( (no CVSS)
- [CVE-2006-7151](https://cve.now/CVE-2006-7151.md): Untrusted search path vulnerability in the libtool-ltdl library (libltdl.so) 1.5.22-2.3 in Fedora Core 5 might allow local users to execute (no CVSS)
- [CVE-2006-7152](https://cve.now/CVE-2006-7152.md): default.asp in ASP-Nuke Community 1.5 and earlier allows remote attackers to gain privileges by setting certain pseudo cookie values. (no CVSS)
- [CVE-2006-7153](https://cve.now/CVE-2006-7153.md): PHP remote file inclusion vulnerability in index.php in MiniBB Forum 2 allows remote attackers to execute arbitrary code via a URL in the pa (no CVSS)
- [CVE-2006-7154](https://cve.now/CVE-2006-7154.md): Iono allows remote attackers to obtain the full server path via certain requests to (1) templates/iono/admin/denied.tpl.php, (2) templates/i (no CVSS)
- [CVE-2006-7155](https://cve.now/CVE-2006-7155.md): Novell BorderManager 3.8 SP4 generates the same ISAKMP cookies for the same source IP and port number during the same day, which allows remo (no CVSS)
- [CVE-2006-7156](https://cve.now/CVE-2006-7156.md): PHP remote file inclusion vulnerability in addon\_keywords.php in Keyword Replacer (keyword\_replacer) 1.0 and earlier, a module for miniBB, a (no CVSS)
- [CVE-2006-7157](https://cve.now/CVE-2006-7157.md): Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ (no CVSS)
- [CVE-2006-7158](https://cve.now/CVE-2006-7158.md): Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to i (no CVSS)
- [CVE-2006-7159](https://cve.now/CVE-2006-7159.md): Directory traversal vulnerability in include/prune\_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbi (no CVSS)
- [CVE-2006-7160](https://cve.now/CVE-2006-7160.md): The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, whi (no CVSS)
- [CVE-2006-7161](https://cve.now/CVE-2006-7161.md): SQL injection vulnerability in giris\_yap.asp in Hazir Site 2.0 allows remote attackers to bypass authentication via the (1) k\_a class or (2) (no CVSS)
- [CVE-2006-7135](https://cve.now/CVE-2006-7135.md): PHP remote file inclusion vulnerability in lib/functions.inc.php in PHP Poll Creator (phpPC) 1.04 allows remote attackers to execute arbitra (no CVSS)
- [CVE-2006-7136](https://cve.now/CVE-2006-7136.md): Multiple PHP remote file inclusion vulnerabilities in PHP Poll Creator (phpPC) 1.04 and earlier allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-7137](https://cve.now/CVE-2006-7137.md): Cross-site scripting (XSS) vulnerability in TinyPortal before 0.8.6 allows remote attackers to inject arbitrary web script or HTML via the s (no CVSS)
- [CVE-2007-1288](https://cve.now/CVE-2007-1288.md): Multiple PHP remote file inclusion vulnerabilities in Webmobo WB News 1.4.1 and earlier allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-1289](https://cve.now/CVE-2007-1289.md): SQL injection vulnerability in ViewBugs.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2007-1290](https://cve.now/CVE-2007-1290.md): SQL injection vulnerability in ViewReport.php in Tyger Bug Tracking System (TygerBT) 1.1.3 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-1291](https://cve.now/CVE-2007-1291.md): Multiple cross-site scripting (XSS) vulnerabilities in Tyger Bug Tracking System (TygerBT) 1.1.3 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-1292](https://cve.now/CVE-2007-1292.md): SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote aut (no CVSS)
- [CVE-2007-1293](https://cve.now/CVE-2007-1293.md): SQL injection vulnerability in Rigter Portal System (RPS) 6.2, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitra (no CVSS)
- [CVE-2007-1294](https://cve.now/CVE-2007-1294.md): A certain ActiveX control in the DivXBrowserPlugin (npdivx32.dll) in DivX Web Player, as distributed with DivX Player 1.3.0, allows remote a (no CVSS)
- [CVE-2007-1295](https://cve.now/CVE-2007-1295.md): SQL injection vulnerability in topic\_title.php in AJ Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the td\_id param (no CVSS)
- [CVE-2007-1296](https://cve.now/CVE-2007-1296.md): SQL injection vulnerability in postingdetails.php in AJ Classifieds 1.0 allows remote attackers to execute arbitrary SQL commands via the po (no CVSS)
- [CVE-2007-1297](https://cve.now/CVE-2007-1297.md): SQL injection vulnerability in view\_profile.php in AJDating 1.0 allows remote attackers to execute arbitrary SQL commands via the user\_id pa (no CVSS)
- [CVE-2007-1298](https://cve.now/CVE-2007-1298.md): SQL injection vulnerability in subcat.php in AJ Auction 1.0 allows remote attackers to execute arbitrary SQL commands via the cate\_id parame (no CVSS)
- [CVE-2007-1299](https://cve.now/CVE-2007-1299.md): PHP remote file inclusion vulnerability in index.php in Mani Stats Reader 1.2 and earlier allows remote attackers to execute arbitrary PHP c (no CVSS)
- [CVE-2007-1300](https://cve.now/CVE-2007-1300.md): DOURAN Software Technologies ISPUtil 3.32.84.1, and possibly earlier versions, stores sensitive information under the web root with insuffic (no CVSS)
- [CVE-2007-1301](https://cve.now/CVE-2007-1301.md): Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authentica (no CVSS)
- [CVE-2007-1302](https://cve.now/CVE-2007-1302.md): SQL injection vulnerability in guestbook.php in LI-Guestbook 1.1, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbi (no CVSS)
- [CVE-2007-1303](https://cve.now/CVE-2007-1303.md): Directory traversal vulnerability in rb.cgi in RRDBrowse 1.6 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-1304](https://cve.now/CVE-2007-1304.md): Multiple SQL injection vulnerabilities in add2.php in Sava's Guestbook 23.11.2006, when magic\_quotes\_gpc is disabled, allow remote attackers (no CVSS)
- [CVE-2007-1305](https://cve.now/CVE-2007-1305.md): Multiple cross-site scripting (XSS) vulnerabilities in add2.php in Sava's Guestbook 23.11.2006 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2007-1306](https://cve.now/CVE-2007-1306.md): Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation (no CVSS)
- [CVE-2007-1307](https://cve.now/CVE-2007-1307.md): Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impa (no CVSS)
- [CVE-2007-1308](https://cve.now/CVE-2007-1308.md): ecma/kjs\_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause a denial of service (crash) b (no CVSS)
- [CVE-2007-1309](https://cve.now/CVE-2007-1309.md): Novell Access Management 3 SSLVPN Server allows remote authenticated users to bypass VPN restrictions by making policy.txt read-only, discon (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.