# CVEs published 2007-03-10

45 CVEs were published on March 10, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2007-1389](https://cve.now/CVE-2007-1389.md): dynaliens 2.0 and 2.1 allows remote attackers to bypass authentication and perform certain privileged actions via a direct request for (1) v (no CVSS)
- [CVE-2007-1390](https://cve.now/CVE-2007-1390.md): Multiple cross-site scripting (XSS) vulnerabilities in dynaliens 2.0 and 2.1 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2007-1391](https://cve.now/CVE-2007-1391.md): PHP remote file inclusion vulnerability in modules/abook/foldertree.php in Leo West WEBO (aka weborganizer) 1.0 allows remote attackers to e (no CVSS)
- [CVE-2007-1392](https://cve.now/CVE-2007-1392.md): Directory traversal vulnerability in down.php in netForo! 0.1g allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-1393](https://cve.now/CVE-2007-1393.md): PHP remote file inclusion vulnerability in mysave.php in Magic CMS 4.2.747 allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2007-1394](https://cve.now/CVE-2007-1394.md): Direct static code injection vulnerability in startsession.php in Flat Chat 2.0 allows remote attackers to execute arbitrary PHP code via th (no CVSS)
- [CVE-2007-1395](https://cve.now/CVE-2007-1395.md): Incomplete blacklist vulnerability in index.php in phpMyAdmin 2.8.0 through 2.9.2 allows remote attackers to conduct cross-site scripting (X (no CVSS)
- [CVE-2007-1396](https://cve.now/CVE-2007-1396.md): The import\_request\_variables function in PHP 4.0.7 through 4.4.6, and 5.x before 5.2.2, when called without a prefix, does not prevent the ( (no CVSS)
- [CVE-2007-1397](https://cve.now/CVE-2007-1397.md): Multiple stack-based buffer overflows in the (1) ExtractRnick and (2) decrypt\_topic\_332 functions in FiSH allow remote attackers to execute (no CVSS)
- [CVE-2007-1398](https://cve.now/CVE-2007-1398.md): The frag3 preprocessor in Snort 2.6.1.1, 2.6.1.2, and 2.7.0 beta, when configured for inline use on Linux without the ip\_conntrack module lo (no CVSS)
- [CVE-2007-1399](https://cve.now/CVE-2007-1399.md): Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote atta (no CVSS)
- [CVE-2007-1400](https://cve.now/CVE-2007-1400.md): Plash permits sandboxed processes to open /dev/tty, which allows local users to escape sandbox restrictions and execute arbitrary commands b (no CVSS)
- [CVE-2007-1401](https://cve.now/CVE-2007-1401.md): Buffer overflow in the crack extension (CrackLib), as bundled with PHP 4.4.6 and other versions before 5.0.0, might allow local users to gai (no CVSS)
- [CVE-2007-1402](https://cve.now/CVE-2007-1402.md): The Rediff Toolbar 2.0 ActiveX control in redifftoolbar.dll allows remote attackers to cause a denial of service via unspecified manipulatio (no CVSS)
- [CVE-2007-1403](https://cve.now/CVE-2007-1403.md): Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote attackers to cause a (no CVSS)
- [CVE-2007-1404](https://cve.now/CVE-2007-1404.md): tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not pr (no CVSS)
- [CVE-2007-1405](https://cve.now/CVE-2007-1405.md): Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explor (no CVSS, trac)
- [CVE-2007-1406](https://cve.now/CVE-2007-1406.md): Trac before 0.10.3.1 does not send a Content-Disposition HTTP header specifying an attachment in certain "unsafe" situations, which has unkn (no CVSS, trac)
- [CVE-2007-1407](https://cve.now/CVE-2007-1407.md): Unspecified vulnerability in OpenSolution Quick.Cart before 2.1 has unknown impact and attack vectors, related to a "low critical exploit." (no CVSS)
- [CVE-2007-1408](https://cve.now/CVE-2007-1408.md): Multiple vulnerabilities in (1) bank.php, (2) landfill.php, (3) outposts.php, (4) tribes.php, (5) house.php, (6) tribearmor.php, (7) tribeas (no CVSS)
- [CVE-2007-1409](https://cve.now/CVE-2007-1409.md): WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the p (no CVSS)
- [CVE-2007-1410](https://cve.now/CVE-2007-1410.md): SQL injection vulnerability in kategori.asp in GaziYapBoz Game Portal allows remote attackers to execute arbitrary SQL commands via the kate (no CVSS)
- [CVE-2007-1411](https://cve.now/CVE-2007-1411.md): Buffer overflow in PHP 4.4.6 and earlier, and unspecified PHP 5 versions, allows local and possibly remote attackers to execute arbitrary co (no CVSS)
- [CVE-2007-1365](https://cve.now/CVE-2007-1365.md): Buffer overflow in kern/uipc\_mbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets du (no CVSS)
- [CVE-2007-1273](https://cve.now/CVE-2007-1273.md): Integer overflow in the ktruser function in NetBSD-current before 20061022, NetBSD 3 and 3-0 before 20061024, and NetBSD 2 before 20070209, (no CVSS)
- [CVE-2007-0999](https://cve.now/CVE-2007-0999.md): Format string vulnerability in Ekiga 2.0.3, and probably other versions, allows remote attackers to execute arbitrary code via unspecified v (no CVSS)
- [CVE-2007-1345](https://cve.now/CVE-2007-1345.md): Unspecified vulnerability in cube.exe in the GINA component for CA (Computer Associates) eTrust Admin 8.1.0 through 8.1.2 allows attackers w (no CVSS)
- [CVE-2007-1388](https://cve.now/CVE-2007-1388.md): The do\_ipv6\_setsockopt function in net/ipv6/ipv6\_sockglue.c in Linux kernel before 2.6.20, and possibly other versions, allows local users t (no CVSS)
- [CVE-2007-1384](https://cve.now/CVE-2007-1384.md): Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.2 allows remote attackers to overwrite arbitrary files via ".." sequ (no CVSS)
- [CVE-2007-1385](https://cve.now/CVE-2007-1385.md): chunkcounter.cpp in KTorrent before 2.1.2 allows remote attackers to cause a denial of service (crash) and heap corruption via a negative or (no CVSS)
- [CVE-2006-7163](https://cve.now/CVE-2006-7163.md): DreameeSoft Password Master 1.0 stores the database in an unencrypted format when the master password is set, which allows attackers with ph (no CVSS)
- [CVE-2007-0005](https://cve.now/CVE-2007-0005.md): Multiple buffer overflows in the (1) read and (2) write handlers in the Omnikey CardMan 4040 driver in the Linux kernel before 2.6.21-rc3 al (no CVSS)
- [CVE-2007-1371](https://cve.now/CVE-2007-1371.md): Multiple buffer overflows in Conquest 8.2a and earlier (1) allow local users to gain privileges by querying a metaserver that sends a long s (no CVSS)
- [CVE-2007-1372](https://cve.now/CVE-2007-1372.md): PHP remote file inclusion vulnerability in styles/internal/header.php in the PostGuestbook 0.6.1 module for PHP-Nuke allows remote attackers (no CVSS)
- [CVE-2007-1373](https://cve.now/CVE-2007-1373.md): Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-1374](https://cve.now/CVE-2007-1374.md): Cross-site scripting (XSS) vulnerability in pop\_profile.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2007-1375](https://cve.now/CVE-2007-1375.md): Integer overflow in the substr\_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a l (no CVSS)
- [CVE-2007-1376](https://cve.now/CVE-2007-1376.md): The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resour (no CVSS)
- [CVE-2007-1377](https://cve.now/CVE-2007-1377.md): AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2007-1378](https://cve.now/CVE-2007-1378.md): The ovrimos\_longreadlen function in the Ovrimos extension for PHP before 4.4.5 allows context-dependent attackers to write to arbitrary memo (no CVSS)
- [CVE-2007-1379](https://cve.now/CVE-2007-1379.md): The ovrimos\_close function in the Ovrimos extension for PHP before 4.4.5 can trigger efree of an arbitrary address, which might allow contex (no CVSS)
- [CVE-2007-1380](https://cve.now/CVE-2007-1380.md): The php\_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers (no CVSS)
- [CVE-2007-1381](https://cve.now/CVE-2007-1381.md): The wddx\_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, (no CVSS)
- [CVE-2007-1382](https://cve.now/CVE-2007-1382.md): The PHP COM extensions for PHP on Windows systems allow context-dependent attackers to execute arbitrary code via a WScript.Shell COM object (no CVSS)
- [CVE-2007-1383](https://cve.now/CVE-2007-1383.md): Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowi (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-03-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.