# CVEs published 2007-03-14 19 CVEs were published on March 14, 2007: 0 critical, 0 high. Days are UTC. - [CVE-2007-1449](https://cve.now/CVE-2007-1449.md): Directory traversal vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2007-1450](https://cve.now/CVE-2007-1450.md): SQL injection vulnerability in mainfile.php in PHP-Nuke 8.0 and earlier allows remote attackers to execute arbitrary SQL commands in the Top (no CVSS) - [CVE-2007-1451](https://cve.now/CVE-2007-1451.md): GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre (no CVSS) - [CVE-2007-1452](https://cve.now/CVE-2007-1452.md): The FDF support (ext/fdf) in PHP 5.2.0 and earlier does not implement the input filtering hooks for ext/filter, which allows remote attacker (no CVSS) - [CVE-2007-1453](https://cve.now/CVE-2007-1453.md): Buffer underflow in the PHP\_FILTER\_TRIM\_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attacker (no CVSS) - [CVE-2007-1454](https://cve.now/CVE-2007-1454.md): ext/filter in PHP 5.2.0, when FILTER\_SANITIZE\_STRING is used with the FILTER\_FLAG\_STRIP\_LOW flag, does not properly strip HTML tags, which a (no CVSS) - [CVE-2007-1455](https://cve.now/CVE-2007-1455.md): Multiple absolute path traversal vulnerabilities in Fantastico, as used with cPanel 10.x, allow remote authenticated users to include and ex (no CVSS) - [CVE-2007-1456](https://cve.now/CVE-2007-1456.md): PHP remote file inclusion vulnerability in common.php in PHP Photo Album allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS) - [CVE-2007-1457](https://cve.now/CVE-2007-1457.md): Buffer overflow in the urarlib\_get function in Christian Scheurer UniquE RAR File Library (unrarlib, aka URARFileLib) 0.4 allows context-dep (no CVSS) - [CVE-2007-1458](https://cve.now/CVE-2007-1458.md): Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the root\_ (no CVSS) - [CVE-2007-1459](https://cve.now/CVE-2007-1459.md): Multiple PHP remote file inclusion vulnerabilities in WebCreator 0.2.6-rc3 and earlier allow remote attackers to execute arbitrary PHP code (no CVSS) - [CVE-2007-1460](https://cve.now/CVE-2007-1460.md): The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open\_base (no CVSS) - [CVE-2007-1461](https://cve.now/CVE-2007-1461.md): The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or op (no CVSS) - [CVE-2007-1441](https://cve.now/CVE-2007-1441.md): The 4thPass browser (BlackBerry Browser) on the RIM BlackBerry 8100 (Pearl) before 4.2.1 allows remote attackers to cause a denial of servic (no CVSS) - [CVE-2007-1442](https://cve.now/CVE-2007-1442.md): Oracle Database 10g uses a NULL pDacl parameter when calling the SetSecurityDescriptorDacl function to create discretionary access control l (no CVSS) - [CVE-2007-1443](https://cve.now/CVE-2007-1443.md): Multiple cross-site scripting (XSS) vulnerabilities in register.php in Woltlab Burning Board (wBB) 2.3.6 and Burning Board Lite 1.0.2pl3e al (no CVSS) - [CVE-2007-1444](https://cve.now/CVE-2007-1444.md): netserver in netperf 2.4.3 allows local users to overwrite arbitrary files via a symlink attack on /tmp/netperf.debug. (no CVSS) - [CVE-2007-1445](https://cve.now/CVE-2007-1445.md): SQL injection vulnerability in the heme preview feature for default.asp in BP Blog 7.0 through 7.0.2 allows remote attackers to execute arbi (no CVSS) - [CVE-2007-1446](https://cve.now/CVE-2007-1446.md): Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1beta allow remote attackers to execute arbitrary PHP co (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-03-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.