# CVEs published 2007-03-16

38 CVEs were published on March 16, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1447](https://cve.now/CVE-2007-1447.md): The Tape Engine in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial o (no CVSS)
- [CVE-2007-1448](https://cve.now/CVE-2007-1448.md): The Tape Engine in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial o (no CVSS)
- [CVE-2007-0450](https://cve.now/CVE-2007-0450.md): Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-1490](https://cve.now/CVE-2007-1490.md): Unspecified maintenance web pages in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allow remote authenticated users to execut (no CVSS)
- [CVE-2007-1491](https://cve.now/CVE-2007-1491.md): Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, whi (no CVSS)
- [CVE-2007-1492](https://cve.now/CVE-2007-1492.md): winmm.dll in Microsoft Windows XP allows user-assisted remote attackers to cause a denial of service (infinite loop) via a large cch argumen (no CVSS)
- [CVE-2007-1493](https://cve.now/CVE-2007-1493.md): nukesentinel.php in NukeSentinel 2.5.06 and earlier uses a permissive regular expression to validate an IP address, which allows remote atta (no CVSS)
- [CVE-2007-1494](https://cve.now/CVE-2007-1494.md): Cross-site scripting (XSS) vulnerability in NukeSentinel before 2.5.06 allows remote attackers to inject arbitrary web script or HTML via un (no CVSS)
- [CVE-2007-1495](https://cve.now/CVE-2007-1495.md): The \\Device\\SymEvent driver in Symantec Norton Personal Firewall 2006 9.1.1.7, and possibly other products using symevent.sys 12.0.0.20, all (no CVSS)
- [CVE-2007-1496](https://cve.now/CVE-2007-1496.md): nfnetlink\_log in netfilter in the Linux kernel before 2.6.20.3 allows attackers to cause a denial of service (crash) via unspecified vectors (no CVSS)
- [CVE-2007-1497](https://cve.now/CVE-2007-1497.md): nf\_conntrack in netfilter in the Linux kernel before 2.6.20.3 does not set nfctinfo during reassembly of fragmented packets, which leaves th (no CVSS)
- [CVE-2007-1498](https://cve.now/CVE-2007-1498.md): Multiple stack-based buffer overflows in the SiteManager.SiteMgr.1 ActiveX control (SiteManager.dll) in the ePO management console in McAfee (no CVSS)
- [CVE-2007-0002](https://cve.now/CVE-2007-0002.md): Multiple heap-based buffer overflows in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allow user-assisted remote attackers to (no CVSS)
- [CVE-2007-1466](https://cve.now/CVE-2007-1466.md): Integer overflow in the WP6GeneralTextPacket::\_readContents function in WordPerfect Document importer/exporter (libwpd) before 0.8.9 allows (no CVSS)
- [CVE-2007-1467](https://cve.now/CVE-2007-1467.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) PreSearch.html and (2) PreSearch.class in Cisco Secure Access Control Server (ACS (no CVSS)
- [CVE-2007-1468](https://cve.now/CVE-2007-1468.md): Cross-site scripting (XSS) vulnerability in IBM Rational ClearQuest (CQ) Web 7.0.0.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-1469](https://cve.now/CVE-2007-1469.md): SQL injection vulnerability in gallery.asp in Absolute Image Gallery 2.0 allows remote attackers to execute arbitrary SQL commands via the c (no CVSS)
- [CVE-2007-1470](https://cve.now/CVE-2007-1470.md): Multiple buffer overflows in LIBFtp 5.0 allow user-assisted remote attackers to execute arbitrary code via certain long arguments to the (1) (no CVSS)
- [CVE-2007-1471](https://cve.now/CVE-2007-1471.md): admin/default.asp in Orion-Blog 2.0 allows remote attackers to bypass authentication controls and gain privileges via a direct URL request f (no CVSS)
- [CVE-2007-1472](https://cve.now/CVE-2007-1472.md): Variable overwrite vulnerability in groupit/base/groupit.start.inc in Groupit 2.00b5 allows remote attackers to conduct remote file inclusio (no CVSS)
- [CVE-2007-1473](https://cve.now/CVE-2007-1473.md): Cross-site scripting (XSS) vulnerability in framework/NLS/NLS.php in Horde Framework before 3.1.4 RC1, when the login page contains a langua (no CVSS)
- [CVE-2007-1474](https://cve.now/CVE-2007-1474.md): Argument injection vulnerability in the cleanup cron script in Horde Project Horde and IMP before Horde Application Framework 3.1.4 allows l (no CVSS)
- [CVE-2007-1475](https://cve.now/CVE-2007-1475.md): Multiple buffer overflows in the (1) ibase\_connect and (2) ibase\_pconnect functions in the interbase extension in PHP 4.4.6 and earlier allo (no CVSS)
- [CVE-2007-1476](https://cve.now/CVE-2007-1476.md): The SymTDI device driver (SYMTDI.SYS) in Symantec Norton Personal Firewall 2006 9.1.1.7 and earlier, Internet Security 2005 and 2006, AntiVi (no CVSS)
- [CVE-2007-1477](https://cve.now/CVE-2007-1477.md): Directory traversal vulnerability in index.php in PHP Point Of Sale for osCommerce 1.1 allows remote attackers to include and execute arbitr (no CVSS)
- [CVE-2007-1478](https://cve.now/CVE-2007-1478.md): download.php in McGallery 0.5b allows remote attackers to read arbitrary files and obtain script source code via the filename parameter. (no CVSS)
- [CVE-2007-1479](https://cve.now/CVE-2007-1479.md): Cross-site scripting (XSS) vulnerability in Guestbook.php in Creative Guestbook 1.0 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-1480](https://cve.now/CVE-2007-1480.md): Creative Guestbook 1.0 allows remote attackers to add an administrative account via a direct request to createadmin.php with Name, Email, an (no CVSS)
- [CVE-2007-1481](https://cve.now/CVE-2007-1481.md): SQL injection vulnerability in index.php in WBBlog allows remote attackers to execute arbitrary SQL commands via the e\_id parameter in a vie (no CVSS)
- [CVE-2007-1482](https://cve.now/CVE-2007-1482.md): Cross-site scripting (XSS) vulnerability in index.php in WBBlog allows remote attackers to inject arbitrary web script or HTML via the e\_id (no CVSS)
- [CVE-2007-1483](https://cve.now/CVE-2007-1483.md): Multiple PHP remote file inclusion vulnerabilities in WebCalendar 0.9.45 allow remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2007-1484](https://cve.now/CVE-2007-1484.md): The array\_user\_key\_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval\_dtor, which triggers memory (no CVSS)
- [CVE-2007-1485](https://cve.now/CVE-2007-1485.md): Buffer overflow in the set\_umask function in QFTP in LIBFtp 3.1-1 allows local users to execute arbitrary code via a long -m argument. (no CVSS)
- [CVE-2007-1486](https://cve.now/CVE-2007-1486.md): PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute (no CVSS)
- [CVE-2007-1487](https://cve.now/CVE-2007-1487.md): Directory traversal vulnerability in index.php in Sascha Schroeder (aka CyberTeddy or Cyber-inside) WebLog allows remote attackers to read a (no CVSS)
- [CVE-2007-1488](https://cve.now/CVE-2007-1488.md): Unspecified vulnerability in Sun Java System Web Server 6.0 and 6.1 before 20070315 allows remote attackers to "gain unauthorized access to (no CVSS)
- [CVE-2007-1489](https://cve.now/CVE-2007-1489.md): Unspecified vulnerability in web-app.org Web Automated Perl Portal (WebAPP) 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin acces (no CVSS)
- [CVE-2007-1278](https://cve.now/CVE-2007-1278.md): Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft I (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-03-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.