# CVEs published 2007-03-20

63 CVEs were published on March 20, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-7172](https://cve.now/CVE-2006-7172.md): Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-7173](https://cve.now/CVE-2006-7173.md): Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP c (no CVSS)
- [CVE-2007-1537](https://cve.now/CVE-2007-1537.md): \\Device\\NdisTapi (NDISTAPI.sys) in Microsoft Windows XP SP2 and 2003 SP1 uses weak permissions, which allows local users to write to the dev (no CVSS)
- [CVE-2007-1538](https://cve.now/CVE-2007-1538.md): McAfee VirusScan Enterprise 8.5.0.i uses insecure permissions for certain Windows Registry keys, which allows local users to bypass local pa (no CVSS)
- [CVE-2007-1539](https://cve.now/CVE-2007-1539.md): Directory traversal vulnerability in inc/map.func.php in pragmaMX Landkarten 2.1 module allows remote attackers to include arbitrary files v (no CVSS)
- [CVE-2007-1540](https://cve.now/CVE-2007-1540.md): Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to (no CVSS)
- [CVE-2007-1541](https://cve.now/CVE-2007-1541.md): Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27 only checks for the presence of a NULL (%00) character to protect against di (no CVSS)
- [CVE-2007-1542](https://cve.now/CVE-2007-1542.md): Unspecified vulnerability in the Cisco IP Phone 7940 and 7960 running firmware before POS8-6-0 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2007-1543](https://cve.now/CVE-2007-1543.md): Stack-based buffer overflow in the accept\_att\_local function in server/os/connection.c in Network Audio System (NAS) before 1.8a SVN 237 all (no CVSS)
- [CVE-2007-1544](https://cve.now/CVE-2007-1544.md): Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c in Network Audio System (NAS) before 1.8a SVN 237 allows remo (no CVSS)
- [CVE-2007-1545](https://cve.now/CVE-2007-1545.md): The AddResource function in server/dia/resource.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denia (no CVSS)
- [CVE-2007-1546](https://cve.now/CVE-2007-1546.md): Array index error in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a denial of service (crash) via (1) lar (no CVSS)
- [CVE-2007-1547](https://cve.now/CVE-2007-1547.md): The ReadRequestFromClient function in server/os/io.c in Network Audio System (NAS) before 1.8a SVN 237 allows remote attackers to cause a de (no CVSS)
- [CVE-2007-1548](https://cve.now/CVE-2007-1548.md): SQL injection vulnerability in functions/functions\_filters.asp in Web Wiz Forums before 8.05a (MySQL version) does not properly filter certa (no CVSS)
- [CVE-2007-1549](https://cve.now/CVE-2007-1549.md): Unrestricted file upload vulnerability in gallery.php in phpx 3.5.15 allows remote attackers to upload and execute arbitrary PHP scripts via (no CVSS)
- [CVE-2007-1550](https://cve.now/CVE-2007-1550.md): Multiple SQL injection vulnerabilities in phpx 3.5.15 allow remote attackers to execute arbitrary SQL commands via the (1) image\_id or (2) c (no CVSS)
- [CVE-2007-1551](https://cve.now/CVE-2007-1551.md): Multiple cross-site scripting (XSS) vulnerabilities in phpx 3.5.15 allow remote attackers to inject arbitrary web script or HTML via (1) the (no CVSS)
- [CVE-2007-1552](https://cve.now/CVE-2007-1552.md): Unrestricted file upload vulnerability in usercp.php in MetaForum 0.513 Beta restricts file types based on the MIME type in the Content-type (no CVSS)
- [CVE-2007-1553](https://cve.now/CVE-2007-1553.md): admin/configuration.php in Guestbara 1.2 and earlier allows remote attackers to modify the e-mail, name, and password of the admin account b (no CVSS)
- [CVE-2007-1554](https://cve.now/CVE-2007-1554.md): Direct static code injection vulnerability in admin/configuration.php in Guestbara 1.2 and earlier allows remote authenticated users to inje (no CVSS)
- [CVE-2007-1555](https://cve.now/CVE-2007-1555.md): SQL injection vulnerability in forum.php in the Minerva mod 2.0.21 build 238a and earlier for phpBB allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-0607](https://cve.now/CVE-2007-0607.md): W-Agora (Web-Agora) 4.2.1, when register\_globals is enabled, stores globals.inc under the web document root with insufficient access control (no CVSS)
- [CVE-2007-1517](https://cve.now/CVE-2007-1517.md): SQL injection vulnerability in comments.php in WSN Guest 1.02 and 1.21 allows remote attackers to execute arbitrary SQL commands via the id (no CVSS)
- [CVE-2007-1518](https://cve.now/CVE-2007-1518.md): SQL injection vulnerability in usergroups.php in Woltlab Burning Board (wBB) 2.x allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2007-1519](https://cve.now/CVE-2007-1519.md): Cross-site scripting (XSS) vulnerability in modules.php in PHP-Nuke 8.0 and earlier allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-1520](https://cve.now/CVE-2007-1520.md): The cross-site request forgery (CSRF) protection in PHP-Nuke 8.0 and earlier does not ensure the SERVER superglobal is an array before valid (no CVSS)
- [CVE-2007-1521](https://cve.now/CVE-2007-1521.md): Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interru (no CVSS)
- [CVE-2007-1522](https://cve.now/CVE-2007-1522.md): Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute arbitrary code via i (no CVSS)
- [CVE-2007-1523](https://cve.now/CVE-2007-1523.md): Heap-based buffer overflow in the kernel in NetBSD 3.0, certain versions of FreeBSD and OpenBSD, and possibly other BSD derived operating sy (no CVSS)
- [CVE-2007-1524](https://cve.now/CVE-2007-1524.md): Directory traversal vulnerability in themes/default/ in ZomPlog 3.7.6 and earlier allows remote attackers to include arbitrary local files v (no CVSS)
- [CVE-2007-1525](https://cve.now/CVE-2007-1525.md): Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-1526](https://cve.now/CVE-2007-1526.md): Sun Java System Web Server 6.1 before 20070314 allows remote authenticated users with revoked client certificates to bypass the Certificate (no CVSS)
- [CVE-2007-1527](https://cve.now/CVE-2007-1527.md): The LLTD Mapper in Microsoft Windows Vista does not verify that an IP address in a TLV type 0x07 field in a HELLO packet corresponds to a va (no CVSS)
- [CVE-2007-1528](https://cve.now/CVE-2007-1528.md): The LLTD Mapper in Microsoft Windows Vista allows remote attackers to spoof hosts, and nonexistent bridge relationships, into the network to (no CVSS)
- [CVE-2007-1529](https://cve.now/CVE-2007-1529.md): The LLTD Responder in Microsoft Windows Vista does not send the Mapper a response to a DISCOVERY packet if another host has sent a spoofed r (no CVSS)
- [CVE-2007-1530](https://cve.now/CVE-2007-1530.md): The LLTD Mapper in Microsoft Windows Vista does not properly gather responses to EMIT packets, which allows remote attackers to cause a deni (no CVSS)
- [CVE-2007-1531](https://cve.now/CVE-2007-1531.md): Microsoft Windows XP and Vista overwrites ARP table entries included in gratuitous ARP, which allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2007-1532](https://cve.now/CVE-2007-1532.md): The neighbor discovery implementation in Microsoft Windows Vista allows remote attackers to conduct a redirect attack by (1) responding to q (no CVSS)
- [CVE-2007-1533](https://cve.now/CVE-2007-1533.md): The Teredo implementation in Microsoft Windows Vista uses the same nonce for communication with different UDP ports within a solicitation se (no CVSS)
- [CVE-2007-1534](https://cve.now/CVE-2007-1534.md): DFSR.exe in Windows Meeting Space in Microsoft Windows Vista remains available for remote connections on TCP port 5722 for 2 minutes after W (no CVSS)
- [CVE-2007-1535](https://cve.now/CVE-2007-1535.md): Microsoft Windows Vista establishes a Teredo address without user action upon connection to the Internet, contrary to documentation that Ter (no CVSS)
- [CVE-2007-1536](https://cve.now/CVE-2007-1536.md): Integer underflow in the file\_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via (no CVSS)
- [CVE-2005-4833](https://cve.now/CVE-2005-4833.md): IBM WebSphere Application Server (WAS) 6.0 before 20050201, when serving pages in an Application WAR or an Extended Document Root, allows re (no CVSS)
- [CVE-2005-4834](https://cve.now/CVE-2005-4834.md): IBM WebSphere Application Server (WAS) 5.0.2.5 through 5.1.1.3 allows remote attackers to obtain JSP source code and other sensitive informa (no CVSS)
- [CVE-2006-7164](https://cve.now/CVE-2006-7164.md): SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does n (no CVSS)
- [CVE-2006-7165](https://cve.now/CVE-2006-7165.md): IBM WebSphere Application Server (WAS) 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information (no CVSS)
- [CVE-2006-7166](https://cve.now/CVE-2006-7166.md): IBM WebSphere Application Server (WAS) 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information (no CVSS)
- [CVE-2006-7167](https://cve.now/CVE-2006-7167.md): Unspecified vulnerability in ProRat Server 1.9 Fix2 allows remote attackers to bypass the authentication mechanism for remote login via unsp (no CVSS)
- [CVE-2006-7168](https://cve.now/CVE-2006-7168.md): PHP remote file inclusion vulnerability in includes/not\_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2006-7169](https://cve.now/CVE-2006-7169.md): PHP remote file inclusion vulnerability in includes/header\_simple.php in Ultimate PHP Board (UPB) 2.0 and earlier allows remote attackers to (no CVSS)
- [CVE-2006-7170](https://cve.now/CVE-2006-7170.md): Multiple SQL injection vulnerabilities in Koan Software Mega Mall allow remote attackers to execute arbitrary SQL commands via the (1) t, (2 (no CVSS)
- [CVE-2006-7171](https://cve.now/CVE-2006-7171.md): product\_review.php in Koan Software Mega Mall allows remote attackers to obtain the installation path via a request with an empty value of t (no CVSS)
- [CVE-2007-0998](https://cve.now/CVE-2007-0998.md): The VNC server implementation in QEMU, as used by Xen and possibly other environments, allows local users of a guest operating system to rea (no CVSS)
- [CVE-2007-1507](https://cve.now/CVE-2007-1507.md): The default configuration in OpenAFS 1.4.x before 1.4.4 and 1.5.x before 1.5.17 supports setuid programs within the local cell, which might (no CVSS)
- [CVE-2007-1508](https://cve.now/CVE-2007-1508.md): Cross-site scripting (XSS) vulnerability in CMD\_USER\_STATS in DirectAdmin allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-1509](https://cve.now/CVE-2007-1509.md): Directory traversal vulnerability in enkrypt.php in Sascha Schroeder krypt (aka Holtstraeter Rot 13) allows remote attackers to read arbitra (no CVSS)
- [CVE-2007-1510](https://cve.now/CVE-2007-1510.md): SQL injection vulnerability in post.php in Particle Blogger 1.0.0 through 1.2.0 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2007-1511](https://cve.now/CVE-2007-1511.md): Buffer overflow in FrontBase Relational Database Server 4.2.7 and earlier allows remote authenticated users, with privileges for creating a (no CVSS)
- [CVE-2007-1512](https://cve.now/CVE-2007-1512.md): Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Go (no CVSS)
- [CVE-2007-1513](https://cve.now/CVE-2007-1513.md): PHP remote file inclusion vulnerability in comanda.php in GraFX Company WebSite Builder (CWB) PRO 1.9.8, when register\_globals is enabled, a (no CVSS)
- [CVE-2007-1514](https://cve.now/CVE-2007-1514.md): PHP remote file inclusion vulnerability in index.php in ViperWeb Portal alpha 0.1 allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-1515](https://cve.now/CVE-2007-1515.md): Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP H3 4.1.3, and possibly earlier, allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-1516](https://cve.now/CVE-2007-1516.md): PHP remote file inclusion vulnerability in functions/update.php in Cicoandcico CcMail 1.0 allows remote attackers to execute arbitrary PHP c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.