# CVEs published 2007-03-22

21 CVEs were published on March 22, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1594](https://cve.now/CVE-2007-1594.md): The handle\_response function in chan\_sip.c in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2007-1595](https://cve.now/CVE-2007-1595.md): The Asterisk Extension Language (AEL) in pbx/pbx\_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to e (no CVSS)
- [CVE-2007-1596](https://cve.now/CVE-2007-1596.md): Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com\_nfn\_addressbook) 0.4 component for Mambo and Joomla! allow r (no CVSS)
- [CVE-2007-1597](https://cve.now/CVE-2007-1597.md): Unclassified NewsBoard 1.6.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers (no CVSS)
- [CVE-2007-1598](https://cve.now/CVE-2007-1598.md): Stack-based buffer overflow in InterVations FileCOPA FTP Server 1.01 allows remote attackers to execute arbitrary code via unspecified vecto (no CVSS)
- [CVE-2007-1599](https://cve.now/CVE-2007-1599.md): wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive informa (no CVSS)
- [CVE-2007-1600](https://cve.now/CVE-2007-1600.md): PHP remote file inclusion vulnerability in module.php in Digital Eye Gallery 1.1 Beta (aka 0.1.1b) allows remote attackers to execute arbitr (no CVSS)
- [CVE-2007-1601](https://cve.now/CVE-2007-1601.md): Directory traversal vulnerability in check\_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-1602](https://cve.now/CVE-2007-1602.md): SQL injection vulnerability in check\_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-1603](https://cve.now/CVE-2007-1603.md): admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into (no CVSS)
- [CVE-2007-1604](https://cve.now/CVE-2007-1604.md): Multiple unrestricted file upload vulnerabilities in w-Agora (Web-Agora) allow remote attackers to upload and execute arbitrary PHP code (1) (no CVSS)
- [CVE-2007-1605](https://cve.now/CVE-2007-1605.md): w-Agora (Web-Agora) allows remote attackers to obtain sensitive information via a request to rss.php with an invalid (1) site or (2) bn para (no CVSS)
- [CVE-2007-1606](https://cve.now/CVE-2007-1606.md): Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-1607](https://cve.now/CVE-2007-1607.md): search.php in w-Agora (Web-Agora) allows remote attackers to obtain potentially sensitive information via a ' (quote) value followed by cert (no CVSS)
- [CVE-2007-1608](https://cve.now/CVE-2007-1608.md): CRLF injection vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.19 allows remote attackers to inject arbitrary HTTP head (no CVSS)
- [CVE-2007-1609](https://cve.now/CVE-2007-1609.md): Cross-site scripting (XSS) vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS) in Oracle Application Server (OAS) 10g 10.1.2.0 (no CVSS)
- [CVE-2007-1610](https://cve.now/CVE-2007-1610.md): Cross-site scripting (XSS) vulnerability in the RSS reader in Glue Software NewsGlue before 1.3.4 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2007-1611](https://cve.now/CVE-2007-1611.md): Cross-site scripting (XSS) vulnerability in the RSS reader in a certain SOURCENEXT product, probably IKANARI JIJYOU 1.0.0 and 1.0.1, allows (no CVSS)
- [CVE-2007-1591](https://cve.now/CVE-2007-1591.md): VsapiNT.sys in the Scan Engine 8.0 for Trend Micro AntiVirus 14.10.1041, and other products, allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2007-1592](https://cve.now/CVE-2007-1592.md): net/ipv6/tcp\_ipv6.c in Linux kernel 2.6.x up to 2.6.21-rc3 inadvertently copies the ipv6\_fl\_socklist from a listening TCP socket to child so (no CVSS)
- [CVE-2007-0240](https://cve.now/CVE-2007-0240.md): Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspe (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.