# CVEs published 2007-04-03

35 CVEs were published on April 3, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-0242](https://cve.now/CVE-2007-0242.md): The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3 does not reject long UTF-8 sequences as required by the standard, which allo (no CVSS)
- [CVE-2007-1842](https://cve.now/CVE-2007-1842.md): Directory traversal vulnerability in login.php in JSBoard before 2.0.12 allows remote attackers to include and execute arbitrary local files (no CVSS)
- [CVE-2007-1843](https://cve.now/CVE-2007-1843.md): PHP remote file inclusion vulnerability in gmapfactory/params.php in MapLab 2.2.1, when register\_globals is enabled, allows remote attackers (no CVSS)
- [CVE-2007-1844](https://cve.now/CVE-2007-1844.md): Multiple PHP remote file inclusion vulnerabilities in Aardvark Topsites PHP 5 allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-1845](https://cve.now/CVE-2007-1845.md): SQL injection vulnerability in show\_event.php in the Expanded Calendar (calendar\_panel) 2.00 module for PHP-Fusion allows remote attackers t (no CVSS)
- [CVE-2007-1846](https://cve.now/CVE-2007-1846.md): SQL injection vulnerability in index.php in the MyAds 2.04jp and earlier module for Xoops allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2007-1847](https://cve.now/CVE-2007-1847.md): SQL injection vulnerability in viewcat.php in the Repository module for Xoops allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-1848](https://cve.now/CVE-2007-1848.md): Cross-site scripting (XSS) vulnerability in admin/classes/ui.dta.php in Drake CMS allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-1849](https://cve.now/CVE-2007-1849.md): Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute arbitrary local arbitrary files via (no CVSS)
- [CVE-2007-1850](https://cve.now/CVE-2007-1850.md): Directory traversal vulnerability in classes/captcha/captcha.jpg.php in Drake CMS allows remote attackers to read arbitrary files or list ar (no CVSS)
- [CVE-2007-1851](https://cve.now/CVE-2007-1851.md): Multiple directory traversal vulnerabilities in Really Simple PHP and Ajax (RSPA) 2007-03-23 allow remote attackers to include and execute a (no CVSS)
- [CVE-2007-1852](https://cve.now/CVE-2007-1852.md): Multiple PHP remote file inclusion vulnerabilities in 2BGal 3.1.1 allow remote attackers to execute arbitrary PHP code via a URL in the lang (no CVSS)
- [CVE-2007-1853](https://cve.now/CVE-2007-1853.md): Unspecified vulnerability in Hitachi JP1/HiCommand DeviceManager, Global Link Availability Manager, Replication Monitor, Tiered Storage Mana (no CVSS)
- [CVE-2007-1854](https://cve.now/CVE-2007-1854.md): Unspecified vulnerability in Hitachi Cosminexus Component Container 07-00 through 07-00-10, and 07-10 through 07-10-03, as used in uCosminex (no CVSS)
- [CVE-2007-1855](https://cve.now/CVE-2007-1855.md): Multiple PHP remote file inclusion vulnerabilities in smarty/smarty\_class.php in Shop-Script FREE allow remote attackers to execute arbitrar (no CVSS)
- [CVE-2006-7186](https://cve.now/CVE-2006-7186.md): cgi-lib/subs.pl in web-app.net WebAPP before 0.9.9.3.5 allows attackers to open list files in "profile and other functions," a different vul (no CVSS)
- [CVE-2006-7187](https://cve.now/CVE-2006-7187.md): Cross-site scripting (XSS) vulnerability in the show\_recent\_searches function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 200 (no CVSS)
- [CVE-2006-7188](https://cve.now/CVE-2006-7188.md): The search function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to read internal forum posts (no CVSS)
- [CVE-2006-7189](https://cve.now/CVE-2006-7189.md): Cross-site scripting (XSS) vulnerability in cgi-bin/admin/logs.cgi in web-app.net WebAPP before 20060403 allows remote attackers to inject a (no CVSS)
- [CVE-2006-7190](https://cve.now/CVE-2006-7190.md): Cross-site scripting (XSS) vulnerability in cgi-bin/user-lib/topics.pl in web-app.net WebAPP before 20060515 allows remote attackers to inje (no CVSS)
- [CVE-2006-7191](https://cve.now/CVE-2006-7191.md): Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager (LAM) before 1.0.0 allows local users to gain privileges via a m (no CVSS)
- [CVE-2007-1827](https://cve.now/CVE-2007-1827.md): Multiple unspecified vulnerabilities in form input validation in web-app.org WebAPP before 0.9.9.6 allow remote authenticated users to corru (no CVSS)
- [CVE-2007-1828](https://cve.now/CVE-2007-1828.md): Multiple cross-site scripting (XSS) vulnerabilities in web-app.org WebAPP before 0.9.9.6 allow remote authenticated users to inject arbitrar (no CVSS)
- [CVE-2007-1829](https://cve.now/CVE-2007-1829.md): Multiple unspecified vulnerabilities in web-app.net WebAPP have unknown impact and attack vectors, described as "\[having\] other \[security\] i (no CVSS)
- [CVE-2007-1830](https://cve.now/CVE-2007-1830.md): Unspecified vulnerability in the Username Hijacking Patch 20070312 for web-app.org WebAPP 0.9.9.6 allows remote attackers to obtain administ (no CVSS)
- [CVE-2007-1831](https://cve.now/CVE-2007-1831.md): web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to open files and write "wrong data" via a crafted QUERY\_STRING. (no CVSS)
- [CVE-2007-1832](https://cve.now/CVE-2007-1832.md): web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files (1) via a crafted filename or (2) by "using perc (no CVSS)
- [CVE-2007-1833](https://cve.now/CVE-2007-1833.md): The Skinny Call Control Protocol (SCCP) implementation in Cisco Unified CallManager (CUCM) 3.3 before 3.3(5)SR2a, 4.1 before 4.1(3)SR4, 4.2 (no CVSS)
- [CVE-2007-1834](https://cve.now/CVE-2007-1834.md): Cisco Unified CallManager (CUCM) 5.0 before 5.0(4a)SU1 and Cisco Unified Presence Server (CUPS) 1.0 before 1.0(3) allow remote attackers to (no CVSS)
- [CVE-2007-1835](https://cve.now/CVE-2007-1835.md): PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save\_path), uses the TMPDIR default after checking (no CVSS)
- [CVE-2007-1836](https://cve.now/CVE-2007-1836.md): The command line administration interface in Data Domain OS before 4.0.3.6 allows remote authenticated users to execute arbitrary commands v (no CVSS)
- [CVE-2007-1837](https://cve.now/CVE-2007-1837.md): Multiple PHP remote file inclusion vulnerabilities in MangoBery CMS 0.5.5 allow remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-1838](https://cve.now/CVE-2007-1838.md): SQL injection vulnerability in view.php in the Friendfinder 3.3 and earlier module for Xoops allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2007-1839](https://cve.now/CVE-2007-1839.md): Multiple PHP remote file inclusion vulnerabilities in CodeBB 1.1b3 and earlier allow remote attackers to execute arbitrary PHP code via a UR (no CVSS)
- [CVE-2007-1840](https://cve.now/CVE-2007-1840.md): lib/modules.inc in LDAP Account Manager (LAM) before 1.3.0 does not escape HTML special characters in LDAP data, which allows remote attacke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.