# CVEs published 2007-04-10

49 CVEs were published on April 10, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4837](https://cve.now/CVE-2005-4837.md): snmp\_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, 5.1.x before 5.1.3, and 5.0.x before 5.0.10.2, when running in master agentx mode, allow (no CVSS)
- [CVE-2007-1904](https://cve.now/CVE-2007-1904.md): Directory traversal vulnerability in AOL Instant Messenger (AIM) 5.9 and earlier, and ICQ 5.1 and probably earlier, allows user-assisted rem (no CVSS)
- [CVE-2007-1905](https://cve.now/CVE-2007-1905.md): Cross-site scripting (XSS) vulnerability in auth.php in Pineapple Technologies QuizShock 1.6.1 and earlier allows remote attackers to inject (no CVSS)
- [CVE-2007-1906](https://cve.now/CVE-2007-1906.md): Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows (no CVSS)
- [CVE-2007-1907](https://cve.now/CVE-2007-1907.md): PHP remote file inclusion vulnerability in warn.php in Pathos Content Management System (CMS) 0.92-2 allows remote attackers to execute arbi (no CVSS)
- [CVE-2007-1908](https://cve.now/CVE-2007-1908.md): PHP file inclusion vulnerability in php121db.php in PHP121 Instant Messenger 2.2 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-1909](https://cve.now/CVE-2007-1909.md): SQL injection vulnerability in login.php in Ryan Haudenschilt Battle.net Clan Script for PHP 1.5.1 and earlier allows remote attackers to ex (no CVSS)
- [CVE-2007-1910](https://cve.now/CVE-2007-1910.md): Buffer overflow in wwlib.dll in Microsoft Word 2007 allows remote attackers to cause a denial of service (application crash) and possibly ex (no CVSS)
- [CVE-2007-1911](https://cve.now/CVE-2007-1911.md): Multiple unspecified vulnerabilities in Microsoft Word 2007 allow remote attackers to cause a denial of service (CPU consumption) via crafte (no CVSS)
- [CVE-2007-1912](https://cve.now/CVE-2007-1912.md): Heap-based buffer overflow in Microsoft Windows allows user-assisted remote attackers to have an unknown impact via a crafted .HLP file. (no CVSS)
- [CVE-2007-1913](https://cve.now/CVE-2007-1913.md): The TRUSTED\_SYSTEM\_SECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of (no CVSS)
- [CVE-2007-1914](https://cve.now/CVE-2007-1914.md): The RFC\_START\_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (no CVSS)
- [CVE-2007-1915](https://cve.now/CVE-2007-1915.md): Buffer overflow in the RFC\_START\_PROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute ar (no CVSS)
- [CVE-2007-1916](https://cve.now/CVE-2007-1916.md): Buffer overflow in the RFC\_START\_GUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2007-1917](https://cve.now/CVE-2007-1917.md): Buffer overflow in the SYSTEM\_CREATE\_INSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execu (no CVSS)
- [CVE-2007-1918](https://cve.now/CVE-2007-1918.md): The RFC\_SET\_REG\_SERVER\_PROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to a (no CVSS)
- [CVE-2007-1919](https://cve.now/CVE-2007-1919.md): Cross-site scripting (XSS) vulnerability in index.php in Arizona Dream Livre d'or (livor) 2.5 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2007-1920](https://cve.now/CVE-2007-1920.md): SQL injection vulnerability in index.php in the aktualnosci module in SmodBIP 1.06 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-1921](https://cve.now/CVE-2007-1921.md): LIBSNDFILE.DLL, as used by AOL Nullsoft Winamp 5.33 and possibly other products, allows remote attackers to execute arbitrary code via a cra (no CVSS)
- [CVE-2007-1922](https://cve.now/CVE-2007-1922.md): The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in IN\_MOD.DLL in AOL Nullsoft Winamp 5.33 allows remote attackers to execute arbi (no CVSS)
- [CVE-2007-1924](https://cve.now/CVE-2007-1924.md): Multiple PHP remote file inclusion vulnerabilities in phpContact allow remote attackers to execute arbitrary PHP code via a URL in the inclu (no CVSS)
- [CVE-2007-1925](https://cve.now/CVE-2007-1925.md): The borrado function in modules/Your\_Account/index.php in Tru-Zone Nuke ET 3.4 before fix 7 does not verify that account deletion requests c (no CVSS)
- [CVE-2007-1926](https://cve.now/CVE-2007-1926.md): Cross-site scripting (XSS) vulnerability in JBMC Software DirectAdmin before 1.293 does not properly display log files, which allows remote (no CVSS)
- [CVE-2007-1927](https://cve.now/CVE-2007-1927.md): Cross-site scripting (XSS) vulnerability in signup.asp in CmailServer WebMail 5.3.4 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-1928](https://cve.now/CVE-2007-1928.md): Directory traversal vulnerability in index.php in witshare 0.9 allows remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2007-1929](https://cve.now/CVE-2007-1929.md): Directory traversal vulnerability in downloadpic.php in Beryo 2.0, and possibly other versions including 2.4, allows remote attackers to rea (no CVSS)
- [CVE-2007-1930](https://cve.now/CVE-2007-1930.md): Directory traversal vulnerability in download2.php in cattaDoc 2.21, and possibly other versions including 3.0, allows remote attackers to r (no CVSS)
- [CVE-2007-1931](https://cve.now/CVE-2007-1931.md): SQL injection vulnerability in index.php in the slownik module in SmodCMS 2.10 and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-1932](https://cve.now/CVE-2007-1932.md): Directory traversal vulnerability in scarnews.inc.php in ScarNews 1.2.1 allows remote attackers to include and execute arbitrary local files (no CVSS)
- [CVE-2007-1933](https://cve.now/CVE-2007-1933.md): Multiple directory traversal vulnerabilities in PcP-Guestbook (PcP-Book) 3.0 allow remote attackers to include and execute arbitrary local f (no CVSS)
- [CVE-2007-1934](https://cve.now/CVE-2007-1934.md): Directory traversal vulnerability in member.php in the eBoard 1.0.7 module for PHP-Nuke allows remote attackers to include and execute arbit (no CVSS)
- [CVE-2007-1935](https://cve.now/CVE-2007-1935.md): PHP file inclusion vulnerability in admin/index.php in ScarAdControl (ScarAdController) 1.1 allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-1936](https://cve.now/CVE-2007-1936.md): PHP remote file inclusion vulnerability in scaradcontrol.php in ScarAdControl (ScarAdController) 1.1 allows remote attackers to execute arbi (no CVSS)
- [CVE-2007-1937](https://cve.now/CVE-2007-1937.md): PHP remote file inclusion vulnerability in smilies.php in Scorp Book 1.0 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-1938](https://cve.now/CVE-2007-1938.md): Ichitaro 2005 through 2007, and possibly related products, allows remote attackers to have an unknown impact via unspecified vectors in a do (no CVSS)
- [CVE-2007-1939](https://cve.now/CVE-2007-1939.md): Cross-site scripting (XSS) vulnerability in the embedded webserver in Daniel Naber LanguageTool before 0.8.9 allows remote attackers to inje (no CVSS)
- [CVE-2006-7192](https://cve.now/CVE-2006-7192.md): Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/\* \*/) enclosures, which allows remote attackers to bypass reque (no CVSS)
- [CVE-2007-0734](https://cve.now/CVE-2007-0734.md): fsck, as used by the AirPort Disk feature of the AirPort Extreme Base Station with 802.11n before Firmware Update 7.1, and by Apple Mac OS X (no CVSS)
- [CVE-2007-1841](https://cve.now/CVE-2007-1841.md): The isakmp\_info\_recv function in src/racoon/isakmp\_inf.c in racoon in Ipsec-tools before 0.6.7 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2007-0938](https://cve.now/CVE-2007-0938.md): Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 does not properly handle certain characters in a crafted HTTP GET request, (no CVSS)
- [CVE-2007-0939](https://cve.now/CVE-2007-0939.md): Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inje (no CVSS)
- [CVE-2007-1204](https://cve.now/CVE-2007-1204.md): Stack-based buffer overflow in the Universal Plug and Play (UPnP) service in Microsoft Windows XP SP2 allows remote attackers on the same su (no CVSS)
- [CVE-2007-1205](https://cve.now/CVE-2007-1205.md): Unspecified vulnerability in Microsoft Agent (msagent\\agentsvr.exe) in Windows 2000 SP4, XP SP2, and Server 2003, 2003 SP1, and 2003 SP2 all (no CVSS)
- [CVE-2007-1206](https://cve.now/CVE-2007-1206.md): The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003, 2003 SP1, and 2003 SP2; and (no CVSS)
- [CVE-2007-1209](https://cve.now/CVE-2007-1209.md): Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection (no CVSS)
- [CVE-2006-4250](https://cve.now/CVE-2006-4250.md): Buffer overflow in man and mandb (man-db) 2.4.3 and earlier allows local users to execute arbitrary code via crafted arguments to the -H fla (no CVSS)
- [CVE-2007-1687](https://cve.now/CVE-2007-1687.md): Multiple buffer overflows in the Internet Pictures Corporation iPIX Image Well ActiveX control (iPIX-ImageWell-ipix.dll) allow remote attack (no CVSS)
- [CVE-2007-1900](https://cve.now/CVE-2007-1900.md): CRLF injection vulnerability in the FILTER\_VALIDATE\_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to (no CVSS)
- [CVE-2007-1923](https://cve.now/CVE-2007-1923.md): (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing the set of URLs linked from menus, which allows remo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.