# CVEs published 2007-04-11

39 CVEs were published on April 11, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2007-1973](https://cve.now/CVE-2007-1973.md): Race condition in the Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0 allows local users to modify memory and ga (no CVSS)
- [CVE-2007-1279](https://cve.now/CVE-2007-1279.md): Unspecified vulnerability in the installer for Adobe Bridge 1.0.3 update for Apple OS X, when patching with desktop management tools, allows (no CVSS)
- [CVE-2007-1363](https://cve.now/CVE-2007-1363.md): Multiple SQL injection vulnerabilities in DropAFew before 0.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) id para (no CVSS)
- [CVE-2007-1364](https://cve.now/CVE-2007-1364.md): DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged ca (no CVSS)
- [CVE-2007-1559](https://cve.now/CVE-2007-1559.md): Multiple stack-based buffer overflows in SonicDVDDashVRNav.dll in Roxio CinePlayer 3.2 allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2007-1874](https://cve.now/CVE-2007-1874.md): Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execu (no CVSS)
- [CVE-2007-1958](https://cve.now/CVE-2007-1958.md): Buffer overflow in TinyMUX before 2.4 allows attackers to cause a denial of service via unspecified vectors related to "too many substring m (no CVSS)
- [CVE-2007-1959](https://cve.now/CVE-2007-1959.md): Unspecified vulnerability in the process\_cmdent function in command.cpp in TinyMUX before 2.4 has unknown impact and attack vectors, related (no CVSS)
- [CVE-2007-1960](https://cve.now/CVE-2007-1960.md): SQL injection vulnerability in visit.php in the Rha7 Downloads (rha7downloads) 1.0 module for XOOPS, and possibly other versions up to 1.10, (no CVSS)
- [CVE-2007-1961](https://cve.now/CVE-2007-1961.md): PHP remote file inclusion vulnerability in mutant\_functions.php in the Mutant 0.9.2 portal for phpBB 2.2 allows remote attackers to execute (no CVSS)
- [CVE-2007-1962](https://cve.now/CVE-2007-1962.md): SQL injection vulnerability in index.php in the WF-Snippets 1.02 and earlier module for XOOPS allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2007-1963](https://cve.now/CVE-2007-1963.md): SQL injection vulnerability in the create\_session function in class\_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remot (no CVSS)
- [CVE-2007-1964](https://cve.now/CVE-2007-1964.md): member.php in MyBB (aka MyBulletinBoard), when debug mode is available, allows remote authenticated users to change the password of any acco (no CVSS)
- [CVE-2007-1965](https://cve.now/CVE-2007-1965.md): Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS 2.0.4.3 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-1966](https://cve.now/CVE-2007-1966.md): Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID cooki (CVSS 9.1)
- [CVE-2007-1967](https://cve.now/CVE-2007-1967.md): PHP remote file inclusion vulnerability in index.php in stat12 allows remote attackers to execute arbitrary PHP code via a URL in the langpa (no CVSS)
- [CVE-2007-1968](https://cve.now/CVE-2007-1968.md): PHP remote file inclusion vulnerability in games.php in Sam Crew MyBlog, possibly 1.0 through 1.6, allows remote attackers to execute arbitr (no CVSS)
- [CVE-2007-1969](https://cve.now/CVE-2007-1969.md): Cross-site scripting (XSS) vulnerability in admin/modify.php in Sam Crew MyBlog remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-1970](https://cve.now/CVE-2007-1970.md): Mozilla Firefox does not warn the user about HTTP elements on an HTTPS page when the HTTP elements are dynamically created by a delayed docu (no CVSS)
- [CVE-2007-1971](https://cve.now/CVE-2007-1971.md): SQL injection vulnerability in fotokategori.asp in Gazi Okul Sitesi 2007 allows remote attackers to execute arbitrary SQL commands via the q (no CVSS)
- [CVE-2007-1940](https://cve.now/CVE-2007-1940.md): IBM Tivoli Business Service Manager (TBSM) 4.1 before Interim Fix 1 logs passwords in plaintext, which allows local users to obtain sensitiv (no CVSS)
- [CVE-2007-1941](https://cve.now/CVE-2007-1941.md): Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in Domino Web Access (DWA) in IBM Lotus Notes before 6.5.6 and (no CVSS)
- [CVE-2007-1942](https://cve.now/CVE-2007-1942.md): Integer overflow in FastStone Image Viewer 2.9 allows context-dependent attackers to cause a denial of service and possibly execute arbitrar (no CVSS)
- [CVE-2007-1943](https://cve.now/CVE-2007-1943.md): Integer overflow in ACDSee Photo Manager 9.0 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary (no CVSS)
- [CVE-2007-1944](https://cve.now/CVE-2007-1944.md): The Java Message Service (JMS) in IBM WebSphere Application Server (WAS) before 6.1.0.7 allows attackers to cause a denial of service via un (no CVSS)
- [CVE-2007-1945](https://cve.now/CVE-2007-1945.md): Unspecified vulnerability in the Servlet Engine/Web Container in IBM WebSphere Application Server (WAS) before 6.1.0.7 has unknown impact an (no CVSS)
- [CVE-2007-1946](https://cve.now/CVE-2007-1946.md): Integer overflow in Windows Explorer in Microsoft Windows XP SP1 might allow user-assisted remote attackers to cause a denial of service (cr (no CVSS)
- [CVE-2007-1947](https://cve.now/CVE-2007-1947.md): Cross-zone scripting vulnerability in the DOM templates (domplates) used by the console.log function in the Firebug extension before 1.04 fo (no CVSS)
- [CVE-2007-1948](https://cve.now/CVE-2007-1948.md): Buffer overflow in IrfanView 3.99 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via th (no CVSS)
- [CVE-2007-1949](https://cve.now/CVE-2007-1949.md): Session fixation vulnerability in WebBlizzard CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie. (no CVSS)
- [CVE-2007-1950](https://cve.now/CVE-2007-1950.md): Cross-site scripting (XSS) vulnerability in index\_cms.php in WebBlizzard CMS allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-1951](https://cve.now/CVE-2007-1951.md): Session fixation vulnerability in onelook obo Shop allows remote attackers to hijack web sessions by setting a PHPSESSID cookie. (no CVSS)
- [CVE-2007-1952](https://cve.now/CVE-2007-1952.md): Session fixation vulnerability in onelook onebyone CMS allows remote attackers to hijack web sessions by setting a PHPSESSID cookie. (no CVSS)
- [CVE-2007-1953](https://cve.now/CVE-2007-1953.md): Session fixation vulnerability in onelook courts on-line allows remote attackers to hijack web sessions by setting a PHPSESSID cookie. (no CVSS)
- [CVE-2007-1954](https://cve.now/CVE-2007-1954.md): Multiple directory traversal vulnerabilities in ArchiveXpert 2.02 build 80 allow remote attackers to create files in arbitrary directories v (no CVSS)
- [CVE-2007-1955](https://cve.now/CVE-2007-1955.md): Multiple stack-based buffer overflows in the SignKorea SKCrypAX ActiveX control module 5.4.1.2 allow remote attackers to execute arbitrary c (no CVSS)
- [CVE-2007-1956](https://cve.now/CVE-2007-1956.md): SQL injection vulnerability in ubbthreads.php in Groupee UBB.threads 6.1.1 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2007-1957](https://cve.now/CVE-2007-1957.md): Multiple PHP remote file inclusion vulnerabilities in Guernion Sylvain Portail Web Php (aka Gsylvain35 Portail Web, PwP) allow remote attack (no CVSS)
- [CVE-2007-1357](https://cve.now/CVE-2007-1357.md): The atalk\_sum\_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and possibly 2.4.x, allows remote attackers to cause a denial (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.