# CVEs published 2007-04-13

14 CVEs were published on April 13, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1748](https://cve.now/CVE-2007-1748.md): Stack-based buffer overflow in the RPC interface in the Domain Name System (DNS) Server Service in Microsoft Windows 2000 Server SP 4, Serve (no CVSS)
- [CVE-2007-1871](https://cve.now/CVE-2007-1871.md): Cross-site scripting (XSS) vulnerability in chcounter 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the login\_nam (no CVSS)
- [CVE-2007-1872](https://cve.now/CVE-2007-1872.md): Cross-site scripting (XSS) vulnerability in toendaCMS 1.5.3 allows remote attackers to inject arbitrary web script or HTML via the searchwor (no CVSS)
- [CVE-2007-1873](https://cve.now/CVE-2007-1873.md): Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q paramete (no CVSS)
- [CVE-2007-2022](https://cve.now/CVE-2007-2022.md): Adobe Macromedia Flash Player 7 and 9, when used with Opera before 9.20 or Konqueror before 20070613, allows remote attackers to obtain sens (no CVSS)
- [CVE-2007-2023](https://cve.now/CVE-2007-2023.md): USB20.dll in Secustick USB flash drive decouples the authorization and file access routines, which allows local users to bypass authenticati (no CVSS)
- [CVE-2007-2024](https://cve.now/CVE-2007-2024.md): Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbi (no CVSS)
- [CVE-2007-2025](https://cve.now/CVE-2007-2025.md): Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.11p1 allows remote attackers to upload a (no CVSS)
- [CVE-2007-2026](https://cve.now/CVE-2007-2026.md): The gnu regular expression code in file 4.20 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted (no CVSS)
- [CVE-2007-2027](https://cve.now/CVE-2007-2027.md): Untrusted search path vulnerability in the add\_filename\_to\_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users (no CVSS)
- [CVE-2007-2028](https://cve.now/CVE-2007-2028.md): Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of (no CVSS)
- [CVE-2007-1742](https://cve.now/CVE-2007-1742.md): suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root (no CVSS)
- [CVE-2007-1743](https://cve.now/CVE-2007-1743.md): suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local u (no CVSS)
- [CVE-2007-1741](https://cve.now/CVE-2007-1741.md): Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local u (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.