# CVEs published 2007-04-22

15 CVEs were published on April 22, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1972](https://cve.now/CVE-2007-1972.md): PatrolAgent.exe in BMC Performance Manager does not require authentication for requests to modify configuration files, which allows remote a (no CVSS)
- [CVE-2007-2136](https://cve.now/CVE-2007-2136.md): Stack-based buffer overflow in bgs\_sdservice.exe in BMC Patrol PerformAgent allows remote attackers to execute arbitrary code by connecting (no CVSS)
- [CVE-2007-2137](https://cve.now/CVE-2007-2137.md): Heap-based buffer overflow in kde.dll in IBM Tivoli Monitoring Express 6.1.0 before Fix Pack 2, as used in Tivoli Universal Agent, Windows O (no CVSS)
- [CVE-2007-2159](https://cve.now/CVE-2007-2159.md): Multiple cross-site scripting (XSS) vulnerabilities in the Database Administration (dba) module 4.6.x-\*, and before 4.7.x-1.2 in the 4.7.x-1 (no CVSS)
- [CVE-2007-2160](https://cve.now/CVE-2007-2160.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Database Administration (dba) module 4.6.x-\*, and before 4.7.x-1.2 in the (no CVSS)
- [CVE-2007-2161](https://cve.now/CVE-2007-2161.md): Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (browser hang) via JavaScript that matches a regular expr (no CVSS)
- [CVE-2007-2162](https://cve.now/CVE-2007-2162.md): (1) Mozilla Firefox 2.0.0.3 and (2) GNU IceWeasel 2.0.0.3 allow remote attackers to cause a denial of service (browser crash or system hang) (no CVSS)
- [CVE-2007-2163](https://cve.now/CVE-2007-2163.md): Apple Safari allows remote attackers to cause a denial of service (browser crash) via JavaScript that matches a regular expression against a (no CVSS)
- [CVE-2007-2164](https://cve.now/CVE-2007-2164.md): Konqueror 3.5.5 release 45.4 allows remote attackers to cause a denial of service (browser crash or abort) via JavaScript that matches a reg (no CVSS)
- [CVE-2007-2165](https://cve.now/CVE-2007-2165.md): The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module (no CVSS)
- [CVE-2007-2166](https://cve.now/CVE-2007-2166.md): PHP remote file inclusion vulnerability in administration/user/lib/group.inc.php in OpenSurveyPilot (osp) 1.2.1 and earlier allows remote at (no CVSS)
- [CVE-2007-2167](https://cve.now/CVE-2007-2167.md): Static code injection vulnerability in process.php in AimStats 3.2 allows remote attackers to inject PHP code into config.php via the number (no CVSS)
- [CVE-2007-2168](https://cve.now/CVE-2007-2168.md): Static code injection vulnerability in process.php in AimStats 3.2 and earlier allows remote attackers to inject PHP code into config.php vi (no CVSS)
- [CVE-2007-2169](https://cve.now/CVE-2007-2169.md): Static code injection vulnerability in add.php in Mozzers SubSystem 1.0 allows remote attackers to inject PHP code into subs.php via the (1) (no CVSS)
- [CVE-2007-2172](https://cve.now/CVE-2007-2172.md): A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA\_MAX to be used as an array size instead of RTN\_MAX, which lead (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.