# CVEs published 2007-04-24

62 CVEs were published on April 24, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2135](https://cve.now/CVE-2007-2135.md): The ADI\_BINARY component in the Oracle E-Business Suite allows remote attackers to download arbitrary documents from the APPS.FND\_DOCUMENTS (no CVSS)
- [CVE-2007-2138](https://cve.now/CVE-2007-2138.md): Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x bef (no CVSS)
- [CVE-2007-2170](https://cve.now/CVE-2007-2170.md): The APPLSYS.FND\_DM\_NODES package in Oracle E-Business Suite does not check for valid sessions, which allows remote attackers to delete arbit (no CVSS)
- [CVE-2007-2171](https://cve.now/CVE-2007-2171.md): Stack-based buffer overflow in the base64\_decode function in GWINTER.exe in Novell GroupWise (GW) WebAccess before 7.0 SP2 allows remote att (no CVSS)
- [CVE-2007-2199](https://cve.now/CVE-2007-2199.md): PHP remote file inclusion vulnerability in lib/pcltar.lib.php (aka pcltar.php) in the PclTar module 1.3 and 1.3.1 for Vincent Blavet PhpConc (no CVSS)
- [CVE-2007-2200](https://cve.now/CVE-2007-2200.md): Directory traversal vulnerability in navigator/navigator\_ok.php in Pagode 0.5.8 allows remote attackers to read and possibly delete arbitrar (no CVSS)
- [CVE-2007-2201](https://cve.now/CVE-2007-2201.md): Multiple PHP remote file inclusion vulnerabilities in Post Revolution 6.6 and 7.0 RC2 allow remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-2202](https://cve.now/CVE-2007-2202.md): PHP remote file inclusion vulnerability in inc\_ACVS/SOAP/Transport.php in Accueil et Conseil en Visites et Sejours Web Services (ACVSWS) PHP (no CVSS)
- [CVE-2007-2203](https://cve.now/CVE-2007-2203.md): Cross-site scripting (XSS) vulnerability in Big Blue Guestbook allows remote attackers to inject arbitrary web script or HTML via the messag (no CVSS)
- [CVE-2007-2204](https://cve.now/CVE-2007-2204.md): Multiple PHP remote file inclusion vulnerabilities in GPL PHP Board (GPB) unstable-2001.11.14-1 allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-2205](https://cve.now/CVE-2007-2205.md): PHP remote file inclusion vulnerability in modules/rtmessageadd.php in LAN Management System (LMS) 1.5.3, and possibly 1.5.4, allows remote (no CVSS)
- [CVE-2007-2206](https://cve.now/CVE-2007-2206.md): Cross-site scripting (XSS) vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to inject ar (no CVSS)
- [CVE-2007-2207](https://cve.now/CVE-2007-2207.md): SQL injection vulnerability in contact/index.php in Ripe Website Manager 0.8.4 and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-2208](https://cve.now/CVE-2007-2208.md): Multiple PHP remote file inclusion vulnerabilities in Extreme PHPBB2 3.0 Pre Final allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-2209](https://cve.now/CVE-2007-2209.md): Buffer overflow in igcore15d.dll 15.1.2.0 and 15.2.0.0 for AccuSoft ImageGear, as used in Corel Paint Shop Pro Photo 11.20 and possibly othe (no CVSS)
- [CVE-2007-2210](https://cve.now/CVE-2007-2210.md): A certain ActiveX control in askPopStp.dll in Netsprint Ask IE Toolbar 1.1 allows remote attackers to cause a denial of service (Internet Ex (no CVSS)
- [CVE-2007-2211](https://cve.now/CVE-2007-2211.md): SQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-2212](https://cve.now/CVE-2007-2212.md): Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arb (no CVSS)
- [CVE-2007-2213](https://cve.now/CVE-2007-2213.md): Unspecified vulnerability in the Initialize function in NetscapeFTPHandler in WS\_FTP Home and Professional 2007 allows remote attackers to c (no CVSS)
- [CVE-2007-2214](https://cve.now/CVE-2007-2214.md): Unrestricted file upload vulnerability in includes/upload\_file.php in DmCMS allows remote attackers to upload arbitrary PHP scripts by placi (no CVSS)
- [CVE-2007-2198](https://cve.now/CVE-2007-2198.md): Cross-site scripting (XSS) vulnerability in LAN Management System (LMS) before 1.6.9 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-0735](https://cve.now/CVE-2007-0735.md): Use-after-free vulnerability in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to cause a denial of service (applic (no CVSS)
- [CVE-2007-0736](https://cve.now/CVE-2007-0736.md): Integer overflow in the RPC library in Libinfo in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2007-0737](https://cve.now/CVE-2007-0737.md): The Login Window in Apple Mac OS X 10.3.9 through 10.4.9 does not properly check certain environment variables, which allows local users to (no CVSS)
- [CVE-2007-0738](https://cve.now/CVE-2007-0738.md): The Login Window in Apple Mac OS X 10.4 through 10.4.9 does not display the screen saver authentication dialog in certain circumstances when (no CVSS)
- [CVE-2007-0739](https://cve.now/CVE-2007-0739.md): The Login Window in Apple Mac OS X 10.4 through 10.4.9 displays the software update window beneath the loginwindow authentication dialog in (no CVSS)
- [CVE-2007-0741](https://cve.now/CVE-2007-0741.md): Buffer overflow in natd in network\_cmds in Apple Mac OS X 10.3.9 through 10.4.9, when Internet Sharing is enabled, allows remote attackers t (no CVSS)
- [CVE-2007-0742](https://cve.now/CVE-2007-0742.md): The WebFoundation framework in Apple Mac OS X 10.3.9 and earlier allows subdomain cookies to be accessed by the parent domain, which allows (no CVSS)
- [CVE-2007-0743](https://cve.now/CVE-2007-0743.md): URLMount in Apple Mac OS X 10.3.9 through 10.4.9 passes the username and password credentials for mounting filesystems on SMB servers as com (no CVSS)
- [CVE-2007-0744](https://cve.now/CVE-2007-0744.md): SMB in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment when executing commands, which allows local users to gai (no CVSS)
- [CVE-2007-0746](https://cve.now/CVE-2007-0746.md): Heap-based buffer overflow in the VideoConference framework in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-0747](https://cve.now/CVE-2007-0747.md): load\_webdav in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment when mounting a WebDAV filesystem, which allows (no CVSS)
- [CVE-2007-2178](https://cve.now/CVE-2007-2178.md): Multiple unspecified vulnerabilities in Objective Development Sharity before 3.3 allow remote attackers to cause a denial of service (daemon (no CVSS)
- [CVE-2007-2179](https://cve.now/CVE-2007-2179.md): Multiple unspecified vulnerabilities in IXceedCompression in XceddZipLib (RaidenFTPD.dll) in RaidenFTPD 2.4 allow remote attackers to cause (no CVSS)
- [CVE-2007-2180](https://cve.now/CVE-2007-2180.md): Buffer overflow in Nullsoft Winamp 5.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted WMV file. (no CVSS)
- [CVE-2007-2181](https://cve.now/CVE-2007-2181.md): PHP remote file inclusion vulnerability in admin/login.php in Webinsta FM Manager 0.1.4 and earlier allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-2182](https://cve.now/CVE-2007-2182.md): Unrestricted file upload vulnerability in forum\_write.php in Maran PHP Forum allows remote attackers to upload and execute arbitrary PHP fil (no CVSS)
- [CVE-2007-2183](https://cve.now/CVE-2007-2183.md): SQL injection vulnerability in index.php in PHP-Ring Webring System (aka uPHP\_ring\_website) 0.9 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-2184](https://cve.now/CVE-2007-2184.md): Directory traversal vulnerability in imgsrv.php in jchit counter 1.0.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-2185](https://cve.now/CVE-2007-2185.md): Multiple PHP remote file inclusion vulnerabilities in Supasite 1.23b allow remote attackers to execute arbitrary PHP code via a URL in the s (no CVSS)
- [CVE-2007-2186](https://cve.now/CVE-2007-2186.md): Foxit Reader 2.0 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document. (no CVSS)
- [CVE-2007-2187](https://cve.now/CVE-2007-2187.md): Stack-based buffer overflow in eXtremail 2.1.1 and earlier allows remote attackers to execute arbitrary code via a long DNS response. (no CVSS)
- [CVE-2007-2188](https://cve.now/CVE-2007-2188.md): eXtremail 2.1.1 and earlier does not verify the ID field (aka transaction id) in DNS responses, which makes it easier for remote attackers t (no CVSS)
- [CVE-2007-2189](https://cve.now/CVE-2007-2189.md): PHP remote file inclusion vulnerability in admin/admin\_album\_otf.php in the MX Smartor Full Album Pack (FAP) 2.0 RC1 module for mxBB allows (no CVSS)
- [CVE-2007-2190](https://cve.now/CVE-2007-2190.md): PHP remote file inclusion vulnerability in admin/public/webpages.php in Eba News 1.1 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-2191](https://cve.now/CVE-2007-2191.md): Multiple cross-site scripting (XSS) vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2007-2192](https://cve.now/CVE-2007-2192.md): Buffer overflow in Photofiltre Studio 8.1.1 allows user-assisted remote attackers to execute arbitrary code via a crafted .tif file. (no CVSS)
- [CVE-2007-2193](https://cve.now/CVE-2007-2193.md): Stack-based buffer overflow in the ID\_X.apl plugin in ACDSee 9.0 Build 108, Pro 8.1 Build 99, and Photo Editor 4.0 Build 195 allows user-ass (no CVSS)
- [CVE-2007-2194](https://cve.now/CVE-2007-2194.md): Stack-based buffer overflow in XnView 1.90.3 allows user-assisted remote attackers to execute arbitrary code via a crafted XPM file with a l (no CVSS)
- [CVE-2007-2195](https://cve.now/CVE-2007-2195.md): aMSN (aka Alvaro's Messenger) 0.96 and earlier allows remote attackers to cause a denial of service (application crash) by sending invalid d (no CVSS)
- [CVE-2007-2196](https://cve.now/CVE-2007-2196.md): PHP remote file inclusion vulnerability in jambook.php in the Jambook (com\_Jambook) 1.0 beta7 module for Mambo and Joomla! allows remote att (no CVSS)
- [CVE-2007-2197](https://cve.now/CVE-2007-2197.md): Race condition in the NeatUpload ASP.NET component 1.2.11 through 1.2.16, 1.1.18 through 1.1.23, and trunk.379 through trunk.445 allows remo (no CVSS)
- [CVE-2007-0443](https://cve.now/CVE-2007-0443.md): Multiple buffer overflows in the CDDBControl ActiveX control in Gracenote CDDB before 20070418 allow remote attackers to execute arbitrary c (no CVSS)
- [CVE-2007-0725](https://cve.now/CVE-2007-0725.md): Buffer overflow in the AirPortDriver module for AirPort in Apple Mac OS X 10.3.9 through 10.4.9, when running on hardware with the original (no CVSS)
- [CVE-2007-0729](https://cve.now/CVE-2007-0729.md): Apple File Protocol (AFP) Client in Apple Mac OS X 10.3.9 through 10.4.9 does not properly clean the environment before executing commands, (no CVSS)
- [CVE-2007-0732](https://cve.now/CVE-2007-0732.md): Unspecified vulnerability in the CoreServices daemon in CarbonCore in Apple Mac OS X 10.4 through 10.4.9 allows local users to gain privileg (no CVSS)
- [CVE-2007-1353](https://cve.now/CVE-2007-1353.md): The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to rea (no CVSS)
- [CVE-2007-2173](https://cve.now/CVE-2007-2173.md): Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before (no CVSS)
- [CVE-2007-2174](https://cve.now/CVE-2007-2174.md): The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal Engine (SRE) in Check Point ZoneAlarm before 5.0.156.0 allows local users (no CVSS)
- [CVE-2007-2175](https://cve.now/CVE-2007-2175.md): Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to exe (no CVSS)
- [CVE-2007-2176](https://cve.now/CVE-2007-2176.md): Unspecified vulnerability in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving Javascript (no CVSS)
- [CVE-2007-2177](https://cve.now/CVE-2007-2177.md): Stack-based buffer overflow in the Microgaming Download Helper ActiveX control (dlhelper.dll) before 7.2.0.19, and the WebHandler Class cont (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.