# CVEs published 2007-04-25

45 CVEs were published on April 25, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4838](https://cve.now/CVE-2005-4838.md): Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attack (no CVSS)
- [CVE-2006-7197](https://cve.now/CVE-2006-7197.md): The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp\_process\_callbac (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-2139](https://cve.now/CVE-2007-2139.md): Multiple stack-based buffer overflows in the SUN RPC service in CA (formerly Computer Associates) BrightStor ARCserve Media Server, as used (no CVSS)
- [CVE-2007-2265](https://cve.now/CVE-2007-2265.md): Cross-site scripting (XSS) vulnerability in YA Book 0.98-alpha allows remote attackers to inject arbitrary web script or HTML via the City f (no CVSS)
- [CVE-2007-2266](https://cve.now/CVE-2007-2266.md): Progress Webspeed Messenger allows remote attackers to read, create, modify, and execute arbitrary files by invoking webutil/\_cpyfile.p in t (no CVSS)
- [CVE-2007-2267](https://cve.now/CVE-2007-2267.md): Unspecified vulnerability in Sun Cluster 3.1 and Solaris Cluster 3.2 before 20070424 allows remote authenticated users, operating from a dif (no CVSS)
- [CVE-2007-2268](https://cve.now/CVE-2007-2268.md): Multiple directory traversal vulnerabilities in SWsoft Plesk for Windows 7.6.1, 8.1.0, and 8.1.1 allow remote attackers to read arbitrary fi (no CVSS)
- [CVE-2007-2269](https://cve.now/CVE-2007-2269.md): Directory traversal vulnerability in top.php3 in SWsoft Plesk for Windows 8.1 and 8.1.1 allows remote attackers to read arbitrary files via (no CVSS)
- [CVE-2007-2270](https://cve.now/CVE-2007-2270.md): The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service (device reboot) via a 0377 (0xff) character in the From h (no CVSS)
- [CVE-2007-2271](https://cve.now/CVE-2007-2271.md): Directory traversal vulnerability in Rajneel Lal TotaRam USP FOSS Distribution 1.01 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-2272](https://cve.now/CVE-2007-2272.md): PHP remote file inclusion vulnerability in docs/front-end-demo/cart2.php in Advanced Webhost Billing System (AWBS) 2.4.0 allows remote attac (no CVSS)
- [CVE-2007-2273](https://cve.now/CVE-2007-2273.md): PHP remote file inclusion vulnerability in include/loading.php in Alessandro Lulli wavewoo 0.1.1 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2007-2274](https://cve.now/CVE-2007-2274.md): The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via (no CVSS)
- [CVE-2007-2275](https://cve.now/CVE-2007-2275.md): Unspecified vulnerability in HP StorageWorks Command View Advanced Edition for XP before 5.6.0-01, XP Replication Monitor before 5.6.0-01, a (no CVSS)
- [CVE-2007-2276](https://cve.now/CVE-2007-2276.md): 3Com TippingPoint IPS allows remote attackers to cause a denial of service (device hang) via a flood of packets on TCP port 80 with sequenti (no CVSS)
- [CVE-2007-2277](https://cve.now/CVE-2007-2277.md): Session fixation vulnerability in Plogger allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. (no CVSS)
- [CVE-2007-2278](https://cve.now/CVE-2007-2278.md): Multiple PHP remote file inclusion vulnerabilities in DCP-Portal 6.1.1 allow remote attackers to execute arbitrary PHP code via a URL in (1) (no CVSS)
- [CVE-2007-2252](https://cve.now/CVE-2007-2252.md): Directory traversal vulnerability in iconspopup.php in Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain sensitive inf (no CVSS)
- [CVE-2007-2253](https://cve.now/CVE-2007-2253.md): Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain path information via a direct request for (1) sdk/blanks/formcontrol (no CVSS)
- [CVE-2007-2254](https://cve.now/CVE-2007-2254.md): PHP remote file inclusion vulnerability in admin/setup/level2.php in PHP Classifieds 6.04, and probably earlier versions, allows remote atta (no CVSS)
- [CVE-2007-2255](https://cve.now/CVE-2007-2255.md): Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2007-2256](https://cve.now/CVE-2007-2256.md): Cross-site scripting (XSS) vulnerability in you.php in TJSChat 0.95 allows remote attackers to inject arbitrary web script or HTML via the u (no CVSS)
- [CVE-2007-2257](https://cve.now/CVE-2007-2257.md): PHP remote file inclusion vulnerability in subscp.php in Fully Modded phpBB2 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-2258](https://cve.now/CVE-2007-2258.md): PHP remote file inclusion vulnerability in includes/init.inc.php in PHPMyBibli allows remote attackers to execute arbitrary PHP code via a U (no CVSS)
- [CVE-2007-2259](https://cve.now/CVE-2007-2259.md): SQL injection vulnerability in forum.php in EsForum 3.0 allows remote attackers to execute arbitrary SQL commands via the idsalon parameter. (no CVSS)
- [CVE-2007-2260](https://cve.now/CVE-2007-2260.md): Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-2261](https://cve.now/CVE-2007-2261.md): PHP remote file inclusion vulnerability in espaces/communiques/annotations.php in C-Arbre 0.6PR7 and earlier allows remote attackers to exec (no CVSS)
- [CVE-2007-2262](https://cve.now/CVE-2007-2262.md): Multiple PHP remote file inclusion vulnerabilities in html/php/detail.php in Sinato jmuffin allow remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-2242](https://cve.now/CVE-2007-2242.md): The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6\_RTHDR\_TYPE\_0) that create (no CVSS)
- [CVE-2007-2243](https://cve.now/CVE-2007-2243.md): OpenSSH 4.6 and earlier, when ChallengeResponseAuthentication is enabled, allows remote attackers to determine the existence of user account (no CVSS)
- [CVE-2007-2244](https://cve.now/CVE-2007-2244.md): Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9 allow user-assisted remote attackers to execute arbi (no CVSS)
- [CVE-2007-2245](https://cve.now/CVE-2007-2245.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-2246](https://cve.now/CVE-2007-2246.md): Unspecified vulnerability in HP-UX B.11.00 and B.11.11, when running sendmail 8.9.3 or 8.11.1; and HP-UX B.11.23 when running sendmail 8.11. (no CVSS)
- [CVE-2007-2247](https://cve.now/CVE-2007-2247.md): SQL injection vulnerability in modules/news/article.php in phpMySpace Gold 8.10 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2007-2248](https://cve.now/CVE-2007-2248.md): Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2007-2249](https://cve.now/CVE-2007-2249.md): include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user\_id (no CVSS)
- [CVE-2007-2250](https://cve.now/CVE-2007-2250.md): admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module\[\] parameter. (no CVSS)
- [CVE-2007-2251](https://cve.now/CVE-2007-2251.md): Unspecified vulnerability in the Roles module in Xaraya 1.1.2 and earlier allows attackers to gain privileges via unspecified vectors, proba (no CVSS)
- [CVE-2007-2230](https://cve.now/CVE-2007-2230.md): SQL injection vulnerability in CA Clever Path Portal allows remote authenticated users to execute limited SQL commands and retrieve arbitrar (no CVSS)
- [CVE-2007-2231](https://cve.now/CVE-2007-2231.md): Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attacke (no CVSS)
- [CVE-2007-2232](https://cve.now/CVE-2007-2232.md): The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\\r) sequences in the cos (no CVSS)
- [CVE-2007-2233](https://cve.now/CVE-2007-2233.md): cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by (no CVSS)
- [CVE-2007-2234](https://cve.now/CVE-2007-2234.md): include/common.php in PunBB 1.2.14 and earlier does not properly handle a disabled ini\_get function when checking the register\_globals setti (no CVSS)
- [CVE-2007-2235](https://cve.now/CVE-2007-2235.md): Multiple cross-site scripting (XSS) vulnerabilities in PunBB 1.2.14 and earlier allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-2236](https://cve.now/CVE-2007-2236.md): footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) atta (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.