# CVEs published 2007-04-27

28 CVEs were published on April 27, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2348](https://cve.now/CVE-2007-2348.md): mirror --script in lftp before 3.5.9 does not properly quote shell metacharacters, which might allow remote user-assisted attackers to execu (no CVSS)
- [CVE-2007-2343](https://cve.now/CVE-2007-2343.md): Stack-based buffer overflow in the TFTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlie (no CVSS)
- [CVE-2007-2344](https://cve.now/CVE-2007-2344.md): The BOOTPD component in Enterasys NetSight Console 2.1 and NetSight Inventory Manager 2.1, and possibly earlier, on Windows allows remote at (no CVSS)
- [CVE-2007-2345](https://cve.now/CVE-2007-2345.md): PHP remote file inclusion vulnerability in include/include\_stream.inc.php in CodeWand phpBrowse allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-2346](https://cve.now/CVE-2007-2346.md): Multiple PHP remote file inclusion vulnerabilities in PHP-Generics 1.0 beta allow remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2007-2347](https://cve.now/CVE-2007-2347.md): PHP remote file inclusion vulnerability in main/forum/komentar.php in OneClick CMS (aka Sisplet CMS) 05.10 and earlier allows remote attacke (no CVSS)
- [CVE-2007-2332](https://cve.now/CVE-2007-2332.md): Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 6\_05.140 uses a fixed DES key to encrypt passwords, which allows remote (no CVSS)
- [CVE-2007-2333](https://cve.now/CVE-2007-2333.md): Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5\_05.149, 5\_05.3xx before 5\_05.304, and 6.x before 6\_05.140 includes the (no CVSS)
- [CVE-2007-2334](https://cve.now/CVE-2007-2334.md): Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5\_05.149, 5\_05.3xx before 5\_05.304, and 6.x before 6\_05.140 has two temp (no CVSS)
- [CVE-2007-2335](https://cve.now/CVE-2007-2335.md): Cross-site scripting (XSS) vulnerability in the RSS feed reader functionality in Lunascape 4.1.3 build2 and earlier allows remote attackers (no CVSS)
- [CVE-2007-2336](https://cve.now/CVE-2007-2336.md): Unspecified vulnerability in InterVations NaviCOPA Web Server 2.01 20070323 allows remote attackers to cause a denial of service (daemon cra (no CVSS)
- [CVE-2007-2337](https://cve.now/CVE-2007-2337.md): Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS 0.96.6 Alpha and earlier allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-2338](https://cve.now/CVE-2007-2338.md): Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unau (no CVSS)
- [CVE-2007-2339](https://cve.now/CVE-2007-2339.md): Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified r (no CVSS)
- [CVE-2007-2340](https://cve.now/CVE-2007-2340.md): Multiple PHP remote file inclusion vulnerabilities in inc/include\_all.inc.php in phporacleview allow remote attackers to execute arbitrary P (no CVSS)
- [CVE-2007-2341](https://cve.now/CVE-2007-2341.md): PHP remote file inclusion vulnerability in suite/index.php in phpBandManager 0.8 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-2342](https://cve.now/CVE-2007-2342.md): SQL injection vulnerability in error.asp in CreaScripts CreaDirectory 1.2 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-2321](https://cve.now/CVE-2007-2321.md): Unspecified vulnerability in the search functionality in SilverStripe 2.0.0 has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-2322](https://cve.now/CVE-2007-2322.md): NMMediaServer.exe in Nero MediaHome 2.5.5.0 and CE 1.3.0.4 allows remote attackers to cause a denial of service (NULL dereference and applic (no CVSS)
- [CVE-2007-2323](https://cve.now/CVE-2007-2323.md): Multiple buffer overflows in the WinDVDX ActiveX control in InterVideo Home Theater 2.1.13.0 and 2.5.13.58 allow remote attackers to execute (no CVSS)
- [CVE-2007-2324](https://cve.now/CVE-2007-2324.md): Directory traversal vulnerability in file.php in JulmaCMS 1.4 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-2325](https://cve.now/CVE-2007-2325.md): PHP remote file inclusion vulnerability in include.php in MyNewsGroups :) allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-2326](https://cve.now/CVE-2007-2326.md): Multiple PHP remote file inclusion vulnerabilities in HYIP Manager Pro allow remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2007-2327](https://cve.now/CVE-2007-2327.md): PHP remote file inclusion vulnerability in \_editor.php in HTMLeditbox 2.2 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-2328](https://cve.now/CVE-2007-2328.md): PHP remote file inclusion vulnerability in addvip.php in phpMYTGP 1.4b allows remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2007-2329](https://cve.now/CVE-2007-2329.md): PHP remote file inclusion vulnerability in searchbot.php in Searchactivity allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2007-2330](https://cve.now/CVE-2007-2330.md): PHP remote file inclusion vulnerability in includes\_handler.php in DynaTracker 151 allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-2331](https://cve.now/CVE-2007-2331.md): PHP remote file inclusion vulnerability in cart.php in Shop-Script 2.0 allows remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.