# CVEs published 2007-04-30

47 CVEs were published on April 30, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-7199](https://cve.now/CVE-2006-7199.md): EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in which an attacker-con (no CVSS)
- [CVE-2006-7200](https://cve.now/CVE-2006-7200.md): EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it (no CVSS)
- [CVE-2006-7201](https://cve.now/CVE-2006-7201.md): EMC RSA Security SiteKey does not set the secure qualifier on the SiteKey Flash token (aka the PassMark Flash shared object), which might al (no CVSS)
- [CVE-2007-2367](https://cve.now/CVE-2007-2367.md): Buffer overflow in wserve\_console.exe in Wserve HTTP Server (whttp) 4.6 allows remote attackers to cause a denial of service (forced applica (no CVSS)
- [CVE-2007-2368](https://cve.now/CVE-2007-2368.md): picture.php in WebSPELL 4.01.02 and earlier allows remote attackers to read arbitrary files via the file parameter. (no CVSS)
- [CVE-2007-2369](https://cve.now/CVE-2007-2369.md): Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to (no CVSS)
- [CVE-2007-2370](https://cve.now/CVE-2007-2370.md): SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2007-2371](https://cve.now/CVE-2007-2371.md): admin/index.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier provides access to configuration modification before login, which (no CVSS)
- [CVE-2007-2372](https://cve.now/CVE-2007-2372.md): admin/send\_mod.php in Gregory Kokanosky phpMyNewsletter 0.8 beta5 and earlier prints a Location header but does not exit when administrative (no CVSS)
- [CVE-2007-2373](https://cve.now/CVE-2007-2373.md): SQL injection vulnerability in viewcat.php in the WF-Links (wflinks) 1.03 and earlier module for XOOPS allows remote attackers to execute ar (no CVSS)
- [CVE-2007-2374](https://cve.now/CVE-2007-2374.md): Unspecified vulnerability in Microsoft Windows 2000, XP, and Server 2003 allows user-assisted remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2007-2375](https://cve.now/CVE-2007-2375.md): The agent remote upgrade interface in Symantec Enterprise Security Manager (ESM) before 20070405 does not verify the authenticity of upgrade (no CVSS)
- [CVE-2007-2376](https://cve.now/CVE-2007-2376.md): The Dojo framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attac (no CVSS)
- [CVE-2007-2377](https://cve.now/CVE-2007-2377.md): The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protecti (no CVSS)
- [CVE-2007-2378](https://cve.now/CVE-2007-2378.md): The Google Web Toolkit (GWT) framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which (no CVSS)
- [CVE-2007-2379](https://cve.now/CVE-2007-2379.md): The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote att (no CVSS)
- [CVE-2007-2380](https://cve.now/CVE-2007-2380.md): The Microsoft Atlas framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows r (no CVSS)
- [CVE-2007-2381](https://cve.now/CVE-2007-2381.md): The MochiKit framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote a (no CVSS)
- [CVE-2007-2382](https://cve.now/CVE-2007-2382.md): The Moo.fx framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote att (no CVSS)
- [CVE-2007-2383](https://cve.now/CVE-2007-2383.md): The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protecti (no CVSS)
- [CVE-2007-2384](https://cve.now/CVE-2007-2384.md): The Script.aculo.us framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows r (no CVSS)
- [CVE-2007-2385](https://cve.now/CVE-2007-2385.md): The Yahoo! UI framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote (no CVSS)
- [CVE-2006-4520](https://cve.now/CVE-2006-4520.md): ncp in Novell eDirectory before 8.7.3 SP9, and 8.8.x before 8.8.1 FTF2, does not properly handle NCP fragments with a negative length, which (no CVSS)
- [CVE-2006-7198](https://cve.now/CVE-2006-7198.md): Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impac (no CVSS)
- [CVE-2007-2029](https://cve.now/CVE-2007-2029.md): File descriptor leak in the PDF handler in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service via a crafted PDF fi (no CVSS)
- [CVE-2007-2053](https://cve.now/CVE-2007-2053.md): Multiple stack-based buffer overflows in AFFLIB before 2.2.6 allow remote attackers to cause a denial of service (crash) or possibly execute (no CVSS)
- [CVE-2007-2054](https://cve.now/CVE-2007-2054.md): Multiple format string vulnerabilities in AFFLIB before 2.2.6 allow remote attackers to execute arbitrary code via certain command line para (no CVSS)
- [CVE-2007-2055](https://cve.now/CVE-2007-2055.md): AFFLIB 2.2.8 and earlier allows attackers to execute arbitrary commands via shell metacharacters involving (1) certain command line paramete (no CVSS)
- [CVE-2007-2349](https://cve.now/CVE-2007-2349.md): Cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) 2.1.x and 2.2.x allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-2350](https://cve.now/CVE-2007-2350.md): admin/config.php in the music-on-hold module in freePBX 2.2.x allows remote authenticated administrators to execute arbitrary commands via s (no CVSS)
- [CVE-2007-2351](https://cve.now/CVE-2007-2351.md): Unspecified vulnerability in the HP Power Manager Remote Agent (RA) 4.0Build10 and earlier in HP-UX B.11.11 and B.11.23 allows local users t (no CVSS)
- [CVE-2007-2352](https://cve.now/CVE-2007-2352.md): Multiple format string vulnerabilities in AFFLIB 2.2.6 allow remote attackers to execute arbitrary code via certain command line parameters, (no CVSS)
- [CVE-2007-2353](https://cve.now/CVE-2007-2353.md): Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installati (no CVSS, org.apache.axis:axis)
- [CVE-2007-2354](https://cve.now/CVE-2007-2354.md): Progress Webspeed Messenger allows remote attackers to obtain sensitive information via a WService parameter containing "wsbroker1/webutil/a (no CVSS)
- [CVE-2007-2355](https://cve.now/CVE-2007-2355.md): The get\_url function in DODS\_Dispatch.pm for the CGI\_server in OPeNDAP 3 allows remote attackers to execute arbitrary commands via shell met (no CVSS)
- [CVE-2007-2356](https://cve.now/CVE-2007-2356.md): Stack-based buffer overflow in the set\_color\_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote atta (no CVSS)
- [CVE-2007-2357](https://cve.now/CVE-2007-2357.md): Cross-site scripting (XSS) vulnerability in mods/Core/result.php in SineCms 2.3.4 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-2358](https://cve.now/CVE-2007-2358.md): Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the (1) (no CVSS)
- [CVE-2007-2359](https://cve.now/CVE-2007-2359.md): Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec Syste (no CVSS)
- [CVE-2007-2360](https://cve.now/CVE-2007-2360.md): Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of re (no CVSS)
- [CVE-2007-2361](https://cve.now/CVE-2007-2361.md): Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of re (no CVSS)
- [CVE-2007-2362](https://cve.now/CVE-2007-2362.md): Multiple buffer overflows in MyDNS 1.1.0 allow remote attackers to (1) cause a denial of service (daemon crash) and possibly execute arbitra (no CVSS)
- [CVE-2007-2363](https://cve.now/CVE-2007-2363.md): Buffer overflow in IrfanView 4.00 and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted .IFF file. (no CVSS)
- [CVE-2007-2364](https://cve.now/CVE-2007-2364.md): Multiple PHP remote file inclusion vulnerabilities in burnCMS 0.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-2365](https://cve.now/CVE-2007-2365.md): Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers (no CVSS)
- [CVE-2007-2366](https://cve.now/CVE-2007-2366.md): Buffer overflow in Corel Paint Shop Pro 11.20 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file. (no CVSS)
- [CVE-2005-4839](https://cve.now/CVE-2005-4839.md): PureTLS before 0.9b5 does not clear optional Extensions and Algorithm.Parameters values before parsing, which might trigger an information l (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.