# CVEs published 2007-05-02

55 CVEs were published on May 2, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2007-2469](https://cve.now/CVE-2007-2469.md): SQL injection vulnerability in index.php in FileRun 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the fid pa (no CVSS)
- [CVE-2007-2470](https://cve.now/CVE-2007-2470.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in FileRun 1.0 and earlier allow remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2007-2471](https://cve.now/CVE-2007-2471.md): Directory traversal vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to read arbitrary files via a full p (no CVSS)
- [CVE-2007-2472](https://cve.now/CVE-2007-2472.md): Cross-site scripting (XSS) vulnerability in sendcard.php in Sendcard 3.4.1 and earlier allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-2473](https://cve.now/CVE-2007-2473.md): SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-2474](https://cve.now/CVE-2007-2474.md): Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools SunShop Shopping Cart 4.0 allow remote attackers to execute arbitrar (no CVSS)
- [CVE-2007-2475](https://cve.now/CVE-2007-2475.md): Unspecified vulnerability in the ADSCHEMA utility in Novell SecureLogin (NSL) 6 SP1 before 6.0.106 has unknown impact and remote attack vect (no CVSS)
- [CVE-2007-2476](https://cve.now/CVE-2007-2476.md): Unspecified vulnerability in Novell SecureLogin (NSL) 6 SP1 before 6.0.106 has unknown impact and remote attack vectors, related to Active D (no CVSS)
- [CVE-2007-0771](https://cve.now/CVE-2007-0771.md): The utrace support in Linux kernel 2.6.18, and other versions, allows local users to cause a denial of service (system hang) related to "MT (no CVSS)
- [CVE-2007-2418](https://cve.now/CVE-2007-2418.md): Heap-based buffer overflow in the Rendezvous / Extensible Messaging and Presence Protocol (XMPP) component (plugins\\rendezvous.dll) for Ceru (no CVSS)
- [CVE-2007-2461](https://cve.now/CVE-2007-2461.md): The DHCP relay agent in Cisco Adaptive Security Appliance (ASA) and PIX 7.2 allows remote attackers to cause a denial of service (dropped pa (no CVSS)
- [CVE-2007-2462](https://cve.now/CVE-2007-2462.md): Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) and PIX 7.2 before 7.2(2)8, when using Layer 2 Tunneling Protocol (L2TP (no CVSS)
- [CVE-2007-2463](https://cve.now/CVE-2007-2463.md): Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)17 allows remote attac (no CVSS)
- [CVE-2007-2464](https://cve.now/CVE-2007-2464.md): Race condition in Cisco Adaptive Security Appliance (ASA) and PIX 7.1 before 7.1(2)49 and 7.2 before 7.2(2)19, when using "clientless SSL VP (no CVSS)
- [CVE-2007-2465](https://cve.now/CVE-2007-2465.md): Unspecified vulnerability in Sun Solaris 9, when Solaris Auditing (BSM) is enabled for file read, write, attribute modify, create, or delete (no CVSS)
- [CVE-2007-2466](https://cve.now/CVE-2007-2466.md): Unspecified vulnerability in the LDAP Software Development Kit (SDK) for C, as used in Sun Java System Directory Server 5.2 up to Patch 4 an (no CVSS)
- [CVE-2007-2467](https://cve.now/CVE-2007-2467.md): ZoneAlarm Pro 6.5.737.000, 6.1.744.001, and possibly earlier versions and other products, allows local users to cause a denial of service (s (no CVSS)
- [CVE-2007-2468](https://cve.now/CVE-2007-2468.md): Unspecified vulnerability in HP OpenVMS for Integrity Servers 8.2-1 and 8.3 allows local users to cause a denial of service (crash) via "Pro (no CVSS)
- [CVE-2007-0745](https://cve.now/CVE-2007-0745.md): The Apple Security Update 2007-004 uses an incorrect configuration file for FTPServer in Apple Mac OS X Server 10.4.9, which might allow rem (no CVSS)
- [CVE-2007-2438](https://cve.now/CVE-2007-2438.md): The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attacker (no CVSS)
- [CVE-2007-1859](https://cve.now/CVE-2007-1859.md): XScreenSaver 4.10, when using a remote directory service for credentials, does not properly handle the results from the getpwuid function in (no CVSS)
- [CVE-2007-1069](https://cve.now/CVE-2007-1069.md): The memory management in VMware Workstation before 5.5.4 allows attackers to cause a denial of service (Windows virtual machine crash) by tr (no CVSS)
- [CVE-2007-1337](https://cve.now/CVE-2007-1337.md): The virtual machine process (VMX) in VMware Workstation before 5.5.4 does not properly read state information when moving from the ACPI slee (no CVSS)
- [CVE-2007-1744](https://cve.now/CVE-2007-1744.md): Directory traversal vulnerability in the Shared Folders feature for VMware Workstation before 5.5.4, when a folder is shared, allows users o (no CVSS)
- [CVE-2007-1876](https://cve.now/CVE-2007-1876.md): VMware Workstation before 5.5.4, when running a 64-bit Windows guest on a 64-bit host, allows local users to "corrupt the virtual machine's (no CVSS)
- [CVE-2007-1877](https://cve.now/CVE-2007-1877.md): VMware Workstation before 5.5.4 allows attackers to cause a denial of service against the guest OS by causing the virtual machine process (V (no CVSS)
- [CVE-2007-0655](https://cve.now/CVE-2007-0655.md): The MicroWorld Agent service (MWAGENT.EXE) in MicroWorld Technologies eScan 8.0.671.1, and possibly other versions, allows remote or local a (no CVSS)
- [CVE-2007-2457](https://cve.now/CVE-2007-2457.md): PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to ex (no CVSS)
- [CVE-2007-2458](https://cve.now/CVE-2007-2458.md): Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-2459](https://cve.now/CVE-2007-2459.md): Heap-based buffer overflow in the BMP reader (bmp.c) in Imager perl module (libimager-perl) 0.45 through 0.56 allows remote attackers to cau (no CVSS)
- [CVE-2007-2460](https://cve.now/CVE-2007-2460.md): PHP remote file inclusion vulnerability in modules/admin/include/config.php in FireFly 1.1.01 and earlier allows remote attackers to execute (no CVSS)
- [CVE-2007-1320](https://cve.now/CVE-2007-1320.md): Multiple heap-based buffer overflows in the cirrus\_invalidate\_region function in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and (no CVSS)
- [CVE-2007-1322](https://cve.now/CVE-2007-1322.md): QEMU 0.8.2 allows local users to halt a virtual machine by executing the icebp instruction. (no CVSS)
- [CVE-2007-1366](https://cve.now/CVE-2007-1366.md): QEMU 0.8.2 allows local users to crash a virtual machine via the divisor operand to the aam instruction, as demonstrated by "aam 0x0," which (no CVSS)
- [CVE-2007-2454](https://cve.now/CVE-2007-2454.md): Heap-based buffer overflow in the VGA device in Parallels allows local users, with root access to the guest operating system, to terminate t (no CVSS)
- [CVE-2007-2455](https://cve.now/CVE-2007-2455.md): Parallels allows local users to cause a denial of service (virtual machine abort) via (1) certain INT instructions, as demonstrated by INT 0 (no CVSS)
- [CVE-2007-2456](https://cve.now/CVE-2007-2456.md): Multiple PHP remote file inclusion vulnerabilities in FireFly 1.1.01 allow remote attackers to execute arbitrary PHP code via a URL in the d (no CVSS)
- [CVE-2007-2241](https://cve.now/CVE-2007-2241.md): Unspecified vulnerability in query.c in ISC BIND 9.4.0, and 9.5.0a1 through 9.5.0a3, when recursion is enabled, allows remote attackers to c (no CVSS)
- [CVE-2007-2432](https://cve.now/CVE-2007-2432.md): Cross-site scripting (XSS) vulnerability in utilities/search.asp in nukedit 4.9.7b allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-2433](https://cve.now/CVE-2007-2433.md): Cross-site scripting (XSS) vulnerability in index.php in Ariadne 2.4.1 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-2434](https://cve.now/CVE-2007-2434.md): Buffer overflow in asnsp.dll in Aventail Connect 4.1.2.13 allows remote attackers to cause a denial of service (application crash) or execut (no CVSS)
- [CVE-2007-2435](https://cve.now/CVE-2007-2435.md): Sun Java Web Start in JDK and JRE 5.0 Update 10 and earlier, and Java Web Start in SDK and JRE 1.4.2\_13 and earlier, allows remote attackers (no CVSS)
- [CVE-2007-2437](https://cve.now/CVE-2007-2437.md): The X render (Xrender) extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated use (no CVSS)
- [CVE-2007-2420](https://cve.now/CVE-2007-2420.md): SQL injection vulnerability in bry.asp in Burak Yilmaz Blog 1.0 allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2007-2421](https://cve.now/CVE-2007-2421.md): Buffer overflow in Hitachi Groupmax Mobile Option for Mobile-Phone 07-00 through 07-30, 5 for i-mode 05-11 through 05-23, and 6 for EZweb 06 (no CVSS)
- [CVE-2007-2422](https://cve.now/CVE-2007-2422.md): Multiple PHP remote file inclusion vulnerabilities in Modules Builder (modbuild) 4.1 for Comdev One Admin allow remote attackers to execute (CVSS 9.8)
- [CVE-2007-2423](https://cve.now/CVE-2007-2423.md): Cross-site scripting (XSS) vulnerability in index.php in MoinMoin 1.5.7 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2007-2424](https://cve.now/CVE-2007-2424.md): PHP remote file inclusion vulnerability in help/index.php in The Merchant (themerchant) 2.2 allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-2425](https://cve.now/CVE-2007-2425.md): Directory traversal vulnerability in fileview.php in Imageview 5.3 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-2426](https://cve.now/CVE-2007-2426.md): PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows r (no CVSS)
- [CVE-2007-2427](https://cve.now/CVE-2007-2427.md): SQL injection vulnerability in index.php in the pnFlashGames 1.5 module for PostNuke allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-2428](https://cve.now/CVE-2007-2428.md): Multiple PHP remote file inclusion vulnerabilities in page.php in Ahhp-Portal allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-2429](https://cve.now/CVE-2007-2429.md): ManageEngine PasswordManager Pro (PMP) allows remote attackers to obtain administrative access to a database by injecting a certain command (no CVSS)
- [CVE-2007-2430](https://cve.now/CVE-2007-2430.md): shared/code/tce\_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file conten (no CVSS)
- [CVE-2007-2431](https://cve.now/CVE-2007-2431.md): Dynamic variable evaluation vulnerability in shared/config/tce\_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.