# CVEs published 2007-05-09

79 CVEs were published on May 9, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2005-4836](https://cve.now/CVE-2005-4836.md): The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which all (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2006-7195](https://cve.now/CVE-2006-7195.md): Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remot (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2006-7196](https://cve.now/CVE-2006-7196.md): Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0 (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-1280](https://cve.now/CVE-2007-1280.md): Cross-site scripting (XSS) vulnerability in Adobe RoboHelp X5, 6, and Server 6 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-1358](https://cve.now/CVE-2007-1358.md): Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows rem (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-1858](https://cve.now/CVE-2007-1858.md): The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain ins (no CVSS)
- [CVE-2007-2582](https://cve.now/CVE-2007-2582.md): Multiple buffer overflows in the DB2 JDBC Applet Server (DB2JDS) service in IBM DB2 9.x and earlier allow remote attackers to (1) execute ar (no CVSS)
- [CVE-2007-2583](https://cve.now/CVE-2007-2583.md): The in\_decimal::set function in item\_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to ca (no CVSS)
- [CVE-2007-2584](https://cve.now/CVE-2007-2584.md): Buffer overflow in the IsOldAppInstalled function in the McSubMgr.McSubMgr Subscription Manager ActiveX control (MCSUBMGR.DLL) in McAfee Sec (no CVSS)
- [CVE-2007-2585](https://cve.now/CVE-2007-2585.md): Stack-based buffer overflow in the Verify function in the BarCodeWiz ActiveX control 2.0 and 2.52 (BarcodeWiz.dll) allows remote attackers t (no CVSS)
- [CVE-2007-2586](https://cve.now/CVE-2007-2586.md): The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-2587](https://cve.now/CVE-2007-2587.md): The IOS FTP Server in Cisco IOS 11.3 through 12.4 allows remote authenticated users to cause a denial of service (IOS reload) via unspecifie (no CVSS)
- [CVE-2007-2588](https://cve.now/CVE-2007-2588.md): Multiple buffer overflows in the Office Viewer OCX ActiveX control (oa.ocx) 3.2 allow remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2007-2569](https://cve.now/CVE-2007-2569.md): Multiple PHP remote file inclusion vulnerabilities in Friendly 1.0d1 and earlier allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-2570](https://cve.now/CVE-2007-2570.md): PHP remote file inclusion vulnerability in handlers/page/show.php in Wikivi5 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-2571](https://cve.now/CVE-2007-2571.md): SQL injection vulnerability in index.php in the wfquotes 1.0 0 module for XOOPS allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2007-2572](https://cve.now/CVE-2007-2572.md): PHP remote file inclusion vulnerability in modules/noevents/templates/mfa\_theme.php in NoAh (aka PHP Content Architect, phparch) 0.9 pre 1.2 (no CVSS)
- [CVE-2007-2573](https://cve.now/CVE-2007-2573.md): PHP remote file inclusion vulnerability in plugin/HP\_DEV/cms2.php in PHPtree 1.3 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-2574](https://cve.now/CVE-2007-2574.md): Directory traversal vulnerability in index.php in Archangel Weblog 0.90.02 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-2575](https://cve.now/CVE-2007-2575.md): PHP remote file inclusion vulnerability in watermark.php in the vm (aka Jean-Francois Laflamme) watermark 0.4.1 mod for Gallery allows remot (no CVSS)
- [CVE-2007-2576](https://cve.now/CVE-2007-2576.md): Buffer overflow in the East Wind Software advdaudio.ocx 1.5.1.1 ActiveX control allows user-assisted remote attackers to execute arbitrary c (no CVSS)
- [CVE-2007-2577](https://cve.now/CVE-2007-2577.md): Multiple SQL injection vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to execute arbitrary SQL commands via (1) the mode paramete (no CVSS)
- [CVE-2007-2578](https://cve.now/CVE-2007-2578.md): Unspecified vulnerability in search/list/action\_search/index.php in ACP3 4.0 beta 3 allows remote attackers to have unknown impact, relating (no CVSS)
- [CVE-2007-2579](https://cve.now/CVE-2007-2579.md): Multiple cross-site scripting (XSS) vulnerabilities in ACP3 4.0 beta 3 allow remote attackers to inject arbitrary web script or HTML via (1) (no CVSS)
- [CVE-2007-2580](https://cve.now/CVE-2007-2580.md): Unspecified vulnerability in Apple Safari allows local users to obtain sensitive information (saved keychain passwords) via the document.log (no CVSS)
- [CVE-2007-2581](https://cve.now/CVE-2007-2581.md): Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoi (no CVSS)
- [CVE-2006-7202](https://cve.now/CVE-2006-7202.md): The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote at (no CVSS)
- [CVE-2007-0215](https://cve.now/CVE-2007-0215.md): Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execut (no CVSS)
- [CVE-2007-2556](https://cve.now/CVE-2007-2556.md): SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For (X\_FORWARD (no CVSS)
- [CVE-2007-2557](https://cve.now/CVE-2007-2557.md): MOStlyDB Admin in Mambo 4.6.1 does not properly check privileges, which allows remote authenticated administrators to have an unknown impact (no CVSS)
- [CVE-2007-2558](https://cve.now/CVE-2007-2558.md): PHP remote file inclusion vulnerability in index.php in phpFullAnnu CMS (pfa CMS) 6.0 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-2559](https://cve.now/CVE-2007-2559.md): Multiple PHP remote file inclusion vulnerabilities in american cart 3.5 allow remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2007-2560](https://cve.now/CVE-2007-2560.md): Directory traversal vulnerability in theme/acgv.php in ACGVannu 1.3 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-2561](https://cve.now/CVE-2007-2561.md): SQL injection vulnerability in index.asp in fipsCMS 2.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter, a d (no CVSS)
- [CVE-2007-2562](https://cve.now/CVE-2007-2562.md): Cross-site scripting (XSS) vulnerability in index.php in Kayako eSupport 3.00.90 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-2563](https://cve.now/CVE-2007-2563.md): Buffer overflow in the AddFile function in VersalSoft HTTP File Upload ActiveX control (UFileUploaderD.dll) allows remote attackers to execu (no CVSS)
- [CVE-2007-2564](https://cve.now/CVE-2007-2564.md): Multiple stack-based buffer overflows in the Sienzo Digital Music Mentor (DMM) 2.6.0.4 ActiveX control (DSKernel2.dll) allow remote attacker (no CVSS)
- [CVE-2007-2565](https://cve.now/CVE-2007-2565.md): Cdelia Software ImageProcessing allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted BMP fil (no CVSS)
- [CVE-2007-2566](https://cve.now/CVE-2007-2566.md): The SaveBarCode function in the Taltech Tal Bar Code ActiveX control allows remote attackers to cause a denial of service (disk consumption) (no CVSS)
- [CVE-2007-2567](https://cve.now/CVE-2007-2567.md): Buffer overflow in the SaveBarCode function in the Taltech Tal Bar Code ActiveX control allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2007-0605](https://cve.now/CVE-2007-0605.md): Cross-site scripting (XSS) vulnerability in picture.php in Advanced Guestbook 2.4.2 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-0608](https://cve.now/CVE-2007-0608.md): Advanced Guestbook 2.4.2 allows remote attackers to obtain sensitive information via an invalid (1) GB\_TBL parameter to (a) lang/codes-engli (no CVSS)
- [CVE-2007-0609](https://cve.now/CVE-2007-0609.md): Directory traversal vulnerability in Advanced Guestbook 2.4.2 allows remote attackers to bypass .htaccess settings, and execute arbitrary PH (no CVSS)
- [CVE-2007-2553](https://cve.now/CVE-2007-2553.md): Unspecified vulnerability in dop in HP Tru64 UNIX 5.1B-4, 5.1B-3, and 5.1A PK6 allows local users to gain privileges via a large amount of d (no CVSS)
- [CVE-2007-2554](https://cve.now/CVE-2007-2554.md): Associated Press (AP) Newspower 4.0.1 and earlier uses a default blank password for the MySQL root account, which allows remote attackers to (no CVSS)
- [CVE-2007-2555](https://cve.now/CVE-2007-2555.md): Unspecified vulnerability in Default.aspx in Podium CMS allows remote attackers to have an unknown impact, possibly session fixation, via a (no CVSS)
- [CVE-2007-2546](https://cve.now/CVE-2007-2546.md): Session fixation vulnerability in Simple Machines Forum (SMF) 1.1.2 and earlier allows remote attackers to hijack web sessions by setting th (no CVSS)
- [CVE-2007-2547](https://cve.now/CVE-2007-2547.md): Cross-site scripting (XSS) vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2007-2548](https://cve.now/CVE-2007-2548.md): Unspecified vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 has unknown impact and an l remote attack vector, relate (no CVSS)
- [CVE-2007-2549](https://cve.now/CVE-2007-2549.md): SQL injection vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2007-2550](https://cve.now/CVE-2007-2550.md): Multiple CRLF injection vulnerabilities in Devellion CubeCart 3.0.15 allow remote attackers to inject arbitrary HTTP headers and conduct HTT (no CVSS)
- [CVE-2007-2551](https://cve.now/CVE-2007-2551.md): Cross-site scripting (XSS) vulnerability in usersettings.php in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to inject arbi (no CVSS)
- [CVE-2007-2552](https://cve.now/CVE-2007-2552.md): The RecentChanges feature in WikkaWiki (Wikka Wiki) before 1.1.6.3 allows remote attackers to obtain the names, and possibly revision notes (no CVSS)
- [CVE-2007-1673](https://cve.now/CVE-2007-1673.md): unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loo (no CVSS)
- [CVE-2007-2535](https://cve.now/CVE-2007-2535.md): WinAce allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a pre (no CVSS)
- [CVE-2007-2536](https://cve.now/CVE-2007-2536.md): PicoZip allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a pr (no CVSS)
- [CVE-2007-2537](https://cve.now/CVE-2007-2537.md): Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL co (no CVSS)
- [CVE-2007-2538](https://cve.now/CVE-2007-2538.md): SQL injection vulnerability in class/debug/debug\_show.php in RunCms 1.5.2 and earlier allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2007-2539](https://cve.now/CVE-2007-2539.md): The show\_files function in RunCms 1.5.2 and earlier allows remote attackers to obtain sensitive information (file existence and file metadat (no CVSS)
- [CVE-2007-2540](https://cve.now/CVE-2007-2540.md): Multiple PHP remote file inclusion vulnerabilities in PMECMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-2541](https://cve.now/CVE-2007-2541.md): PHP remote file inclusion vulnerability in includes/ajax\_listado.php in Versado CMS 1.07 allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2007-2542](https://cve.now/CVE-2007-2542.md): PHP remote file inclusion vulnerability in header.php in workbench survival guide 0.11 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-2543](https://cve.now/CVE-2007-2543.md): SQL injection vulnerability in game.php in the Flashgames 1.0.1 module for XOOPS allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2007-2544](https://cve.now/CVE-2007-2544.md): PHP remote file inclusion vulnerability in templates/default/tpl\_message.php in PHP TopTree BBS 2.0.1a and earlier allows remote attackers t (no CVSS)
- [CVE-2007-2545](https://cve.now/CVE-2007-2545.md): Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-1669](https://cve.now/CVE-2007-1669.md): zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (no CVSS)
- [CVE-2007-1670](https://cve.now/CVE-2007-1670.md): Panda Software Antivirus before 20070402 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a diren (no CVSS)
- [CVE-2007-1671](https://cve.now/CVE-2007-1671.md): avpack32.dll before 7.3.0.6 in Avira AntiVir allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a d (no CVSS)
- [CVE-2007-1672](https://cve.now/CVE-2007-1672.md): avast! antivirus before 4.7.981 allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry struc (no CVSS)
- [CVE-2007-1864](https://cve.now/CVE-2007-1864.md): Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors. (no CVSS)
- [CVE-2007-2509](https://cve.now/CVE-2007-2509.md): CRLF injection vulnerability in the ftp\_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2007-2510](https://cve.now/CVE-2007-2510.md): Buffer overflow in the make\_http\_soap\_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to (no CVSS)
- [CVE-2007-2511](https://cve.now/CVE-2007-2511.md): Buffer overflow in the user\_filter\_factory\_create function in PHP before 5.2.2 has unknown impact and local attack vectors. (no CVSS)
- [CVE-2007-2529](https://cve.now/CVE-2007-2529.md): Integer signedness error in the acl (facl) system call in Solaris 10 before 20070507 allows local users to cause a denial of service (kernel (no CVSS)
- [CVE-2007-2530](https://cve.now/CVE-2007-2530.md): Multiple PHP remote file inclusion vulnerabilities in Tropicalm Crowell Resource 4.5.2 allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-2531](https://cve.now/CVE-2007-2531.md): PHP remote file inclusion vulnerability in berylium-classes.php in Berylium2 2003-08-18 allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2007-2532](https://cve.now/CVE-2007-2532.md): Multiple cross-site scripting (XSS) vulnerabilities in Minh Nguyen Duong Obie Website Mini Web Shop 2 allow remote attackers to inject arbit (no CVSS)
- [CVE-2007-2533](https://cve.now/CVE-2007-2533.md): Multiple buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2- Build 1174 allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-2534](https://cve.now/CVE-2007-2534.md): Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN\_US (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.