# CVEs published 2007-05-16

55 CVEs were published on May 16, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-1173](https://cve.now/CVE-2007-1173.md): Multiple buffer overflows in the CentennialIPTransferServer service (XFERWAN.EXE), as used by (1) Centennial Discovery 2006 Feature Pack 1, (no CVSS)
- [CVE-2007-1898](https://cve.now/CVE-2007-1898.md): formmail.php in Jetbox CMS 2.1 allows remote attackers to send arbitrary e-mails (spam) via modified recipient, \_SETTINGS\[allowed\_email\_host (no CVSS)
- [CVE-2007-2445](https://cve.now/CVE-2007-2445.md): The png\_handle\_tRNS function in pngrutil.c in libpng before 1.0.25 and 1.2.x before 1.2.17 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2007-2568](https://cve.now/CVE-2007-2568.md): Multiple stack-based buffer overflows in VCDGear 3.55 allow user-assisted remote attackers to execute arbitrary code via a long (1) tag or ( (no CVSS)
- [CVE-2007-2722](https://cve.now/CVE-2007-2722.md): Unspecified vulnerability in NewzCrawler 1.8 allows remote attackers to cause a denial of service (application instability) via certain inva (no CVSS)
- [CVE-2007-2723](https://cve.now/CVE-2007-2723.md): Media Player Classic 6.4.9.0 allows user-assisted remote attackers to cause a denial of service (web browser crash) via an "empty" .MPA file (no CVSS)
- [CVE-2007-2724](https://cve.now/CVE-2007-2724.md): Cross-site scripting (XSS) vulnerability in all\_photos.html in fotolog allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-2725](https://cve.now/CVE-2007-2725.md): The DB Software Laboratory DeWizardX (DEWizardAX.ocx) ActiveX control allows remote attackers to overwrite arbitrary files via the SaveToFil (no CVSS)
- [CVE-2007-2726](https://cve.now/CVE-2007-2726.md): BitsCast 0.13.0 allows remote attackers to cause a denial of service (application crash) via an RSS 2.0 feed item with certain invalid strin (no CVSS)
- [CVE-2007-2727](https://cve.now/CVE-2007-2727.md): The mcrypt\_create\_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php\_rand (no CVSS)
- [CVE-2007-2728](https://cve.now/CVE-2007-2728.md): The soap extension in PHP calls php\_rand\_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue (no CVSS)
- [CVE-2007-2729](https://cve.now/CVE-2007-2729.md): Comodo Firewall Pro 2.4.18.184 and Comodo Personal Firewall 2.3.6.81, and probably older Comodo Firewall versions, do not properly test for (no CVSS)
- [CVE-2007-2730](https://cve.now/CVE-2007-2730.md): Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API (no CVSS)
- [CVE-2007-2731](https://cve.now/CVE-2007-2731.md): CRLF injection vulnerability in formmail.php in Jetbox CMS 2.1 might allow remote attackers to inject arbitrary e-mail headers via LF (%0A) (no CVSS)
- [CVE-2007-2732](https://cve.now/CVE-2007-2732.md): Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2007-2733](https://cve.now/CVE-2007-2733.md): Unrestricted file upload vulnerability in Jetbox CMS allows remote authenticated users with author privileges to upload arbitrary scripts vi (no CVSS)
- [CVE-2007-2734](https://cve.now/CVE-2007-2734.md): The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, whic (no CVSS)
- [CVE-2007-1689](https://cve.now/CVE-2007-1689.md): Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows re (no CVSS)
- [CVE-2007-2721](https://cve.now/CVE-2007-2721.md): The jpc\_qcx\_getcompparms function in jpc/jpc\_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted atta (no CVSS)
- [CVE-2007-2439](https://cve.now/CVE-2007-2439.md): Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to cause a denial of service (device (no CVSS)
- [CVE-2007-2440](https://cve.now/CVE-2007-2440.md): Directory traversal vulnerability in Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers (no CVSS)
- [CVE-2007-2441](https://cve.now/CVE-2007-2441.md): Caucho Resin Professional 3.1.0 and Caucho Resin 3.1.0 and earlier for Windows allows remote attackers to obtain the system path via certain (no CVSS)
- [CVE-2007-2716](https://cve.now/CVE-2007-2716.md): Multiple cross-site scripting (XSS) vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-2717](https://cve.now/CVE-2007-2717.md): SQL injection vulnerability in shop/page.php in iGeneric (iG) Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the typ (no CVSS)
- [CVE-2007-2718](https://cve.now/CVE-2007-2718.md): Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet E (no CVSS)
- [CVE-2007-2719](https://cve.now/CVE-2007-2719.md): Session fixation vulnerability in HP Systems Insight Manager (SIM) 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by (no CVSS)
- [CVE-2007-2720](https://cve.now/CVE-2007-2720.md): Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain r (no CVSS)
- [CVE-2007-2706](https://cve.now/CVE-2007-2706.md): PHP remote file inclusion vulnerability in maint/ftpmedia.php in Media Gallery 1.4.8a and earlier for Geeklog allows remote attackers to exe (no CVSS)
- [CVE-2007-2707](https://cve.now/CVE-2007-2707.md): PHP remote file inclusion vulnerability in linksnet\_linkslog\_rss.php in Linksnet Newsfeed 1.0 allows remote attackers to execute arbitrary P (no CVSS)
- [CVE-2007-2708](https://cve.now/CVE-2007-2708.md): PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute (no CVSS)
- [CVE-2007-2709](https://cve.now/CVE-2007-2709.md): PHP remote file inclusion vulnerability in functions/prepend\_adm.php in NagiosQL 2005 2.00 allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-2710](https://cve.now/CVE-2007-2710.md): PHP remote file inclusion vulnerability in functions/prepend\_adm.php in NagiosQL 2.00-P00 and earlier allows remote attackers to execute arb (no CVSS)
- [CVE-2007-2711](https://cve.now/CVE-2007-2711.md): Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 11 (no CVSS)
- [CVE-2007-2712](https://cve.now/CVE-2007-2712.md): Unspecified vulnerability in MH Software Connect Daily before 3.3.3 has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-2713](https://cve.now/CVE-2007-2713.md): ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers (no CVSS)
- [CVE-2007-2714](https://cve.now/CVE-2007-2714.md): Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-2715](https://cve.now/CVE-2007-2715.md): Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1) username, or the (2) (no CVSS)
- [CVE-2007-2688](https://cve.now/CVE-2007-2688.md): The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width U (no CVSS)
- [CVE-2007-2689](https://cve.now/CVE-2007-2689.md): Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remot (no CVSS)
- [CVE-2007-2690](https://cve.now/CVE-2007-2690.md): Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unico (no CVSS)
- [CVE-2007-2691](https://cve.now/CVE-2007-2691.md): MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which all (no CVSS)
- [CVE-2007-2692](https://cve.now/CVE-2007-2692.md): The mysql\_change\_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db\_access privileges when returning (no CVSS)
- [CVE-2007-2693](https://cve.now/CVE-2007-2693.md): MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via (no CVSS)
- [CVE-2007-2694](https://cve.now/CVE-2007-2694.md): Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 throug (no CVSS)
- [CVE-2007-2695](https://cve.now/CVE-2007-2695.md): The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9 (no CVSS)
- [CVE-2007-2696](https://cve.now/CVE-2007-2696.md): The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front e (no CVSS)
- [CVE-2007-2697](https://cve.now/CVE-2007-2697.md): The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configu (no CVSS)
- [CVE-2007-2698](https://cve.now/CVE-2007-2698.md): The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows (no CVSS)
- [CVE-2007-2699](https://cve.now/CVE-2007-2699.md): The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policie (no CVSS)
- [CVE-2007-2700](https://cve.now/CVE-2007-2700.md): The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain att (no CVSS)
- [CVE-2007-2701](https://cve.now/CVE-2007-2701.md): The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and passwor (no CVSS)
- [CVE-2007-2702](https://cve.now/CVE-2007-2702.md): Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to in (no CVSS)
- [CVE-2007-2703](https://cve.now/CVE-2007-2703.md): BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow r (no CVSS)
- [CVE-2007-2704](https://cve.now/CVE-2007-2704.md): BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-close (no CVSS)
- [CVE-2007-2705](https://cve.now/CVE-2007-2705.md): Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.