# CVEs published 2007-05-22

37 CVEs were published on May 22, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2816](https://cve.now/CVE-2007-2816.md): Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2007-2817](https://cve.now/CVE-2007-2817.md): SQL injection vulnerability in read/index.php in ol'bookmarks 0.7.4 allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2007-2818](https://cve.now/CVE-2007-2818.md): Cross-site scripting (XSS) vulnerability in cand\_login.asp in CactuSoft Parodia 6.4 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-2819](https://cve.now/CVE-2007-2819.md): Cross-site scripting (XSS) vulnerability in reportItem.do in Track+ 3.3.2 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-2820](https://cve.now/CVE-2007-2820.md): Multiple stack-based buffer overflows in the KSign KSignSWAT ActiveX Control (AxKSignSWAT.dll) 2.0.3.3 allow remote attackers to execute arb (no CVSS)
- [CVE-2007-2821](https://cve.now/CVE-2007-2821.md): SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-2822](https://cve.now/CVE-2007-2822.md): TutorialCMS 1.01 and earlier, when register\_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2 (no CVSS)
- [CVE-2007-2823](https://cve.now/CVE-2007-2823.md): Multiple buffer overflows in HT Editor before 2.0.6 might allow remote attackers to execute arbitrary code via unspecified vectors, possibly (no CVSS)
- [CVE-2007-2824](https://cve.now/CVE-2007-2824.md): SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-2825](https://cve.now/CVE-2007-2825.md): Multiple cross-site scripting (XSS) vulnerabilities in ReadMsg.php in @Mail 5.02 and earlier allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-2826](https://cve.now/CVE-2007-2826.md): PHP remote file inclusion vulnerability in lib/addressbook.php in Madirish Webmail 2.0 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-2827](https://cve.now/CVE-2007-2827.md): Heap-based buffer overflow in LEAD Technologies LEADTOOLS ISIS ActiveX Control (ltisi14E.ocx) 14.5.0.44 and earlier allows remote attackers (no CVSS)
- [CVE-2007-2828](https://cve.now/CVE-2007-2828.md): Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers (no CVSS)
- [CVE-2006-3894](https://cve.now/CVE-2006-3894.md): The RSA Crypto-C before 6.3.1 and Cert-C before 2.8 libraries, as used by RSA BSAFE, multiple Cisco products, and other products, allows rem (no CVSS)
- [CVE-2006-7204](https://cve.now/CVE-2006-7204.md): The imap\_body function in PHP before 4.4.4 does not implement safemode or open\_basedir checks, which allows local users to read arbitrary fi (no CVSS)
- [CVE-2007-2519](https://cve.now/CVE-2007-2519.md): Directory traversal vulnerability in the installer in PEAR 1.0 through 1.5.3 allows user-assisted remote attackers to overwrite arbitrary fi (no CVSS)
- [CVE-2007-2686](https://cve.now/CVE-2007-2686.md): Cross-site scripting (XSS) vulnerability in index.php in Jetbox CMS 2.1 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2007-2802](https://cve.now/CVE-2007-2802.md): Cross-site scripting (XSS) vulnerability in cp/ps/Main/login/Login in RM EasyMail Plus allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-2803](https://cve.now/CVE-2007-2803.md): SQL injection vulnerability in default.asp in Vizayn Urun Tanitim Sitesi 0.2 allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2007-2804](https://cve.now/CVE-2007-2804.md): Multiple cross-site scripting (XSS) vulnerabilities in scripts/prodList.asp in CandyPress Store 3.5.2.14 and earlier allow remote attackers (no CVSS)
- [CVE-2007-2805](https://cve.now/CVE-2007-2805.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in ClientExec (CE) 3.0 beta2, and possibly other versions, allow remote att (no CVSS)
- [CVE-2007-2806](https://cve.now/CVE-2007-2806.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in GaliX 2.0 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-2807](https://cve.now/CVE-2007-2807.md): Stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, remote IRC servers t (no CVSS)
- [CVE-2007-2808](https://cve.now/CVE-2007-2808.md): Cross-site scripting (XSS) vulnerability in gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2007-2809](https://cve.now/CVE-2007-2809.md): Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2007-2810](https://cve.now/CVE-2007-2810.md): SQL injection vulnerability in down\_indir.asp in Gazi Download Portal allows remote attackers to execute arbitrary SQL commands via the id p (no CVSS)
- [CVE-2007-2811](https://cve.now/CVE-2007-2811.md): Cross-site scripting (XSS) vulnerability in OSK Advance-Flow 4.41 and earlier allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-2812](https://cve.now/CVE-2007-2812.md): Cross-site scripting (XSS) vulnerability in hlstats.php in HLstats 1.35, and possibly earlier, allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-2813](https://cve.now/CVE-2007-2813.md): Cisco IOS 12.4 and earlier, when using the crypto packages and SSL support is enabled, allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2007-2814](https://cve.now/CVE-2007-2814.md): Multiple stack-based buffer overflows in the Pegasus ImagN' ActiveX control (IMW32O40.OCX) 4.00.041 allow remote attackers to execute arbitr (no CVSS)
- [CVE-2007-2815](https://cve.now/CVE-2007-2815.md): The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL (no CVSS)
- [CVE-2007-2788](https://cve.now/CVE-2007-2788.md): Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0\_11-b03 and 1.6.x before 1.6.0\_01-b0 (no CVSS)
- [CVE-2007-2789](https://cve.now/CVE-2007-2789.md): The BMP image parser in Sun Java Development Kit (JDK) before 1.5.0\_11-b03 and 1.6.x before 1.6.0\_01-b06, and Sun Java Runtime Environment i (no CVSS)
- [CVE-2007-2790](https://cve.now/CVE-2007-2790.md): Cross-site scripting (XSS) vulnerability in shopcontent.asp in VP-ASP Shopping Cart 6.50, and possibly earlier, allows remote attackers to i (no CVSS)
- [CVE-2007-2791](https://cve.now/CVE-2007-2791.md): Unspecified vulnerability in the Secure Shell (SSH) in HP Tru64 UNIX 5.1B-4 and 5.1B-3 allows remote attackers to identify valid users via u (no CVSS)
- [CVE-2007-2792](https://cve.now/CVE-2007-2792.md): SQL injection vulnerability in the Yet another Newsletter Component (aka YaNC or com\_yanc) component before 1.5 beta 3 for Mambo and Joomla! (no CVSS)
- [CVE-2007-2793](https://cve.now/CVE-2007-2793.md): PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitrary PHP code via a U (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.