# CVEs published 2007-06-11

50 CVEs were published on June 11, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2453](https://cve.now/CVE-2007-2453.md): The random number feature in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, (1) does not properly seed pools when there is (no CVSS)
- [CVE-2007-2873](https://cve.now/CVE-2007-2873.md): SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows (no CVSS)
- [CVE-2007-2876](https://cve.now/CVE-2007-2876.md): The sctp\_new function in (1) ip\_conntrack\_proto\_sctp.c and (2) nf\_conntrack\_proto\_sctp.c in Netfilter in Linux kernel 2.6 before 2.6.20.13, (no CVSS)
- [CVE-2007-3179](https://cve.now/CVE-2007-3179.md): Multiple SQL injection vulnerabilities in archives.php in Particle Blogger 1.2.1 and earlier allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-2875](https://cve.now/CVE-2007-2875.md): Integer underflow in the cpuset\_tasks\_read function in the Linux kernel before 2.6.20.13, and 2.6.21.x before 2.6.21.4, when the cpuset file (no CVSS)
- [CVE-2007-2920](https://cve.now/CVE-2007-2920.md): Multiple stack-based buffer overflows in the Zoomify Viewer ActiveX control in ZActiveX.dll might allow remote attackers to execute arbitrar (no CVSS)
- [CVE-2007-3151](https://cve.now/CVE-2007-3151.md): rpttop.htm in the web management interface in Packeteer PacketShaper 7.3.0g2 and 7.5.0g1 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2007-3152](https://cve.now/CVE-2007-3152.md): c-ares before 1.4.0 uses a predictable seed for the random number generator for the DNS Transaction ID field, which might allow remote attac (no CVSS)
- [CVE-2007-3153](https://cve.now/CVE-2007-3153.md): The ares\_init:randomize\_key function in c-ares, on platforms other than Windows, uses a weak facility for producing a random number sequence (no CVSS)
- [CVE-2007-3154](https://cve.now/CVE-2007-3154.md): Unspecified vulnerability in Walter Zorn wz\_tooltip.js (aka wz\_tooltips) before 4.01, as used by eGroupWare before 1.2.107-2 and other packa (no CVSS)
- [CVE-2007-3155](https://cve.now/CVE-2007-3155.md): Unspecified vulnerability in eGroupWare before 1.2.107-2 has unknown impact and attack vectors related to ADOdb. (no CVSS)
- [CVE-2007-3156](https://cve.now/CVE-2007-3156.md): Multiple cross-site scripting (XSS) vulnerabilities in pam\_login.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers (no CVSS)
- [CVE-2007-3157](https://cve.now/CVE-2007-3157.md): IPSecDrv.sys 10.4.0.12 in SafeNET High Assurance Remote 1.4.0 Build 12, and SoftRemote, allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2007-3158](https://cve.now/CVE-2007-3158.md): download\_script.asp in ASP Folder Gallery allows remote attackers to read arbitrary files via a filename in the file parameter. (no CVSS)
- [CVE-2007-3159](https://cve.now/CVE-2007-3159.md): http.c in MiniWeb Http Server 0.8.x allows remote attackers to cause a denial of service (application crash) via a negative value in the Con (no CVSS)
- [CVE-2007-3160](https://cve.now/CVE-2007-3160.md): PHP remote file inclusion vulnerability in admin/header.php in PHP Real Estate Classifieds Premium Plus allows remote attackers to execute a (no CVSS)
- [CVE-2007-3161](https://cve.now/CVE-2007-3161.md): Buffer overflow in Ace-FTP Client 1.24a allows user-assisted, remote FTP servers to execute arbitrary code via a long response. (no CVSS)
- [CVE-2007-3162](https://cve.now/CVE-2007-3162.md): Buffer overflow in the NotSafe function in the idaiehlp ActiveX control in idaiehlp.dll 1.9.1.74 in Internet Download Accelerator (ida) 5.2 (no CVSS)
- [CVE-2007-3163](https://cve.now/CVE-2007-3163.md): Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitr (no CVSS)
- [CVE-2007-3164](https://cve.now/CVE-2007-3164.md): Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the (no CVSS)
- [CVE-2007-3165](https://cve.now/CVE-2007-3165.md): Tor before 0.1.2.14 can construct circuits in which an entry guard is in the same family as the exit node, which might compromise the anonym (no CVSS)
- [CVE-2007-3166](https://cve.now/CVE-2007-3166.md): Buffer overflow in Qualcomm Eudora 7.1.0.9 allows user-assisted, remote IMAP servers to execute arbitrary code via a long FLAGS response to (no CVSS)
- [CVE-2007-3167](https://cve.now/CVE-2007-3167.md): Stack-based buffer overflow in the Vivotek Motion Jpeg ActiveX control (aka MjpegControl) in MjpegDecoder.dll 2.0.0.13 allows remote attacke (no CVSS)
- [CVE-2007-3168](https://cve.now/CVE-2007-3168.md): A certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions before 5.0, allows remot (no CVSS)
- [CVE-2007-3169](https://cve.now/CVE-2007-3169.md): Buffer overflow in a certain ActiveX control in the EDraw Office Viewer Component (edrawofficeviewer.ocx) 4.0.5.20, and other versions befor (no CVSS)
- [CVE-2007-3170](https://cve.now/CVE-2007-3170.md): Multiple cross-site scripting (XSS) vulnerabilities in Uebimiau Webmail allow remote attackers to inject arbitrary web script or HTML via (1 (no CVSS)
- [CVE-2007-3171](https://cve.now/CVE-2007-3171.md): Uebimiau Webmail allows remote attackers to obtain sensitive information via a request to demo/pop3/error.php with an invalid value of the ( (no CVSS)
- [CVE-2007-3172](https://cve.now/CVE-2007-3172.md): Directory traversal vulnerability in demo/pop3/error.php in Uebimiau Webmail allows remote attackers to determine the existence of arbitrary (no CVSS)
- [CVE-2007-3173](https://cve.now/CVE-2007-3173.md): Almnzm allows remote attackers to obtain sensitive information via an activateorder request to index.php with an invalid orderid parameter, (no CVSS)
- [CVE-2007-3174](https://cve.now/CVE-2007-3174.md): Cross-site scripting (XSS) vulnerability in auth.w2b in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2007-3175](https://cve.now/CVE-2007-3175.md): Multiple SQL injection vulnerabilities in W2B Online Banking allow remote attackers to execute arbitrary SQL commands via (1) the draft para (no CVSS)
- [CVE-2007-3176](https://cve.now/CVE-2007-3176.md): Unspecified vulnerability in Ingate Firewall and SIParator before 4.5.2 allows remote authenticated users without full privileges to downloa (no CVSS)
- [CVE-2007-3177](https://cve.now/CVE-2007-3177.md): Ingate Firewall and SIParator before 4.5.2 allow remote attackers to bypass SIP authentication via a certain maddr parameter. (no CVSS)
- [CVE-2007-3178](https://cve.now/CVE-2007-3178.md): Multiple SQL injection vulnerabilities in Zindizayn Okul Web Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2006-3974](https://cve.now/CVE-2006-3974.md): Cross-site scripting (XSS) vulnerability in cgi-bin/admin in 3Com OfficeConnect Secure Router with firmware 1.04-168 allows remote attackers (no CVSS)
- [CVE-2007-3150](https://cve.now/CVE-2007-3150.md): Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a (no CVSS)
- [CVE-2005-4841](https://cve.now/CVE-2005-4841.md): The Outlook Progress Ctl control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of (no CVSS)
- [CVE-2005-4842](https://cve.now/CVE-2005-4842.md): The System Monitor Source Properties control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a CO (no CVSS)
- [CVE-2005-4843](https://cve.now/CVE-2005-4843.md): The SmartConnect Class control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of th (no CVSS)
- [CVE-2005-4844](https://cve.now/CVE-2005-4844.md): The CLSID\_ApprenticeICW control allows remote attackers to cause a denial of service (Internet Explorer crash) by creating a COM object of t (no CVSS)
- [CVE-2005-4845](https://cve.now/CVE-2005-4845.md): The Java Plug-in 1.4.2\_03 and 1.4.2\_04 controls, and the 1.4.2\_03 and 1.4.2\_04 \<applet\> redirector controls, allow remote attackers to cause (no CVSS)
- [CVE-2007-3141](https://cve.now/CVE-2007-3141.md): PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-3142](https://cve.now/CVE-2007-3142.md): Visual truncation vulnerability in Opera 9.21 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a l (no CVSS)
- [CVE-2007-3143](https://cve.now/CVE-2007-3143.md): Visual truncation vulnerability in Konqueror 3.5.5 allows remote attackers to spoof the address bar and possibly conduct phishing attacks vi (no CVSS)
- [CVE-2007-3144](https://cve.now/CVE-2007-3144.md): Visual truncation vulnerability in Mozilla 1.7.12 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via (no CVSS)
- [CVE-2007-3145](https://cve.now/CVE-2007-3145.md): Visual truncation vulnerability in Galeon 2.0.1 allows remote attackers to spoof the address bar and possibly conduct phishing attacks via a (no CVSS)
- [CVE-2007-3146](https://cve.now/CVE-2007-3146.md): Zen Help Desk 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downloa (no CVSS)
- [CVE-2007-3147](https://cve.now/CVE-2007-3147.md): Buffer overflow in the Yahoo! Webcam Upload ActiveX control in ywcupl.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to (no CVSS)
- [CVE-2007-3148](https://cve.now/CVE-2007-3148.md): Buffer overflow in the Yahoo! Webcam Viewer ActiveX control in ywcvwr.dll 2.0.1.4 for Yahoo! Messenger 8.1.0.249 allows remote attackers to (no CVSS)
- [CVE-2007-3149](https://cve.now/CVE-2007-3149.md): sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows lo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-06-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.