# CVEs published 2007-06-14

32 CVEs were published on June 14, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2448](https://cve.now/CVE-2007-2448.md): Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not c (no CVSS)
- [CVE-2007-2449](https://cve.now/CVE-2007-2449.md): Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0. (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-2450](https://cve.now/CVE-2007-2450.md): Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-2921](https://cve.now/CVE-2007-2921.md): Multiple buffer overflows in acgm.dll in the Corel / Micrografx ActiveCGM Browser ActiveX control before 7.1.4.19 allow remote attackers to (no CVSS)
- [CVE-2007-3220](https://cve.now/CVE-2007-3220.md): PHP remote file inclusion vulnerability in admin/editor2/spaw\_control.class.php in the Cjay Content 3 module for XOOPS allows remote attacke (no CVSS)
- [CVE-2007-3221](https://cve.now/CVE-2007-3221.md): PHP remote file inclusion vulnerability in admin/spaw/spaw\_control.class.php in the XT-Conteudo module for XOOPS allows remote attackers to (no CVSS)
- [CVE-2007-3222](https://cve.now/CVE-2007-3222.md): PHP remote file inclusion vulnerability in modify.php in the XFsection 1.07 module for XOOPS allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2007-3223](https://cve.now/CVE-2007-3223.md): Unspecified vulnerability in the NFS server in Sun Solaris 10 before 20070613 allows remote attackers to cause a denial of service (system c (no CVSS)
- [CVE-2007-3224](https://cve.now/CVE-2007-3224.md): Unspecified vulnerability in Sun ONE/Java System Directory Server (slapd) 6.0, and 5.x before 5.2 Patch 5, allows remote attackers to determ (no CVSS)
- [CVE-2007-3225](https://cve.now/CVE-2007-3225.md): Unspecified vulnerability in Sun Java System Directory Server (slapd) 6.0, and 5.2 with Patch 3 or 4, allows remote attackers to modify cert (no CVSS)
- [CVE-2007-3226](https://cve.now/CVE-2007-3226.md): Cross-site scripting (XSS) vulnerability in dotProject before 2.1 RC2 allows remote attackers to inject arbitrary web script or HTML via uns (no CVSS)
- [CVE-2007-3227](https://cve.now/CVE-2007-3227.md): Cross-site scripting (XSS) vulnerability in the to\_json (ActiveRecord::Base#to\_json) function in Ruby on Rails before edge 9606 allows remot (no CVSS, rails)
- [CVE-2007-3228](https://cve.now/CVE-2007-3228.md): PHP remote file inclusion vulnerability in saf/lib/PEAR/PhpDocumentor/Documentation/tests/bug-559668.php in Sitellite CMS 4.2.12 and earlier (no CVSS)
- [CVE-2007-3229](https://cve.now/CVE-2007-3229.md): index.php in Singapore Gallery allows remote attackers to obtain sensitive information via a request with a non-directory gallery parameter, (no CVSS)
- [CVE-2007-3230](https://cve.now/CVE-2007-3230.md): PHP remote file inclusion vulnerability in phphtml.php in Idan Sofer PHP::HTML 0.6.4 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-3231](https://cve.now/CVE-2007-3231.md): Buffer overflow in MeCab before 0.96 has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-3212](https://cve.now/CVE-2007-3212.md): Multiple cross-site scripting (XSS) vulnerabilities in links.php in Beehive Forum 0.7.1 allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-3213](https://cve.now/CVE-2007-3213.md): Multiple cross-site scripting (XSS) vulnerabilities in comments.cgi in Sporum Forum 3.0.9 and earlier allow remote attackers to inject arbit (no CVSS)
- [CVE-2007-3214](https://cve.now/CVE-2007-3214.md): SQL injection vulnerability in style.php in e-Vision CMS 2.02 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to exe (no CVSS)
- [CVE-2007-3215](https://cve.now/CVE-2007-3215.md): PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the (no CVSS, phpmailer/phpmailer)
- [CVE-2007-3216](https://cve.now/CVE-2007-3216.md): Multiple buffer overflows in the LGServer component of CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.1 al (no CVSS)
- [CVE-2007-3217](https://cve.now/CVE-2007-3217.md): Multiple PHP remote file inclusion vulnerabilities in Prototype of an PHP application 0.1 allow remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2007-3218](https://cve.now/CVE-2007-3218.md): Cross-site scripting (XSS) vulnerability in request.php in PHP Live! 3.2.2 and earlier allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-3219](https://cve.now/CVE-2007-3219.md): Unspecified vulnerability in sources/action\_public/xmlout.php in Invision Power Board (IPB or IP.Board) 2.2.0 through 2.2.2 allows remote at (no CVSS)
- [CVE-2006-4168](https://cve.now/CVE-2006-4168.md): Integer overflow in the exif\_data\_load\_data\_entry function in libexif/exif-data.c in Libexif before 0.6.16 allows remote attackers to cause (no CVSS)
- [CVE-2007-3099](https://cve.now/CVE-2007-3099.md): usr/mgmt\_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF\_LOCAL socket inste (no CVSS)
- [CVE-2007-3100](https://cve.now/CVE-2007-3100.md): usr/log.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 uses a semaphore with insecure permissions (world-writable/world-re (no CVSS)
- [CVE-2007-3208](https://cve.now/CVE-2007-3208.md): CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests t (no CVSS)
- [CVE-2007-3209](https://cve.now/CVE-2007-3209.md): Mail Notification 4.0, when WITH\_SSL is set to 0 at compile time, uses unencrypted connections for accounts configured with SSL/TLS, which a (no CVSS)
- [CVE-2007-3210](https://cve.now/CVE-2007-3210.md): Stack-based buffer overflow in nptoken.mox in the Cellosoft Tokens Object 2.0.0.6 extension for Vitalize! allows remote attackers to execute (no CVSS)
- [CVE-2007-3211](https://cve.now/CVE-2007-3211.md): Cross-site scripting (XSS) vulnerability in 404.php in Domain Technologie Control (DTC) before 0.25.9 allows remote attackers to inject arbi (no CVSS)
- [CVE-2007-2391](https://cve.now/CVE-2007-2391.md): Cross-site scripting (XSS) vulnerability in Apple Safari Beta 3.0.1 for Windows allows remote attackers to inject arbitrary web script or HT (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-06-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.