# CVEs published 2007-06-27

53 CVEs were published on June 27, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-3467](https://cve.now/CVE-2007-3467.md): Integer overflow in the \_\_status\_Update function in stats.c VideoLAN VLC Media Player before 0.8.6c allows remote attackers to cause a denia (no CVSS)
- [CVE-2007-3468](https://cve.now/CVE-2007-3468.md): input.c in VideoLAN VLC Media Player before 0.8.6c allows remote attackers to cause a denial of service (crash) via a crafted WAV file that (no CVSS)
- [CVE-2007-3254](https://cve.now/CVE-2007-3254.md): Multiple cross-site scripting (XSS) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0.46.1, a (no CVSS)
- [CVE-2007-3255](https://cve.now/CVE-2007-3255.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Xythos Enterprise Document Manager (XEDM) before 5.0.25.8, and 6.x before 6.0. (no CVSS)
- [CVE-2007-3256](https://cve.now/CVE-2007-3256.md): Xythos Enterprise Document Manager (XEDM), Digital Locker (XDL), and possibly WebFile Server before 6.0.46.1 allow remote authenticated user (no CVSS)
- [CVE-2007-3459](https://cve.now/CVE-2007-3459.md): A certain ActiveX control in Avaxswf.dll 1.0.0.1 in Civitech Avax Vector 1.3 allows remote attackers to create or overwrite arbitrary files (no CVSS)
- [CVE-2007-3460](https://cve.now/CVE-2007-3460.md): Multiple PHP remote file inclusion vulnerabilities in index.php3 in EVA-Web 1.1 through 2.2 allow remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-3461](https://cve.now/CVE-2007-3461.md): SQL injection vulnerability in property.php in elkagroup Image Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-3462](https://cve.now/CVE-2007-3462.md): Cross-site request forgery (CSRF) vulnerability in Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, allows rem (no CVSS)
- [CVE-2007-3463](https://cve.now/CVE-2007-3463.md): Microsoft Windows XP SP2 allows local users, who have sessions created by another user's RunAs (run as) command, to kill arbitrary processes (no CVSS)
- [CVE-2007-3464](https://cve.now/CVE-2007-3464.md): Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, does not require entry of the old password when changing the (no CVSS)
- [CVE-2007-3465](https://cve.now/CVE-2007-3465.md): Check Point SofaWare Safe@Office, with firmware before Embedded NGX 7.0.45 GA, has a certain default password. (no CVSS)
- [CVE-2006-5752](https://cve.now/CVE-2006-5752.md): Cross-site scripting (XSS) vulnerability in mod\_status.c in the mod\_status module in Apache HTTP Server (httpd), when ExtendedStatus is enab (no CVSS)
- [CVE-2006-7210](https://cve.now/CVE-2006-7210.md): Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a PNG image with craf (no CVSS)
- [CVE-2007-1792](https://cve.now/CVE-2007-1792.md): libdayzero.dll in the Filter Hub Service (filter-hub.exe) in Symantec Mail Security for SMTP before 5.0.1 Patch 181 and Mail Security Applia (no CVSS)
- [CVE-2007-1863](https://cve.now/CVE-2007-1863.md): cache\_util.c in the mod\_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is (no CVSS)
- [CVE-2007-3258](https://cve.now/CVE-2007-3258.md): calendar.php in Calendarix 0.7.20070307 allows remote attackers to obtain sensitive information via large values to the (1) year and (2) mon (no CVSS)
- [CVE-2007-3458](https://cve.now/CVE-2007-3458.md): The libsldap library in Sun Solaris 8, 9, and 10 allows local users to cause a denial of service (Name Service Caching Daemon (nscd) crash) (no CVSS)
- [CVE-2006-7209](https://cve.now/CVE-2006-7209.md): Multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-1663](https://cve.now/CVE-2007-1663.md): Memory leak in the image message functionality in ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a de (no CVSS)
- [CVE-2007-1664](https://cve.now/CVE-2007-1664.md): ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial of service (NULL pointer dereference) via a v (no CVSS)
- [CVE-2007-1665](https://cve.now/CVE-2007-1665.md): Memory leak in the token OCR functionality in ekg before 1:1.7~rc2-1etch1 on Debian GNU/Linux Etch allows remote attackers to cause a denial (no CVSS)
- [CVE-2007-3425](https://cve.now/CVE-2007-3425.md): Directory traversal vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to include arbitrary local files via (no CVSS)
- [CVE-2007-3426](https://cve.now/CVE-2007-3426.md): Cross-site scripting (XSS) vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-3427](https://cve.now/CVE-2007-3427.md): SQL injection vulnerability in index.php in phpTrafficA 1.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-3428](https://cve.now/CVE-2007-3428.md): Multiple unspecified vulnerabilities in phpTrafficA before 1.4.2 allow remote attackers to have an unknown impact via the file parameter to (no CVSS)
- [CVE-2007-3429](https://cve.now/CVE-2007-3429.md): Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers t (no CVSS)
- [CVE-2007-3430](https://cve.now/CVE-2007-3430.md): SQL injection vulnerability in index.php in Simple Invoices 2007 05 25 allows remote attackers to execute arbitrary SQL commands via the sub (no CVSS)
- [CVE-2007-3431](https://cve.now/CVE-2007-3431.md): PHP remote file inclusion vulnerability in cal.func.php in Valerio Capello Dagger - The Cutting Edge r23jan2007 allows remote attackers to e (no CVSS)
- [CVE-2007-3432](https://cve.now/CVE-2007-3432.md): Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code (no CVSS)
- [CVE-2007-3433](https://cve.now/CVE-2007-3433.md): SQL injection vulnerability in index.php in Pharmacy System 2 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-3434](https://cve.now/CVE-2007-3434.md): index.php in Pharmacy System 2 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the page par (no CVSS)
- [CVE-2007-3435](https://cve.now/CVE-2007-3435.md): Stack-based buffer overflow in the BeginPrint method in a certain ActiveX control in RKD Software (barcodetools.com) BarCodeAx.dll 4.9 allow (no CVSS)
- [CVE-2007-3436](https://cve.now/CVE-2007-3436.md): Microsoft MSN Messenger 4.7 on Windows XP allows remote attackers to cause a denial of service (resource consumption) via a flood of SIP INV (no CVSS)
- [CVE-2007-3437](https://cve.now/CVE-2007-3437.md): AOL Instant Messenger (AIM) 6.1.32.1 on Windows XP allows remote attackers to cause a denial of service (application crash) via a malformed (no CVSS)
- [CVE-2007-3438](https://cve.now/CVE-2007-3438.md): Buffer overflow in the SIP header parsing module in the Nortel PC Client SIP Soft Phone 4.1 3.5.208\[20051015\] allows remote attackers to exe (no CVSS)
- [CVE-2007-3439](https://cve.now/CVE-2007-3439.md): The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to read a list of miss (no CVSS)
- [CVE-2007-3440](https://cve.now/CVE-2007-3440.md): The Snom 320 SIP Phone, running snom320 linux 3.25, snom320-SIP 6.2.3, and snom320 jffs23.36, allows remote attackers to place calls to arbi (no CVSS)
- [CVE-2007-3441](https://cve.now/CVE-2007-3441.md): Format string vulnerability in the Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10 allows remote attackers to caus (no CVSS)
- [CVE-2007-3442](https://cve.now/CVE-2007-3442.md): Format string vulnerability on the Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2007-3443](https://cve.now/CVE-2007-3443.md): The Research in Motion BlackBerry 7270 before 4.0 SP1 Bundle 108 does not properly manage transaction states, which allows remote attackers (no CVSS)
- [CVE-2007-3444](https://cve.now/CVE-2007-3444.md): The Research in Motion BlackBerry 7270 with 4.0 SP1 Bundle 83 allows remote attackers to cause a denial of service (blocked call reception) (no CVSS)
- [CVE-2007-3445](https://cve.now/CVE-2007-3445.md): Buffer overflow in SJ Labs SJphone 1.60.303c, running under Windows Mobile 2003 on the Samsung SCH-i730 phone, allows remote attackers to ca (no CVSS)
- [CVE-2007-3446](https://cve.now/CVE-2007-3446.md): BugMall Shopping Cart 2.5 and earlier has a default username "demo" and password "demo," which allows remote attackers to obtain login acces (no CVSS)
- [CVE-2007-3447](https://cve.now/CVE-2007-3447.md): SQL injection vulnerability in BugMall Shopping Cart 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the "basi (no CVSS)
- [CVE-2007-3448](https://cve.now/CVE-2007-3448.md): Cross-site scripting (XSS) vulnerability in index.php in BugMall Shopping Cart 2.5 and earlier allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-3449](https://cve.now/CVE-2007-3449.md): SQL injection vulnerability in member.php in 6ALBlog allows remote attackers to execute arbitrary SQL commands via the newsid parameter. (no CVSS)
- [CVE-2007-3450](https://cve.now/CVE-2007-3450.md): SQL injection vulnerability in member.php in 6ALBlog allows remote attackers to execute arbitrary SQL commands via the member parameter. (no CVSS)
- [CVE-2007-3451](https://cve.now/CVE-2007-3451.md): PHP remote file inclusion vulnerability in admin/index.php in 6ALBlog allows remote authenticated administrators to execute arbitrary PHP co (no CVSS)
- [CVE-2007-3452](https://cve.now/CVE-2007-3452.md): SQL injection vulnerability in essentials/minutes/doc.php in eDocStore allows remote attackers to execute arbitrary SQL commands via the doc (no CVSS)
- [CVE-2007-3453](https://cve.now/CVE-2007-3453.md): SQL injection vulnerability in Papoo 3.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the selmenuid (no CVSS)
- [CVE-2007-3454](https://cve.now/CVE-2007-3454.md): Stack-based buffer overflow in CGIOCommon.dll before 8.0.0.1042 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to e (no CVSS)
- [CVE-2007-3455](https://cve.now/CVE-2007-3455.md): cgiChkMasterPwd.exe before 8.0.0.142 in Trend Micro OfficeScan Corporate Edition 8.0 allows remote attackers to bypass the password requirem (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.