# CVEs published 2007-07-05

33 CVEs were published on July 5, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-3589](https://cve.now/CVE-2007-3589.md): Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) (no CVSS)
- [CVE-2007-3590](https://cve.now/CVE-2007-3590.md): Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-2839](https://cve.now/CVE-2007-2839.md): gfax 0.4.2 and probably other versions creates temporary files insecurely, which allows local users to execute arbitrary commands via unknow (no CVSS)
- [CVE-2004-2681](https://cve.now/CVE-2004-2681.md): PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time, which might make it easier for remote attackers to hijack a (no CVSS)
- [CVE-2004-2682](https://cve.now/CVE-2004-2682.md): PeerSec MatrixSSL before 1.1 does not implement RSA blinding, which allows context-dependent attackers to obtain the server's private key by (no CVSS)
- [CVE-2005-4849](https://cve.now/CVE-2005-4849.md): Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC comman (no CVSS, org.apache.derby:derby)
- [CVE-2006-7216](https://cve.now/CVE-2006-7216.md): Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does (no CVSS)
- [CVE-2006-7217](https://cve.now/CVE-2006-7217.md): Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote auth (no CVSS, org.apache.derby:derby)
- [CVE-2007-3572](https://cve.now/CVE-2007-3572.md): Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attacker (no CVSS)
- [CVE-2007-3573](https://cve.now/CVE-2007-3573.md): Multiple SQL injection vulnerabilities in akocomment allow remote attackers to execute arbitrary SQL commands via the (1) acparentid or (2) (no CVSS)
- [CVE-2007-3574](https://cve.now/CVE-2007-3574.md): Multiple cross-site scripting (XSS) vulnerabilities in setup.cgi on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.00.06 firmware (no CVSS)
- [CVE-2007-3575](https://cve.now/CVE-2007-3575.md): SQL injection vulnerability in includes/functions in FreeDomain.co.nr Clone allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2007-3576](https://cve.now/CVE-2007-3576.md): Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the (no CVSS)
- [CVE-2007-3577](https://cve.now/CVE-2007-3577.md): PHPIDS before 20070703 does not properly handle use of the substr method in (1) document.location.search and (2) document.referrer; (3) cert (no CVSS)
- [CVE-2007-3578](https://cve.now/CVE-2007-3578.md): PHPIDS before 20070703 does not properly handle (1) arithmetic expressions and (2) unclosed comments, which allows remote attackers to injec (no CVSS)
- [CVE-2007-3579](https://cve.now/CVE-2007-3579.md): PHPIDS before 20070703 does not properly handle setting the .text property of a SCRIPT element before its attachment to the DOM, which allow (no CVSS)
- [CVE-2007-3580](https://cve.now/CVE-2007-3580.md): PHPIDS does not properly handle certain code containing newlines, as demonstrated by a try/catch block within a loop, which allows user-assi (no CVSS)
- [CVE-2007-3581](https://cve.now/CVE-2007-3581.md): The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the net (no CVSS)
- [CVE-2007-3582](https://cve.now/CVE-2007-3582.md): SQL injection vulnerability in index.php in SuperCali PHP Event Calendar 0.4.0 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-3583](https://cve.now/CVE-2007-3583.md): SQL injection vulnerability in details\_news.php in Girlserv ads 1.5 and earlier allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2007-3584](https://cve.now/CVE-2007-3584.md): SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2007-3585](https://cve.now/CVE-2007-3585.md): PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-3586](https://cve.now/CVE-2007-3586.md): Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into (1 (no CVSS)
- [CVE-2007-3587](https://cve.now/CVE-2007-3587.md): MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settin (no CVSS)
- [CVE-2007-3588](https://cve.now/CVE-2007-3588.md): SQL injection vulnerability in reply.php in VBZooM 1.12 allows remote attackers to execute arbitrary SQL commands via the UserID parameter t (no CVSS)
- [CVE-1999-1591](https://cve.now/CVE-1999-1591.md): Microsoft Internet Information Services (IIS) server 4.0 SP4, without certain hotfixes released for SP4, does not require authentication cre (no CVSS)
- [CVE-2007-3011](https://cve.now/CVE-2007-3011.md): The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute (no CVSS)
- [CVE-2007-3012](https://cve.now/CVE-2007-3012.md): The web interface in Fujitsu-Siemens Computers PRIMERGY BX300 Switch Blade allows remote attackers to obtain sensitive information by cancel (no CVSS)
- [CVE-2007-3567](https://cve.now/CVE-2007-3567.md): MySQLDumper 1.21b through 1.23 REV227 uses a "Limit GET" statement in the .htaccess authentication mechanism, which allows remote attackers (no CVSS)
- [CVE-2007-3568](https://cve.now/CVE-2007-3568.md): The \_LoadBMP function in imlib 1.9.15 and earlier allows context-dependent attackers to cause a denial of service (infinite loop) via a BMP (no CVSS)
- [CVE-2007-3569](https://cve.now/CVE-2007-3569.md): Multiple cross-site scripting (XSS) vulnerabilities in Oliver Library Management System allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-3570](https://cve.now/CVE-2007-3570.md): The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 (RC1) allows remote attackers to bypass unspecified sec (no CVSS)
- [CVE-2007-3571](https://cve.now/CVE-2007-3571.md): The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain dire (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.