# CVEs published 2007-07-06

38 CVEs were published on July 6, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2005-4850](https://cve.now/CVE-2005-4850.md): eZ publish 3.5 through 3.7 before 20050608 requires both edit and create permissions in order to submit data, which allows remote attackers (no CVSS)
- [CVE-2005-4851](https://cve.now/CVE-2005-4851.md): eZ publish 3.4.4 through 3.7 before 20050722 applies certain permissions on the node level, which allows remote authenticated users to bypas (no CVSS)
- [CVE-2005-4852](https://cve.now/CVE-2005-4852.md): The siteaccess URIMatching implementation in eZ publish 3.5 through 3.8 before 20050812 converts all non-alphanumeric characters in a URI to (no CVSS)
- [CVE-2005-4853](https://cve.now/CVE-2005-4853.md): The default configuration of the forum package in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 2005081 (no CVSS)
- [CVE-2005-4854](https://cve.now/CVE-2005-4854.md): eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authentic (no CVSS)
- [CVE-2005-4855](https://cve.now/CVE-2005-4855.md): Unrestricted file upload vulnerability in eZ publish 3.5 before 3.5.5, 3.6 before 3.6.2, 3.7 before 3.7.0rc2, and 3.8 before 20050922 does n (no CVSS)
- [CVE-2005-4856](https://cve.now/CVE-2005-4856.md): The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle aut (no CVSS)
- [CVE-2005-4857](https://cve.now/CVE-2005-4857.md): eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051128 allows remote authenticated users to cause a denial (no CVSS)
- [CVE-2005-4858](https://cve.now/CVE-2005-4858.md): Multiple cross-site scripting (XSS) vulnerabilities in mimic2.cgi in mimicboard2 (Mimic2) 086 and earlier allow remote attackers to inject a (no CVSS)
- [CVE-2005-4859](https://cve.now/CVE-2005-4859.md): mimicboard2 (Mimic2) 086 and earlier stores sensitive information under the web root with insufficient access control, which allows remote a (no CVSS)
- [CVE-2006-7218](https://cve.now/CVE-2006-7218.md): eZ publish before 3.8.1 does not properly enforce permissions for "content edit Language" when there are four or more languages, which allow (no CVSS)
- [CVE-2006-7219](https://cve.now/CVE-2006-7219.md): eZ publish before 3.8.5 does not properly enforce permissions for editing in a specific language, which allows remote authenticated users to (no CVSS)
- [CVE-2007-3598](https://cve.now/CVE-2007-3598.md): index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change (no CVSS)
- [CVE-2007-3599](https://cve.now/CVE-2007-3599.md): vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the Vi (no CVSS)
- [CVE-2007-3600](https://cve.now/CVE-2007-3600.md): WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security perm (no CVSS)
- [CVE-2007-3601](https://cve.now/CVE-2007-3601.md): vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities v (no CVSS)
- [CVE-2007-3602](https://cve.now/CVE-2007-3602.md): The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated use (no CVSS)
- [CVE-2007-3603](https://cve.now/CVE-2007-3603.md): SQL injection vulnerability in the dashboard (include/utils/SearchUtils.php) in vtiger CRM before 5.0.3 allows remote authenticated users to (no CVSS)
- [CVE-2007-3604](https://cve.now/CVE-2007-3604.md): vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read t (no CVSS)
- [CVE-2007-3605](https://cve.now/CVE-2007-3605.md): Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\\SapGui\\kwedit.dll in the EnjoySAP SAP GUI allows remot (no CVSS)
- [CVE-2007-3606](https://cve.now/CVE-2007-3606.md): Heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control in the EnjoySAP SAP GUI, on systems using ASCII versions, allows r (no CVSS)
- [CVE-2007-3607](https://cve.now/CVE-2007-3607.md): Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to cause a denial of service (proces (no CVSS)
- [CVE-2007-3608](https://cve.now/CVE-2007-3608.md): Multiple unspecified vulnerabilities in ActiveX controls in the EnjoySAP SAP GUI allow remote attackers to create certain files via unspecif (no CVSS)
- [CVE-2007-3609](https://cve.now/CVE-2007-3609.md): Multiple SQL injection vulnerabilities in eMeeting Online Dating Software 5.2 allow remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2007-3610](https://cve.now/CVE-2007-3610.md): SQL injection vulnerability in categories\_type.php in phpVID 0.9.9 allows remote attackers to execute arbitrary SQL commands via the cat par (no CVSS)
- [CVE-2007-3611](https://cve.now/CVE-2007-3611.md): admin.php in VRNews 1.1.1, and possibly other 1.x versions, does not require authentication, which allows remote attackers to perform certai (no CVSS)
- [CVE-2007-3612](https://cve.now/CVE-2007-3612.md): Stack-based buffer overflow in Visual IRC (ViRC) 2.0 allows remote IRC servers to execute arbitrary code via a long response to a JOIN comma (no CVSS)
- [CVE-2007-3613](https://cve.now/CVE-2007-3613.md): Cross-site scripting (XSS) vulnerability in ADM:GETLOGFILE in SAP Internet Graphics Service (IGS) allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2007-3614](https://cve.now/CVE-2007-3614.md): Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers (no CVSS)
- [CVE-2007-3615](https://cve.now/CVE-2007-3615.md): Internet Communication Manager (aka ICMAN.exe or ICM) in SAP NetWeaver Application Server 6.x and 7.x, possibly only on Windows, allows remo (no CVSS)
- [CVE-2007-3616](https://cve.now/CVE-2007-3616.md): index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a (no CVSS)
- [CVE-2007-3617](https://cve.now/CVE-2007-3617.md): The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitra (no CVSS)
- [CVE-2007-3591](https://cve.now/CVE-2007-3591.md): Unspecified vulnerability in Profile.php in Elite Bulletin Board before 1.0.10 allows remote attackers to modify profile information via uns (no CVSS)
- [CVE-2007-3592](https://cve.now/CVE-2007-3592.md): PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via (no CVSS)
- [CVE-2007-3593](https://cve.now/CVE-2007-3593.md): Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine NetFlow Analyzer 5 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-3594](https://cve.now/CVE-2007-3594.md): Multiple cross-site scripting (XSS) vulnerabilities in AdventNet ManageEngine OpManager 6 and 7 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-3596](https://cve.now/CVE-2007-3596.md): inc/vul\_check.inc in phpVideoPro before 0.8.8 permits non-alphanumeric characters in the sess\_id parameter, which has unknown impact and rem (no CVSS)
- [CVE-2007-3597](https://cve.now/CVE-2007-3597.md): Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.