# CVEs published 2007-07-15

44 CVEs were published on July 15, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-3013](https://cve.now/CVE-2007-3013.md): SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arb (no CVSS)
- [CVE-2007-3014](https://cve.now/CVE-2007-3014.md): Multiple cross-site scripting (XSS) vulnerabilities in activeWeb contentserver before 5.6.2964 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2007-3784](https://cve.now/CVE-2007-3784.md): Cross-site scripting (XSS) vulnerability in the Belkin G Plus Router F5D7231-4 with firmware 4.05.03 allows remote attackers to inject arbit (no CVSS)
- [CVE-2007-3785](https://cve.now/CVE-2007-3785.md): Absolute path traversal vulnerability in a certain ActiveX control in PGPBBox.dll in EldoS SecureBlackbox (sbb) 5.1.0.112 allows remote atta (no CVSS)
- [CVE-2007-3786](https://cve.now/CVE-2007-3786.md): Cross-site request forgery (CSRF) vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers t (no CVSS)
- [CVE-2007-3787](https://cve.now/CVE-2007-3787.md): The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote att (no CVSS)
- [CVE-2007-3788](https://cve.now/CVE-2007-3788.md): The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document, which might allow context-dependent attacker (no CVSS)
- [CVE-2007-3789](https://cve.now/CVE-2007-3789.md): SQL injection vulnerability in admin/index.php in Inmostore 4.0 allows remote attackers to execute arbitrary SQL commands via the Password f (no CVSS)
- [CVE-2007-3790](https://cve.now/CVE-2007-3790.md): The com\_print\_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial of service via a long (no CVSS)
- [CVE-2007-3791](https://cve.now/CVE-2007-3791.md): Buffer overflow in the w\_read function in sockets.c in Cami Sardinha and Nigel Kukard policyd before 1.81 for Postfix allows remote attacker (no CVSS)
- [CVE-2007-3792](https://cve.now/CVE-2007-3792.md): Multiple PHP remote file inclusion vulnerabilities in AzDG Dating Gold 3.0.5 allow remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-3793](https://cve.now/CVE-2007-3793.md): SQL injection vulnerability in Job Management Partner 1/NETM/DM (JP1/NETM/DM) Manager on Windows before 20070413 allows remote attackers to (no CVSS)
- [CVE-2007-3794](https://cve.now/CVE-2007-3794.md): Buffer overflow in Hitachi Cosminexus V4 through V7, Processing Kit for XML before 20070511, Developer's Kit for Java before 20070312, and t (no CVSS)
- [CVE-2007-3795](https://cve.now/CVE-2007-3795.md): Unspecified vulnerability in Hitachi TP1/Server Base before 03-05-/P, 05-00-x before 05-00-/G, 05-01-x before 05-01-/A, and 05-02-x before 0 (no CVSS)
- [CVE-2005-1924](https://cve.now/CVE-2005-1924.md): The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharact (no CVSS)
- [CVE-2006-4169](https://cve.now/CVE-2006-4169.md): Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authen (no CVSS)
- [CVE-2006-5278](https://cve.now/CVE-2006-5278.md): Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified Communications Manager (CUCM, (no CVSS)
- [CVE-2007-3103](https://cve.now/CVE-2007-3103.md): The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbi (no CVSS)
- [CVE-2007-3771](https://cve.now/CVE-2007-3771.md): Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1, and Client Secu (no CVSS)
- [CVE-2007-3772](https://cve.now/CVE-2007-3772.md): Directory traversal vulnerability in news/show.php in PsNews 1.1 allows remote attackers to include and execute arbitrary local files via a (no CVSS)
- [CVE-2007-3773](https://cve.now/CVE-2007-3773.md): Cross-site request forgery (CSRF) vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to uplo (no CVSS)
- [CVE-2007-3774](https://cve.now/CVE-2007-3774.md): Dvbbs 7.1.0 SP1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS)
- [CVE-2007-3775](https://cve.now/CVE-2007-3775.md): Unspecified vulnerability in Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allows rem (no CVSS)
- [CVE-2007-3776](https://cve.now/CVE-2007-3776.md): Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allow remote attackers to obtain sensit (no CVSS)
- [CVE-2007-3777](https://cve.now/CVE-2007-3777.md): avg7core.sys 7.5.0.444 in Grisoft AVG Anti-Virus 7.5.448 and Free Edition 7.5.446, provides an internal function that copies data to an arbi (no CVSS)
- [CVE-2007-3778](https://cve.now/CVE-2007-3778.md): The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell met (no CVSS)
- [CVE-2007-3779](https://cve.now/CVE-2007-3779.md): PHP local file inclusion vulnerability in gpg\_pop\_init.php in the G/PGP (GPG) Plugin before 20070707 for Squirrelmail allows remote attacker (no CVSS)
- [CVE-2007-3780](https://cve.now/CVE-2007-3780.md): MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in (no CVSS)
- [CVE-2007-3781](https://cve.now/CVE-2007-3781.md): MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which (no CVSS)
- [CVE-2007-3782](https://cve.now/CVE-2007-3782.md): MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view (no CVSS)
- [CVE-2007-3783](https://cve.now/CVE-2007-3783.md): SQL injection vulnerability in default.asp in enVivo!CMS allows remote attackers to execute arbitrary SQL commands via the ID parameter in a (no CVSS)
- [CVE-2006-5277](https://cve.now/CVE-2006-5277.md): Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM, forme (no CVSS)
- [CVE-2007-2392](https://cve.now/CVE-2007-2392.md): Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via a crafted movie (no CVSS)
- [CVE-2007-2393](https://cve.now/CVE-2007-2393.md): The design of QuickTime for Java in Apple Quicktime before 7.2 allows remote attackers to bypass certain security controls and write to proc (no CVSS)
- [CVE-2007-2394](https://cve.now/CVE-2007-2394.md): Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code (no CVSS)
- [CVE-2007-2396](https://cve.now/CVE-2007-2396.md): The JDirect support in QuickTime for Java in Apple Quicktime before 7.2 exposes certain dangerous interfaces, which allows remote attackers (no CVSS)
- [CVE-2007-2397](https://cve.now/CVE-2007-2397.md): QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions, which allows remote attackers to disable security cont (no CVSS)
- [CVE-2007-2402](https://cve.now/CVE-2007-2402.md): QuickTime for Java in Apple Quicktime before 7.2 does not perform sufficient "access control," which allows remote attackers to obtain sensi (no CVSS)
- [CVE-2007-2417](https://cve.now/CVE-2007-2417.md): Heap-based buffer overflow in \_mprosrv.exe in Progress Software Progress 9.1E and OpenEdge 10.1x, as used by the RSA Authentication Manager (no CVSS)
- [CVE-2007-3645](https://cve.now/CVE-2007-3645.md): archive\_read\_support\_format\_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (crash) via (no CVSS)
- [CVE-2007-3673](https://cve.now/CVE-2007-3673.md): Symantec symtdi.sys before 7.0.0, as distributed in Symantec AntiVirus Corporate Edition 9 through 10.1 and Client Security 2.0 through 3.1, (no CVSS)
- [CVE-2007-3768](https://cve.now/CVE-2007-3768.md): The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed respo (no CVSS)
- [CVE-2007-3769](https://cve.now/CVE-2007-3769.md): Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP serv (no CVSS)
- [CVE-2007-3770](https://cve.now/CVE-2007-3770.md): The terminal\_helper\_execute function in terminal/terminal.c in Xfce Terminal 0.2.6 allows user-assisted remote attackers to execute arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.