# CVEs published 2007-07-17

39 CVEs were published on July 17, 2007: 0 critical, 1 high. Days are UTC.

- [CVE-2007-3796](https://cve.now/CVE-2007-3796.md): The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify (no CVSS)
- [CVE-2007-3832](https://cve.now/CVE-2007-3832.md): Buffer overflow in the AOL Instant Messenger (AIM) protocol handler in AIM.DLL in Cerulean Studios Trillian allows remote attackers to execu (no CVSS)
- [CVE-2007-3833](https://cve.now/CVE-2007-3833.md): The AOL Instant Messenger (AIM) protocol handler in Cerulean Studios Trillian allows remote attackers to create files with arbitrary content (no CVSS)
- [CVE-2007-3834](https://cve.now/CVE-2007-3834.md): Multiple cross-site scripting (XSS) vulnerabilities in Ex Libris ALEPH allow remote attackers to inject arbitrary web script or HTML via uns (no CVSS)
- [CVE-2007-3835](https://cve.now/CVE-2007-3835.md): Cross-site scripting (XSS) vulnerability in Ex Libris MetaLib 3.13 and 4 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-3836](https://cve.now/CVE-2007-3836.md): Format string vulnerability in HydraIRC 0.3.151 allows remote attackers to cause a denial of service via format string specifiers in certain (no CVSS)
- [CVE-2007-3837](https://cve.now/CVE-2007-3837.md): Heap-based buffer overflow in HydraIRC 0.3.151 allows remote IRC servers to cause a denial of service (application crash) via a long CTCP re (no CVSS)
- [CVE-2007-3838](https://cve.now/CVE-2007-3838.md): Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 11-10-05-BETA-SF1:111005 and earlier allows remote attackers to (no CVSS)
- [CVE-2007-3839](https://cve.now/CVE-2007-3839.md): Cross-site scripting (XSS) vulnerability in takeprofedit.php in TBDev.NET DR 010306 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-3840](https://cve.now/CVE-2007-3840.md): SQL injection vulnerability in referralUrl.php in Traffic Stats allows remote attackers to execute arbitrary SQL commands via the offset par (no CVSS)
- [CVE-2007-3841](https://cve.now/CVE-2007-3841.md): Unspecified vulnerability in Pidgin (formerly Gaim) 2.0.2 for Linux allows remote authenticated users, who are listed in a users list, to ex (no CVSS)
- [CVE-2007-3842](https://cve.now/CVE-2007-3842.md): Cross-site scripting (XSS) vulnerability in the 8e6 R3000 Enterprise Filter before 2.0.05 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2007-3826](https://cve.now/CVE-2007-3826.md): Microsoft Internet Explorer 7 on Windows XP SP2 allows remote attackers to prevent users from leaving a site, spoof the address bar, and con (no CVSS)
- [CVE-2007-3827](https://cve.now/CVE-2007-3827.md): Mozilla Firefox allows for cookies to be set with a null domain (aka "domainless cookies"), which allows remote attackers to pass informatio (no CVSS)
- [CVE-2007-3828](https://cve.now/CVE-2007-3828.md): Unspecified vulnerability in mDNSResponder in Apple Mac OS X allows remote attackers to execute arbitrary code via unspecified vectors, a re (no CVSS)
- [CVE-2007-3829](https://cve.now/CVE-2007-3829.md): Multiple stack-based buffer overflows in (a) InterActual Player 2.60.12.0717 and (b) Roxio CinePlayer 3.2 allow remote attackers to execute (no CVSS)
- [CVE-2007-3830](https://cve.now/CVE-2007-3830.md): Cross-site scripting (XSS) vulnerability in alert.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to inje (no CVSS)
- [CVE-2007-3831](https://cve.now/CVE-2007-3831.md): PHP remote file inclusion in main.php in ISS Proventia Network IPS GX5108 1.3 and GX5008 1.5 allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2007-3817](https://cve.now/CVE-2007-3817.md): Cross-site scripting (XSS) vulnerability in the LoginToboggan module 4.7.x-1.0, 4.7.x-1.x-dev, and 5.x-1.x-dev before 20070712 for Drupal, w (no CVSS)
- [CVE-2007-3818](https://cve.now/CVE-2007-3818.md): Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated user (no CVSS)
- [CVE-2007-3819](https://cve.now/CVE-2007-3819.md): Opera 9.21 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trailing whitespace, which prevents (no CVSS)
- [CVE-2007-3820](https://cve.now/CVE-2007-3820.md): konqueror/konq\_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the address bar via a long URI with trai (no CVSS)
- [CVE-2007-3821](https://cve.now/CVE-2007-3821.md): Cross-site request forgery (CSRF) vulnerability in Webcit before 7.11 allows remote attackers to modify configurations and perform other act (no CVSS)
- [CVE-2007-3822](https://cve.now/CVE-2007-3822.md): Multiple cross-site scripting (XSS) vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-3823](https://cve.now/CVE-2007-3823.md): The Logging Server (Logsrv.exe) in IPSwitch WS\_FTP 7.5.29.0 allows remote attackers to cause a denial of service (daemon crash) by sending a (no CVSS)
- [CVE-2007-3824](https://cve.now/CVE-2007-3824.md): SQL injection vulnerability in katgoster.asp in MzK Blog (tr) allows remote attackers to execute arbitrary SQL commands via the katID parame (no CVSS)
- [CVE-2007-3017](https://cve.now/CVE-2007-3017.md): The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wys (no CVSS)
- [CVE-2007-3018](https://cve.now/CVE-2007-3018.md): activeWeb contentserver CMS before 5.6.2964 does not limit the file-creation ability of editors who have restricted accounts, which allows t (no CVSS)
- [CVE-2007-3806](https://cve.now/CVE-2007-3806.md): The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an in (no CVSS)
- [CVE-2007-3807](https://cve.now/CVE-2007-3807.md): Multiple cross-site scripting (XSS) vulnerabilities in SiteScape Forum before 7.3 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-3808](https://cve.now/CVE-2007-3808.md): SQL injection vulnerability in includes/search.php in paFileDB 3.6 allows remote attackers to execute arbitrary SQL commands via the categor (no CVSS)
- [CVE-2007-3809](https://cve.now/CVE-2007-3809.md): Multiple SQL injection vulnerabilities in Prozilla Directory Script allow remote attackers to execute arbitrary SQL commands via the cat\_id (no CVSS)
- [CVE-2007-3810](https://cve.now/CVE-2007-3810.md): SQL injection vulnerability in index.php in Realtor 747 allows remote attackers to execute arbitrary SQL commands via the categoryid paramet (no CVSS)
- [CVE-2007-3811](https://cve.now/CVE-2007-3811.md): Multiple SQL injection vulnerabilities in eSyndiCat allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to new (no CVSS)
- [CVE-2007-3812](https://cve.now/CVE-2007-3812.md): SQL injection vulnerability in forums.php in CMScout 1.23 and earlier allows remote attackers to execute arbitrary SQL commands via the f pa (no CVSS)
- [CVE-2007-3813](https://cve.now/CVE-2007-3813.md): PHP remote file inclusion vulnerability in include/user.php in the NoBoard BETA module for MKPortal allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-3814](https://cve.now/CVE-2007-3814.md): Multiple SQL injection vulnerabilities in MKPortal 1.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the idurlo field i (no CVSS)
- [CVE-2007-3815](https://cve.now/CVE-2007-3815.md): Buffer overflow in pirs32.exe in Poslovni informator Republike Slovenije (PIRS) 2007 allows local users to cause a denial of service (applic (no CVSS)
- [CVE-2007-3816](https://cve.now/CVE-2007-3816.md): JWIG might allow context-dependent attackers to cause a denial of service (service degradation) via loops of references to external template (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-07-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.