# CVEs published 2007-07-25

38 CVEs were published on July 25, 2007: 0 critical, 2 high. Days are UTC.

- [CVE-2007-3985](https://cve.now/CVE-2007-3985.md): Directory traversal vulnerability in file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3 allows remote attac (no CVSS)
- [CVE-2007-3986](https://cve.now/CVE-2007-3986.md): file.cgi in Secure Computing SecurityReporter (aka Network Security Analyzer) 4.6.3 allows remote attackers to bypass authentication via a n (no CVSS)
- [CVE-2007-3987](https://cve.now/CVE-2007-3987.md): SQL injection vulnerability in SearchResults.asp in ImageRacer 1.0, when WordSearchCrit is enabled, allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-3988](https://cve.now/CVE-2007-3988.md): Session fixation vulnerability in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier allows remote attackers to hijack web sessions b (no CVSS)
- [CVE-2007-3989](https://cve.now/CVE-2007-3989.md): Multiple cross-site scripting (XSS) vulnerabilities in default.asp in Dora Emlak 1.0, when the goster parameter is set to iletisim, allow re (no CVSS)
- [CVE-2007-3990](https://cve.now/CVE-2007-3990.md): SQL injection vulnerability in default.asp in Dora Emlak 1.0, when the goster parameter is set to emlakdetay, allows remote attackers to exe (no CVSS)
- [CVE-2007-3991](https://cve.now/CVE-2007-3991.md): Multiple cross-site scripting (XSS) vulnerabilities in cv.asp in Asp cvmatik 1.1 and earlier allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-3992](https://cve.now/CVE-2007-3992.md): SQL injection vulnerability in vir\_login.asp in iExpress Property Pro allows remote attackers to execute arbitrary SQL commands via the Pass (no CVSS)
- [CVE-2007-3993](https://cve.now/CVE-2007-3993.md): Unspecified vulnerability in the attachment filter in Kerio MailServer before 6.4.1 has unknown impact and remote attack vectors. (no CVSS)
- [CVE-2006-7221](https://cve.now/CVE-2006-7221.md): Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow attackers to cause a denial of service via unspecified vectors involving t (CVSS 7.5)
- [CVE-2007-3026](https://cve.now/CVE-2007-3026.md): Integer overflow in Panda Software AdminSecure allows remote attackers to execute arbitrary code via crafted packets with modified length va (no CVSS)
- [CVE-2007-3383](https://cve.now/CVE-2007-3383.md): Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomca (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-3531](https://cve.now/CVE-2007-3531.md): The set\_default\_speeds function in backend/backend.c in NVidia NVClock before 0.8b2 allows local users to overwrite arbitrary files via a sy (no CVSS)
- [CVE-2007-3679](https://cve.now/CVE-2007-3679.md): The Citrix EPA ActiveX control (aka the "endpoint checking control" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access G (no CVSS)
- [CVE-2007-3961](https://cve.now/CVE-2007-3961.md): Off-by-one error in the fsp\_readdir\_r function in fsplib.c in fsplib before 0.9 allows remote attackers to cause a denial of service via a d (no CVSS)
- [CVE-2007-3962](https://cve.now/CVE-2007-3962.md): Multiple stack-based buffer overflows in fsplib.c in fsplib before 0.9 might allow remote attackers to execute arbitrary code via (1) a long (no CVSS)
- [CVE-2007-3963](https://cve.now/CVE-2007-3963.md): Multiple cross-site scripting (XSS) vulnerabilities in UseBB 1.0.7, and possibly other 1.0.x versions, allow remote attackers to inject arbi (no CVSS)
- [CVE-2007-3964](https://cve.now/CVE-2007-3964.md): Itaka before 0.2.1, when using Authentication mode, allows remote attackers to bypass authentication and obtain sensitive information by dow (no CVSS)
- [CVE-2007-3965](https://cve.now/CVE-2007-3965.md): Unspecified vulnerability in uFMOD before 1.2.5 has unknown impact and attack vectors, possibly related to malformed files, and possibly an (no CVSS)
- [CVE-2007-3966](https://cve.now/CVE-2007-3966.md): SQL injection vulnerability in Munch Pro allows remote attackers to execute arbitrary SQL commands via the login field to /admin, a differen (no CVSS)
- [CVE-2007-3967](https://cve.now/CVE-2007-3967.md): Directory traversal vulnerability in index.php in PHP Directory Lister (dirLIST) before 0.1.1 allows remote attackers to list the contents o (CVSS 7.5)
- [CVE-2007-3968](https://cve.now/CVE-2007-3968.md): index.php in dirLIST before 0.1.1 allows remote attackers to list the contents of an excluded folder via a modified URL containing the folde (CVSS 5.3)
- [CVE-2007-3969](https://cve.now/CVE-2007-3969.md): Buffer overflow in Panda Antivirus before 20070720 allows remote attackers to execute arbitrary code via a crafted EXE file, resulting from (no CVSS)
- [CVE-2007-3970](https://cve.now/CVE-2007-3970.md): Race condition in ESET NOD32 Antivirus before 2.2289 allows remote attackers to execute arbitrary code via a crafted CAB file, which trigger (no CVSS)
- [CVE-2007-3971](https://cve.now/CVE-2007-3971.md): Integer overflow in ESET NOD32 Antivirus before 2.2289 allows remote attackers to cause a denial of service (CPU and disk consumption) via a (no CVSS)
- [CVE-2007-3972](https://cve.now/CVE-2007-3972.md): ESET NOD32 Antivirus before 2.2289 allows remote attackers to cause a denial of service via a crafted (1) ASPACK or (2) FSG packed file, whi (no CVSS)
- [CVE-2007-3973](https://cve.now/CVE-2007-3973.md): Multiple cross-site scripting (XSS) vulnerabilities in JBlog 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) i (no CVSS)
- [CVE-2007-3974](https://cve.now/CVE-2007-3974.md): admin/ajoutaut.php in JBlog 1.0 does not require authentication, which allows remote attackers to create arbitrary accounts via modified mot (no CVSS)
- [CVE-2007-3975](https://cve.now/CVE-2007-3975.md): Cross-site scripting (XSS) vulnerability in index.php in Elite Forum 1.0.0.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-3976](https://cve.now/CVE-2007-3976.md): SQL injection vulnerability in index.php in bwired allows remote attackers to execute arbitrary SQL commands via the newsID parameter. (no CVSS)
- [CVE-2007-3977](https://cve.now/CVE-2007-3977.md): Cross-site scripting (XSS) vulnerability in bwired allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. (no CVSS)
- [CVE-2007-3978](https://cve.now/CVE-2007-3978.md): Session fixation vulnerability in bwired allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. (no CVSS)
- [CVE-2007-3979](https://cve.now/CVE-2007-3979.md): SQL injection vulnerability in index.php in BlogSite Professional (aka Blog System) 1.x allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2007-3980](https://cve.now/CVE-2007-3980.md): PHP remote file inclusion vulnerability in page.php in RCMS Pro RGameScript Pro allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-3981](https://cve.now/CVE-2007-3981.md): SQL injection vulnerability in index.php in WSN Links Basic Edition allows remote attackers to execute arbitrary SQL commands via the catid (no CVSS)
- [CVE-2007-3982](https://cve.now/CVE-2007-3982.md): Absolute path traversal vulnerability in the Data Dynamics ActiveReport (ActiveReports) ActiveX control in actrpt2.dll 2.5 and earlier allow (no CVSS)
- [CVE-2007-3983](https://cve.now/CVE-2007-3983.md): Absolute path traversal vulnerability in the Data Dynamics DDActiveReports2.ActiveReport.2 (ActiveReports) ActiveX control in arpro2.dll in (no CVSS)
- [CVE-2007-3984](https://cve.now/CVE-2007-3984.md): Buffer overflow in a certain ActiveX control in the NixonMyPrograms class in sasatl.dll 1.5.0.531 in Zenturi ProgramChecker allows remote at (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-07-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.