# CVEs published 2007-07-30

50 CVEs were published on July 30, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-3387](https://cve.now/CVE-2007-3387.md): Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (no CVSS)
- [CVE-2007-4096](https://cve.now/CVE-2007-4096.md): Buffer overflow in Tor before 0.1.2.15, when using BSD natd support, allows remote attackers to cause a denial of service via unspecified ve (no CVSS)
- [CVE-2007-4097](https://cve.now/CVE-2007-4097.md): Tor before 0.1.2.15 sends "destroy cells" containing the reason for tearing down a circuit, which allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2007-4098](https://cve.now/CVE-2007-4098.md): Tor before 0.1.2.15 does not properly distinguish "streamids from different exits," which might allow remote attackers with control over Tor (no CVSS)
- [CVE-2007-4099](https://cve.now/CVE-2007-4099.md): Tor before 0.1.2.15 can select a guard node beyond the first listed never-before-connected-to guard node, which allows remote attackers with (no CVSS)
- [CVE-2007-4092](https://cve.now/CVE-2007-4092.md): Directory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibl (no CVSS)
- [CVE-2007-4093](https://cve.now/CVE-2007-4093.md): Minb Is Not a Blog (minb) stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2007-4094](https://cve.now/CVE-2007-4094.md): PHP remote file inclusion vulnerability in library/authorize.php in IDevSpot PhpHostBot allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2007-4095](https://cve.now/CVE-2007-4095.md): SQL injection vulnerability in BSM Store Dependent Forums 1.02 allows remote attackers to execute arbitrary SQL commands via a Username fiel (no CVSS)
- [CVE-2007-3911](https://cve.now/CVE-2007-3911.md): Multiple heap-based buffer overflows in (1) clsscheduler.exe (aka scheduler client) and (2) srvscheduler.exe (aka scheduler server) in BakBo (no CVSS)
- [CVE-2007-4053](https://cve.now/CVE-2007-4053.md): SQL injection vulnerability in include/img\_view.class.php in LinPHA 1.3.1 and earlier allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2007-4054](https://cve.now/CVE-2007-4054.md): SQL injection vulnerability in category.php in PHP123 Top Sites allows remote attackers to execute arbitrary SQL commands via the cat parame (no CVSS)
- [CVE-2007-4055](https://cve.now/CVE-2007-4055.md): SQL injection vulnerability in comments\_get.asp in SimpleBlog 3.0 allows remote attackers to execute arbitrary SQL commands via the id param (no CVSS)
- [CVE-2007-4056](https://cve.now/CVE-2007-4056.md): SQL injection vulnerability in directory.php in Prozilla Adult Directory allows remote attackers to execute arbitrary SQL commands via the c (no CVSS)
- [CVE-2007-4057](https://cve.now/CVE-2007-4057.md): Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary (no CVSS)
- [CVE-2007-4058](https://cve.now/CVE-2007-4058.md): Absolute path traversal vulnerability in a certain ActiveX control in vielib.dll 2.2.5.42958 in EMC VMware 6.0.0 allows remote attackers to (no CVSS)
- [CVE-2007-4059](https://cve.now/CVE-2007-4059.md): Absolute path traversal vulnerability in a certain ActiveX control in IntraProcessLogging.dll 5.5.3.42958 in EMC VMware allows remote attack (no CVSS)
- [CVE-2007-4060](https://cve.now/CVE-2007-4060.md): Multiple buffer overflows in the HttpSprockMake function in http.c in Frank Yaul corehttp 0.5.3alpha allow remote attackers to execute arbit (no CVSS)
- [CVE-2007-4061](https://cve.now/CVE-2007-4061.md): Directory traversal vulnerability in a certain ActiveX control in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to create or ov (no CVSS)
- [CVE-2007-4062](https://cve.now/CVE-2007-4062.md): The SCANCTRL.ScanCtrlCtrl.1 ActiveX control in scan.dll in Nessus Vulnerability Scanner 3.0.6 allows remote attackers to delete arbitrary fi (no CVSS)
- [CVE-2007-4063](https://cve.now/CVE-2007-4063.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delet (no CVSS)
- [CVE-2007-4064](https://cve.now/CVE-2007-4064.md): Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject a (no CVSS)
- [CVE-2007-4067](https://cve.now/CVE-2007-4067.md): Absolute path traversal vulnerability in the clInetSuiteX6.clWebDav ActiveX control in CLINETSUITEX6.OCX in Clever Internet ActiveX Suite 6. (no CVSS)
- [CVE-2007-4068](https://cve.now/CVE-2007-4068.md): Multiple SQL injection vulnerabilities in Webyapar 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the kat\_id parameter (no CVSS)
- [CVE-2007-4069](https://cve.now/CVE-2007-4069.md): SQL injection vulnerability in show\_cat.php in IndexScript 2.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-4070](https://cve.now/CVE-2007-4070.md): Unspecified vulnerability in Low Bandwidth X proxy (lbxproxy) on Sun Solaris 8 through 10 before 20070725 allows local users to read arbitra (no CVSS)
- [CVE-2007-4071](https://cve.now/CVE-2007-4071.md): Multiple cross-site scripting (XSS) vulnerabilities in uploader/index.php in Webbler CMS before 3.1.6 allow remote attackers to inject arbit (no CVSS)
- [CVE-2007-4072](https://cve.now/CVE-2007-4072.md): Webbler CMS before 3.1.6 provides the full installation path within HTML comments in certain documents, which allows remote attackers to obt (no CVSS)
- [CVE-2007-4073](https://cve.now/CVE-2007-4073.md): Webbler CMS before 3.1.6 does not properly restrict use of "mail a friend" forms, which allows remote attackers to send arbitrary amounts of (no CVSS)
- [CVE-2007-4074](https://cve.now/CVE-2007-4074.md): The default configuration of Centre for Speech Technology Research (CSTR) Festival 1.95 beta (aka 2.0 beta) on Gentoo Linux, SUSE Linux, and (no CVSS)
- [CVE-2007-4075](https://cve.now/CVE-2007-4075.md): Cross-site scripting (XSS) vulnerability in index.asp in Alisveris Sitesi Scripti allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-4076](https://cve.now/CVE-2007-4076.md): Multiple SQL injection vulnerabilities in index.asp in Alisveris Sitesi Scripti allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-4077](https://cve.now/CVE-2007-4077.md): Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2007-4078](https://cve.now/CVE-2007-4078.md): Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Text Ads Enterprise allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-4079](https://cve.now/CVE-2007-4079.md): Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft SMS Text Messaging Enterprise allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-4080](https://cve.now/CVE-2007-4080.md): Cross-site scripting (XSS) vulnerability in index.php AlstraSoft E-Friends allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2007-4081](https://cve.now/CVE-2007-4081.md): Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-4082](https://cve.now/CVE-2007-4082.md): Cross-site scripting (XSS) vulnerability in contact\_author.php AlstraSoft Article Manager Pro allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2007-4083](https://cve.now/CVE-2007-4083.md): Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2007-4084](https://cve.now/CVE-2007-4084.md): Multiple SQL injection vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to execute arbitrary SQL commands via (1) (no CVSS)
- [CVE-2007-4085](https://cve.now/CVE-2007-4085.md): Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the (1) que\_id p (no CVSS)
- [CVE-2007-4086](https://cve.now/CVE-2007-4086.md): Multiple SQL injection vulnerabilities in AlstraSoft Video Share Enterprise allow remote attackers to execute arbitrary SQL commands via (1) (no CVSS)
- [CVE-2007-4087](https://cve.now/CVE-2007-4087.md): AlstraSoft Video Share Enterprise allows remote attackers to obtain sensitive information (the full path) via (1) a ' (quote) character in t (no CVSS)
- [CVE-2007-4088](https://cve.now/CVE-2007-4088.md): Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2007-4089](https://cve.now/CVE-2007-4089.md): Vikingboard 0.1.2 allows remote attackers to obtain sensitive information via the debug parameter to (1) forum.php, (2) cp.php, and possibly (no CVSS)
- [CVE-2007-4090](https://cve.now/CVE-2007-4090.md): Multiple cross-site scripting (XSS) vulnerabilities in Vikingboard 0.1.2 allow remote attackers to inject arbitrary web script or HTML via ( (no CVSS)
- [CVE-2007-4048](https://cve.now/CVE-2007-4048.md): Cross-site scripting (XSS) vulnerability in index.php in phpSysInfo 2.5.4-dev and earlier allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2007-4050](https://cve.now/CVE-2007-4050.md): Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windo (no CVSS)
- [CVE-2007-4051](https://cve.now/CVE-2007-4051.md): Heap-based buffer overflow in the FindFiles function in UltraDefrag 1.0.3 allows local users to gain privileges via a file with a long pathn (no CVSS)
- [CVE-2007-4052](https://cve.now/CVE-2007-4052.md): Cross-site scripting (XSS) vulnerability in utilities/login.asp in nukedit 4.9.7 and earlier allows remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.