# CVEs published 2007-08-08

84 CVEs were published on August 8, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-4244](https://cve.now/CVE-2007-4244.md): PHP remote file inclusion vulnerability in langset.php in J! Reactions (com\_jreactions) 1.8.1 and earlier, a Joomla! component, allows remot (no CVSS)
- [CVE-2007-4245](https://cve.now/CVE-2007-4245.md): Cross-site scripting (XSS) vulnerability in Search.php in DiMeMa CONTENTdm (CDM) allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-4246](https://cve.now/CVE-2007-4246.md): Unspecified vulnerability, possibly a buffer overflow, in Justsystem Ichitaro 2007 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-4247](https://cve.now/CVE-2007-4247.md): Windows Calendar on Microsoft Windows Vista allows remote attackers to cause a denial of service (NULL dereference and persistent applicatio (no CVSS)
- [CVE-2007-4248](https://cve.now/CVE-2007-4248.md): The CallCmd function in toolbar\_gaming.dll in the Toolbar Gaming toolbar for Internet Explorer allows remote attackers to cause a denial of (no CVSS)
- [CVE-2007-4249](https://cve.now/CVE-2007-4249.md): The isChecked function in Toolbar.DLL in the ExportNation toolbar for Internet Explorer allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2007-4250](https://cve.now/CVE-2007-4250.md): The isChecked function in Toolbar.DLL in Advanced Searchbar before 3.33 allows remote attackers to cause a denial of service (NULL dereferen (no CVSS)
- [CVE-2007-4251](https://cve.now/CVE-2007-4251.md): OpenOffice.org (OOo) 2.2 does not properly handle files with multiple extensions, which allows user-assisted remote attackers to cause a den (no CVSS)
- [CVE-2007-4252](https://cve.now/CVE-2007-4252.md): Absolute path traversal vulnerability in a certain ActiveX control in CkString.dll 1.1 and earlier in CHILKAT ASP String allows remote attac (no CVSS)
- [CVE-2007-4253](https://cve.now/CVE-2007-4253.md): SQL injection vulnerability in the News module in modules.php in Envolution 1.1.0 and earlier allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2007-4254](https://cve.now/CVE-2007-4254.md): Stack-based buffer overflow in a certain ActiveX control in VDT70.DLL in Microsoft Visual Database Tools Database Designer 7.0 for Microsoft (no CVSS)
- [CVE-2007-4255](https://cve.now/CVE-2007-4255.md): Buffer overflow in the mSQL extension in PHP 5.2.3 allows context-dependent attackers to execute arbitrary code via a long first argument to (no CVSS)
- [CVE-2007-4256](https://cve.now/CVE-2007-4256.md): Directory traversal vulnerability in showpage.cgi in YNP Portal System 2.2.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-4257](https://cve.now/CVE-2007-4257.md): Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow user-assisted remote attackers to execute arbitrary code via (1) a .spr fi (no CVSS)
- [CVE-2007-4258](https://cve.now/CVE-2007-4258.md): SQL injection vulnerability in directory.php in Prozilla Pub Site Directory allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2007-4259](https://cve.now/CVE-2007-4259.md): EZPhotoSales 1.9.3 and earlier allows remote attackers to download arbitrary image files via (1) a direct request for a URL under OnlineView (no CVSS)
- [CVE-2007-4260](https://cve.now/CVE-2007-4260.md): EZPhotoSales 1.9.3 and earlier has a default "admin" account for galleries, which allows remote attackers to access arbitrary galleries by s (no CVSS)
- [CVE-2007-4261](https://cve.now/CVE-2007-4261.md): EZPhotoSales 1.9.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attacke (no CVSS)
- [CVE-2007-4262](https://cve.now/CVE-2007-4262.md): Unrestricted file upload vulnerability in EZPhotoSales 1.9.3 and earlier allows remote authenticated administrators to upload and execute ar (no CVSS)
- [CVE-2007-4263](https://cve.now/CVE-2007-4263.md): Unspecified vulnerability in the server side of the Secure Copy (SCP) implementation in Cisco 12.2-based IOS allows remote authenticated use (no CVSS)
- [CVE-2007-4226](https://cve.now/CVE-2007-4226.md): Directory traversal vulnerability in the BlueCat Networks Proteus IPAM appliance 2.0.2.0 (Adonis DNS/DHCP appliance 5.0.2.8) allows remote a (no CVSS)
- [CVE-2007-4227](https://cve.now/CVE-2007-4227.md): Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain JPG file, as demo (no CVSS)
- [CVE-2007-4228](https://cve.now/CVE-2007-4228.md): rmpvc on IBM AIX 4.3 allows local users to cause a denial of service (system crash) via long port logical name (-l) argument. (no CVSS)
- [CVE-2007-4229](https://cve.now/CVE-2007-4229.md): Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service (failed assertion and appl (no CVSS)
- [CVE-2007-4230](https://cve.now/CVE-2007-4230.md): BellaBiblio allows remote attackers to gain administrative privileges via a bellabiblio cookie with the value "administrator." NOTE: this is (no CVSS)
- [CVE-2007-4231](https://cve.now/CVE-2007-4231.md): PHP remote file inclusion vulnerability in order/login.php in IDevSpot PhpHostBot 1.06 and earlier allows remote attackers to execute arbitr (no CVSS)
- [CVE-2007-4232](https://cve.now/CVE-2007-4232.md): PHP remote file inclusion vulnerability in admin/inc/change\_action.php in Andreas Robertz PHPNews 0.93 allows remote attackers to execute ar (no CVSS)
- [CVE-2007-4233](https://cve.now/CVE-2007-4233.md): Multiple unspecified vulnerabilities in Camera Life before 2.6 allow attackers to cause a denial of service via unknown vectors. (no CVSS)
- [CVE-2007-4234](https://cve.now/CVE-2007-4234.md): Unspecified vulnerability in Camera Life before 2.6 allows remote attackers to download private photos via unspecified vectors associated wi (no CVSS)
- [CVE-2007-4235](https://cve.now/CVE-2007-4235.md): Multiple PHP remote file inclusion vulnerabilities in VietPHP allow remote attackers to execute arbitrary PHP code via a URL in (1) the dirp (no CVSS)
- [CVE-2007-4236](https://cve.now/CVE-2007-4236.md): Buffer overflow in lpd in bos.rte.printers in AIX 5.2 and 5.3 allows local users with printq group privileges to gain root privileges. (no CVSS)
- [CVE-2007-4237](https://cve.now/CVE-2007-4237.md): Buffer overflow in the atm subset in arp in devices.common.IBM.atm.rte in AIX 5.2 and 5.3 allows local users to gain root privileges. (no CVSS)
- [CVE-2007-4238](https://cve.now/CVE-2007-4238.md): AIX 5.2 and 5.3 install pioinit with user and group ownership of bin, which allows local users with bin or possibly printq privileges to gai (no CVSS)
- [CVE-2007-4239](https://cve.now/CVE-2007-4239.md): Cross-site scripting (XSS) vulnerability in user/forgotPassStep2.jsp in the admin interface in C-SAM oneWallet 210\_07062007;1.0 allows remot (no CVSS)
- [CVE-2007-4240](https://cve.now/CVE-2007-4240.md): The check\_logout function in class/auth.php in Help Center Live (hcl) 2.1.3a sends a redirect to the web browser but does not exit when admi (no CVSS)
- [CVE-2007-4241](https://cve.now/CVE-2007-4241.md): Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller for Cisco Local Director on HP-UX 11.11i allows remote attackers to execute ar (no CVSS)
- [CVE-2007-4242](https://cve.now/CVE-2007-4242.md): The pop3 Proxy in Astaro Security Gateway (ASG) 7 does not perform virus scanning of attachments that exceed the maximum attachment size, an (no CVSS)
- [CVE-2007-4243](https://cve.now/CVE-2007-4243.md): Unspecified vulnerability in pfilter-reporter.pl in Astaro Security Gateway (ASG) 7 allows remote attackers to cause a denial of service (CP (no CVSS)
- [CVE-2007-4224](https://cve.now/CVE-2007-4224.md): KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the windo (no CVSS)
- [CVE-2007-4225](https://cve.now/CVE-2007-4225.md): Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar via an http URI with a large amo (no CVSS)
- [CVE-2005-4860](https://cve.now/CVE-2005-4860.md): Spectrum Cash Receipting System before 6.504 uses weak cryptography (static substitution) in the PASSFILE password file, which makes it easi (no CVSS)
- [CVE-2007-4205](https://cve.now/CVE-2007-4205.md): XHA (Linux-HA) on the BlueCat Networks Adonis DNS/DHCP Appliance 5.0.2.8 allows remote attackers to cause a denial of service (heartbeat con (no CVSS)
- [CVE-2007-4206](https://cve.now/CVE-2007-4206.md): Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4) sets incorrect permissions for application files in certain upgrade scenarios, (no CVSS)
- [CVE-2007-4207](https://cve.now/CVE-2007-4207.md): SQL injection vulnerability in admin\_console/index.asp in Gallery In A Box allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-4208](https://cve.now/CVE-2007-4208.md): SQL injection vulnerability in default.asp in Next Gen Portfolio Manager allows remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2007-4209](https://cve.now/CVE-2007-4209.md): SQL injection vulnerability in Recherche.php in Aceboard forum allows remote attackers to execute arbitrary SQL commands via unspecified vec (no CVSS)
- [CVE-2007-4210](https://cve.now/CVE-2007-4210.md): Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) CMS 1.2.14 allow remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2007-4211](https://cve.now/CVE-2007-4211.md): The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) A (no CVSS)
- [CVE-2007-4212](https://cve.now/CVE-2007-4212.md): Multiple cross-site scripting (XSS) vulnerabilities in the Search Module in PHP-Nuke allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-2927](https://cve.now/CVE-2007-2927.md): Unspecified vulnerability in Atheros 802.11 a/b/g wireless adapter drivers before 5.3.0.35, and 6.x before 6.0.3.67, on Windows allows remot (no CVSS)
- [CVE-2007-3108](https://cve.now/CVE-2007-3108.md): The BN\_from\_montgomery function in crypto/bn/bn\_mont.c in OpenSSL 0.9.8e and earlier does not properly perform Montgomery multiplication, wh (no CVSS)
- [CVE-2007-3384](https://cve.now/CVE-2007-3384.md): Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attack (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2007-3844](https://cve.now/CVE-2007-3844.md): Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and before 1.5.0.13, and SeaMonkey 1.1.3 allows remote attackers to conduct cross-site scriptin (no CVSS)
- [CVE-2007-3845](https://cve.now/CVE-2007-3845.md): Mozilla Firefox before 2.0.0.6, Thunderbird before 1.5.0.13 and 2.x before 2.0.0.6, and SeaMonkey before 1.1.4 allow remote attackers to exe (no CVSS)
- [CVE-2007-4175](https://cve.now/CVE-2007-4175.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenRat CMS 0.8-beta1 and earlier allow remote attackers to inject arbit (no CVSS)
- [CVE-2007-4176](https://cve.now/CVE-2007-4176.md): Multiple unspecified vulnerabilities in EQDKP Plus before 0.4.4.5 have unknown impact and attack vectors. (no CVSS)
- [CVE-2007-4177](https://cve.now/CVE-2007-4177.md): Multiple cross-site scripting (XSS) vulnerabilities in Interact before 2.4 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-4178](https://cve.now/CVE-2007-4178.md): Cross-site scripting (XSS) vulnerability in index.php in WebDirector 2.2 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-4179](https://cve.now/CVE-2007-4179.md): Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11 and B.11.23 allows local (no CVSS)
- [CVE-2007-4180](https://cve.now/CVE-2007-4180.md): Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register\_globals is enabled, allows remote attackers to read arbi (no CVSS)
- [CVE-2007-4181](https://cve.now/CVE-2007-4181.md): PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register\_globals is enabled, allows remote attackers to exe (no CVSS)
- [CVE-2007-4182](https://cve.now/CVE-2007-4182.md): Unrestricted file upload vulnerability in index.php in WikiWebWeaver 1.1 and earlier allows remote attackers to upload and execute arbitrary (no CVSS)
- [CVE-2007-4183](https://cve.now/CVE-2007-4183.md): SQL injection vulnerability in main.php in paBugs 2.0 Beta 3 and earlier allows remote attackers to execute arbitrary SQL commands via the c (no CVSS)
- [CVE-2007-4184](https://cve.now/CVE-2007-4184.md): SQL injection vulnerability in administrator/popups/pollwindow.php in Joomla! 1.0.12 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-4185](https://cve.now/CVE-2007-4185.md): Joomla! 1.0.12 allows remote attackers to obtain sensitive information via a direct request for (1) Stat.php (2) OutputFilter.php, (3) Outpu (no CVSS)
- [CVE-2007-4186](https://cve.now/CVE-2007-4186.md): PHP remote file inclusion vulnerability in admin.tour\_toto.php in the Tour de France Pool (com\_tour\_toto) 1.0.1 module for Joomla! allows re (no CVSS)
- [CVE-2007-4187](https://cve.now/CVE-2007-4187.md): Multiple eval injection vulnerabilities in the com\_search component in Joomla! 1.5 beta before RC1 (aka Mapya) allow remote attackers to exe (no CVSS)
- [CVE-2007-4188](https://cve.now/CVE-2007-4188.md): Session fixation vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to hijack administrative web sessions via unsp (no CVSS)
- [CVE-2007-4189](https://cve.now/CVE-2007-4189.md): Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.13 (aka Sunglow) allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2007-4190](https://cve.now/CVE-2007-4190.md): CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably co (no CVSS, joomla/application)
- [CVE-2007-4191](https://cve.now/CVE-2007-4191.md): Panda Antivirus 2008 stores service executables under the product's installation directory with weak permissions, which allows local users t (no CVSS)
- [CVE-2007-4192](https://cve.now/CVE-2007-4192.md): Multiple cross-site scripting (XSS) vulnerabilities in IDE Group DVD Rental System (DRS) 5.1 before 20070801 allow remote attackers to injec (no CVSS)
- [CVE-2007-4193](https://cve.now/CVE-2007-4193.md): Multiple cross-site request forgery (CSRF) vulnerabilities in index.php in IDE Group DVD Rental System (DRS) 5.1 before 20070801 allow remot (no CVSS)
- [CVE-2007-4194](https://cve.now/CVE-2007-4194.md): Guidance Software EnCase 5.0 allows user-assisted remote attackers to cause a denial of service (stack memory consumption) and possibly have (no CVSS)
- [CVE-2007-4195](https://cve.now/CVE-2007-4195.md): Use-after-free vulnerability in ext2fs.c in Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted remote attackers to cause a (no CVSS)
- [CVE-2007-4196](https://cve.now/CVE-2007-4196.md): icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 misinterprets a certain memory location as the holder of a loop iteration count, whic (no CVSS)
- [CVE-2007-4197](https://cve.now/CVE-2007-4197.md): icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 omits NULL pointer checks in certain code paths, which allows user-assisted remote at (no CVSS)
- [CVE-2007-4198](https://cve.now/CVE-2007-4198.md): The fs\_data\_put\_str function in ntfs.c in fls in Brian Carrier The Sleuth Kit (TSK) before 2.09 does not validate a certain length value, wh (no CVSS)
- [CVE-2007-4199](https://cve.now/CVE-2007-4199.md): Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted remote attackers to cause a denial of service (application crash) and pr (no CVSS)
- [CVE-2007-4200](https://cve.now/CVE-2007-4200.md): ntfs.c in fsstat in Brian Carrier The Sleuth Kit (TSK) before 2.09 interprets a certain variable as a byte count rather than a count of 32-b (no CVSS)
- [CVE-2007-4201](https://cve.now/CVE-2007-4201.md): Guidance Software EnCase 6.2 and 6.5 does not properly handle a volume with more than 25 partitions, which might allow remote attackers to p (no CVSS)
- [CVE-2007-4202](https://cve.now/CVE-2007-4202.md): Guidance Software EnCase Enterprise Edition (EEE) 6 does not properly verify the identity of the acquisition target during communication wit (no CVSS)
- [CVE-2007-4203](https://cve.now/CVE-2007-4203.md): Session fixation vulnerability in Mambo 4.6.2 CMS allows remote attackers to hijack web sessions by setting the Cookie parameter. (no CVSS)
- [CVE-2007-4204](https://cve.now/CVE-2007-4204.md): Hitachi Groupmax Collaboration - Schedule, as used in Groupmax Collaboration Portal 07-32 through 07-32-/B, uCosminexus Collaboration Portal (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-08-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.