# CVEs published 2007-08-27

15 CVEs were published on August 27, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-4544](https://cve.now/CVE-2007-4544.md): Cross-site scripting (XSS) vulnerability in wp-newblog.php in WordPress multi-user (MU) 1.0 and earlier allows remote attackers to inject ar (no CVSS)
- [CVE-2007-4545](https://cve.now/CVE-2007-4545.md): Multiple directory traversal vulnerabilities in Unreal Commander 0.92 build 565 and 573 allow user-assisted remote attackers to create or ov (no CVSS)
- [CVE-2007-4546](https://cve.now/CVE-2007-4546.md): Unreal Commander 0.92 build 565 and 573 lists the filenames from the Central Directory of a ZIP archive, but extracts to local filenames cor (no CVSS)
- [CVE-2007-4547](https://cve.now/CVE-2007-4547.md): Unreal Commander 0.92 build 565 and 573 writes portions of heap memory into local files when extracting from an archive with malformed size (no CVSS)
- [CVE-2007-4548](https://cve.now/CVE-2007-4548.md): The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows r (no CVSS)
- [CVE-2007-4537](https://cve.now/CVE-2007-4537.md): Heap-based buffer overflow in the Huffman decompression algorithm implemented in Skulltag 0.97d-beta4.1 and earlier allows remote attackers (no CVSS)
- [CVE-2007-4538](https://cve.now/CVE-2007-4538.md): email\_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the E (no CVSS)
- [CVE-2007-4539](https://cve.now/CVE-2007-4539.md): The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which (no CVSS)
- [CVE-2007-4540](https://cve.now/CVE-2007-4540.md): Multiple SQL injection vulnerabilities in download.php in Olate Download (od) 3.4.2 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-4541](https://cve.now/CVE-2007-4541.md): Multiple cross-site scripting (XSS) vulnerabilities in Olate Download (od) 3.4.2 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2007-4542](https://cve.now/CVE-2007-4542.md): Multiple cross-site scripting (XSS) vulnerabilities in MapServer before 4.10.3 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-4543](https://cve.now/CVE-2007-4543.md): Cross-site scripting (XSS) vulnerability in enter\_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allo (no CVSS)
- [CVE-2007-2797](https://cve.now/CVE-2007-2797.md): xterm, including 192-7.el4 in Red Hat Enterprise Linux and 208-3.1 in Debian GNU/Linux, sets the wrong group ownership of tty devices, which (no CVSS)
- [CVE-2007-2958](https://cve.now/CVE-2007-2958.md): Format string vulnerability in the inc\_put\_error function in src/inc.c in Sylpheed 2.4.4, and Sylpheed-Claws (Claws Mail) 1.9.100 and 2.10.0 (no CVSS)
- [CVE-2007-3741](https://cve.now/CVE-2007-3741.md): The (1) psp (aka .tub), (2) bmp, (3) pcx, and (4) psd plugins in gimp allow user-assisted remote attackers to cause a denial of service (cra (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.