# CVEs published 2007-08-28 23 CVEs were published on August 28, 2007: 1 critical, 0 high. Days are UTC. - [CVE-2007-3846](https://cve.now/CVE-2007-3846.md): Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on W (no CVSS) - [CVE-2007-4577](https://cve.now/CVE-2007-4577.md): Sophos Anti-Virus for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed BZip fil (no CVSS) - [CVE-2007-4578](https://cve.now/CVE-2007-4578.md): Sophos Anti-Virus for Windows and for Unix/Linux before 2.48.0 allows remote attackers to cause a denial of service (crash) and possibly exe (no CVSS) - [CVE-2007-4580](https://cve.now/CVE-2007-4580.md): Buffer underflow in redlight.sys in BufferZone 2.1 and 2.5 allows local users to cause a denial of service (crash) and possibly execute arbi (no CVSS) - [CVE-2006-7222](https://cve.now/CVE-2006-7222.md): Buffer overflow in the CFLICStream::\_deltachunk function in FLICSource.cpp in Media Player Classic (MPC) 6.4.9.0 allows user-assisted remote (no CVSS) - [CVE-2007-4521](https://cve.now/CVE-2007-4521.md): Asterisk Open Source 1.4.5 through 1.4.11, when configured to use an IMAP voicemail storage backend, allows remote attackers to cause a deni (no CVSS) - [CVE-2007-4556](https://cve.now/CVE-2007-4556.md): Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all inp (no CVSS, opensymphony:xwork) - [CVE-2007-4557](https://cve.now/CVE-2007-4557.md): Cross-site scripting (XSS) vulnerability in the webacc servlet in Novell GroupWise 6.5 WebAccess allows remote attackers to inject arbitrary (no CVSS) - [CVE-2007-4560](https://cve.now/CVE-2007-4560.md): clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metachar (no CVSS) - [CVE-2007-4561](https://cve.now/CVE-2007-4561.md): Heap-based buffer overflow in the RTSP service in Helix DNA Server before 11.1.4 allows remote attackers to execute arbitrary code via an RS (no CVSS) - [CVE-2007-4562](https://cve.now/CVE-2007-4562.md): Unspecified vulnerability in Hitachi DABroker before 03-02-/D and Cosminexus DABroker before 02-04-/C and 03-05-/E allows remote attackers t (no CVSS) - [CVE-2007-4563](https://cve.now/CVE-2007-4563.md): Cosminexus Manager in Cosminexus Application Server 06-50 and later might assign the wrong user's group permissions to logical J2EE server p (no CVSS) - [CVE-2007-4564](https://cve.now/CVE-2007-4564.md): Cosminexus Manager in Cosminexus Application Server 07-00 and later might assign the wrong user's group permissions to logical user server p (no CVSS) - [CVE-2007-4565](https://cve.now/CVE-2007-4565.md): sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by (no CVSS) - [CVE-2007-4566](https://cve.now/CVE-2007-4566.md): Multiple buffer overflows in the login mechanism in sidvault in Alpha Centauri Software SIDVault LDAP Server before 2.0f allow remote attack (no CVSS) - [CVE-2007-4549](https://cve.now/CVE-2007-4549.md): Multiple buffer overflows in ALPass 2.7 English and 3.02 Korean allow user-assisted remote attackers to execute arbitrary code via an ALPass (no CVSS) - [CVE-2007-4550](https://cve.now/CVE-2007-4550.md): Format string vulnerability in ALPass 2.7 English and 3.02 Korean might allow user-assisted remote attackers to execute arbitrary code via f (no CVSS) - [CVE-2007-4551](https://cve.now/CVE-2007-4551.md): PHP remote file inclusion vulnerability in index.php in Agares Media Arcadem 2.01 allows remote attackers to execute arbitrary PHP code via (no CVSS) - [CVE-2007-4552](https://cve.now/CVE-2007-4552.md): SQL injection vulnerability in index.php in Agares Media Arcadem 2.01 allows remote attackers to execute arbitrary SQL commands via the bloc (no CVSS) - [CVE-2007-4553](https://cve.now/CVE-2007-4553.md): The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via an INVITE message (no CVSS) - [CVE-2007-4554](https://cve.now/CVE-2007-4554.md): Cross-site scripting (XSS) vulnerability in tiki-remind\_password.php in Tikiwiki (aka Tiki CMS/Groupware) 1.9.7 allows remote attackers to i (no CVSS) - [CVE-2007-4555](https://cve.now/CVE-2007-4555.md): Cross-site scripting (XSS) vulnerability in Ipswitch WS\_FTP allows remote attackers to inject arbitrary web script or HTML via arguments to (no CVSS) - [CVE-2007-4559](https://cve.now/CVE-2007-4559.md): Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remot (CVSS 9.8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-08-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.