# CVEs published 2007-09-12

31 CVEs were published on September 12, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-4840](https://cve.now/CVE-2007-4840.md): PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out\_c (no CVSS)
- [CVE-2007-4841](https://cve.now/CVE-2007-4841.md): Mozilla Firefox before 2.0.0.8, Thunderbird before 2.0.0.8, and SeaMonkey before 1.1.5 allows remote attackers to execute arbitrary commands (no CVSS)
- [CVE-2007-4842](https://cve.now/CVE-2007-4842.md): Directory traversal vulnerability in Enriva Development Magellan Explorer 3.32 build 2305 and earlier allows remote FTP servers to create or (no CVSS)
- [CVE-2007-4843](https://cve.now/CVE-2007-4843.md): Directory traversal vulnerability in X-Diesel Unreal Commander 0.92 build 565 and 573 allows remote FTP servers to create or overwrite arbit (no CVSS)
- [CVE-2007-4844](https://cve.now/CVE-2007-4844.md): X-Diesel Unreal Commander 0.92 build 565 and 573 does not properly react to an FTP server's behavior after sending a "CWD /" command, which (no CVSS)
- [CVE-2007-4845](https://cve.now/CVE-2007-4845.md): Multiple SQL injection vulnerabilities in UPLOAD/index.php in RW::Download 2.0.3 lite allow remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-4846](https://cve.now/CVE-2007-4846.md): SQL injection vulnerability in start.php in Webace-Linkscript (wls) 1.3 Special Edition (SE) allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2007-4847](https://cve.now/CVE-2007-4847.md): Google Picasa allows remote attackers to read image files stored by Picasa via unspecified vectors involving a picasa:// URI. (no CVSS)
- [CVE-2007-4848](https://cve.now/CVE-2007-4848.md): Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via (no CVSS)
- [CVE-2007-4849](https://cve.now/CVE-2007-4849.md): JFFS2, as used on One Laptop Per Child (OLPC) build 542 and possibly other Linux systems, when POSIX ACL support is enabled, does not proper (no CVSS)
- [CVE-2007-3871](https://cve.now/CVE-2007-3871.md): Stampit Web uses guessable id values for online stamp purchases, which allows remote attackers to cause a denial of service (stamp invalidat (no CVSS)
- [CVE-2007-4727](https://cve.now/CVE-2007-4727.md): Buffer overflow in the fcgi\_env\_add function in mod\_proxy\_backend\_fastcgi.c in the mod\_fastcgi extension in lighttpd before 1.4.18 allows re (no CVSS)
- [CVE-2007-4828](https://cve.now/CVE-2007-4828.md): Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 throu (no CVSS)
- [CVE-2007-4830](https://cve.now/CVE-2007-4830.md): Cross-site scripting (XSS) vulnerability in CMD\_BANDWIDTH\_BREAKDOWN in DirectAdmin 1.30.2 and earlier allows remote attackers to inject arbi (no CVSS)
- [CVE-2007-4831](https://cve.now/CVE-2007-4831.md): Multiple cross-site scripting (XSS) vulnerabilities in account\_settings.php in TorrentTrader 1.07 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-4832](https://cve.now/CVE-2007-4832.md): Format string vulnerability in CellFactor Revolution 1.03 and earlier allows remote attackers to execute arbitrary code via format string sp (no CVSS)
- [CVE-2007-4833](https://cve.now/CVE-2007-4833.md): Unspecified vulnerability in the Edge Component in IBM WebSphere Application Server (WAS) 6.1 before Fix Pack 11 (6.1.0.11) has unknown impa (no CVSS)
- [CVE-2007-4834](https://cve.now/CVE-2007-4834.md): Multiple PHP remote file inclusion vulnerabilities in phpRealty 0.02 allow remote attackers to execute arbitrary PHP code via a URL in the M (no CVSS)
- [CVE-2007-4835](https://cve.now/CVE-2007-4835.md): SQL injection vulnerability in index.php in phpMyQuote 0.20 allows remote attackers to execute arbitrary SQL commands via the id parameter i (no CVSS)
- [CVE-2007-4836](https://cve.now/CVE-2007-4836.md): Cross-site scripting (XSS) vulnerability in index.php in phpMyQuote 0.20 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-4837](https://cve.now/CVE-2007-4837.md): SQL injection vulnerability in anket.asp in Proxy Anket 3.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2007-4838](https://cve.now/CVE-2007-4838.md): Multiple buffer overflows in CellFactor Revolution 1.03 and earlier allow remote attackers to execute arbitrary code via a long string in a (no CVSS)
- [CVE-2007-4839](https://cve.now/CVE-2007-4839.md): Unspecified vulnerability in the PD tools component in IBM WebSphere Application Server (WAS) 6.1 before Fix Pack 11 (6.1.0.11) has unknown (no CVSS)
- [CVE-2007-4826](https://cve.now/CVE-2007-4826.md): bgpd in Quagga before 0.99.9 allows explicitly configured BGP peers to cause a denial of service (crash) via a malformed (1) OPEN message or (no CVSS)
- [CVE-2007-2930](https://cve.now/CVE-2007-2930.md): The (1) NSID\_SHUFFLE\_ONLY and (2) NSID\_USE\_POOL PRNG algorithms in ISC BIND 8 before 8.4.7-P1 generate predictable DNS query identifiers whe (no CVSS)
- [CVE-2007-3036](https://cve.now/CVE-2007-3036.md): Unspecified vulnerability in the (1) Windows Services for UNIX 3.0 and 3.5, and (2) Subsystem for UNIX-based Applications in Microsoft Windo (no CVSS)
- [CVE-2007-3040](https://cve.now/CVE-2007-3040.md): Stack-based buffer overflow in agentdpv.dll 2.0.0.3425 in Microsoft Agent on Windows 2000 SP4 allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2007-4651](https://cve.now/CVE-2007-4651.md): Unspecified vulnerability in Adobe Connect Enterprise Server 6 allows remote attackers to read certain pages that are restricted to the admi (no CVSS)
- [CVE-2007-4731](https://cve.now/CVE-2007-4731.md): Stack-based buffer overflow in the TMregChange function in TMReg.dll in Trend Micro ServerProtect before 5.58 Security Patch 4 allows remote (no CVSS)
- [CVE-2007-4752](https://cve.now/CVE-2007-4752.md): ssh in OpenSSH before 4.7 does not properly handle when an untrusted cookie cannot be created and uses a trusted X11 cookie instead, which a (no CVSS)
- [CVE-2007-4825](https://cve.now/CVE-2007-4825.md): Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open\_basedir restrictions and possibly execute arbitra (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.