# CVEs published 2007-09-14 29 CVEs were published on September 14, 2007: 0 critical, 0 high. Days are UTC. - [CVE-2007-4892](https://cve.now/CVE-2007-4892.md): Multiple SQL injection vulnerabilities in SWSoft Plesk 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Windows allow remote attackers to execute arbitrar (no CVSS) - [CVE-2007-4893](https://cve.now/CVE-2007-4893.md): wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered\_h (no CVSS) - [CVE-2007-4894](https://cve.now/CVE-2007-4894.md): Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execu (no CVSS) - [CVE-2007-4895](https://cve.now/CVE-2007-4895.md): Directory traversal vulnerability in dwoprn.php in Sisfo Kampus 2006 (Semarang 3) allows remote attackers to read arbitrary files via the f (no CVSS) - [CVE-2007-4896](https://cve.now/CVE-2007-4896.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/header.php in Toms Gaestebuch 1.01 and earlier allow remote attackers to inject (no CVSS) - [CVE-2007-4897](https://cve.now/CVE-2007-4897.md): pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a lo (no CVSS) - [CVE-2007-4898](https://cve.now/CVE-2007-4898.md): Unspecified vulnerability in the Multiwiki plugin in XWiki before 1.1 Enterprise RC2 allows remote authenticated users, with administrative (no CVSS) - [CVE-2007-4899](https://cve.now/CVE-2007-4899.md): Multiple cross-site scripting (XSS) vulnerabilities in Boinc Forum 5.10.20 and earlier allow remote attackers to inject arbitrary web script (no CVSS) - [CVE-2007-4900](https://cve.now/CVE-2007-4900.md): Cross-site scripting (XSS) vulnerability in the logon page in RSA EnVision 3.3.6 Build 0115 allows remote attackers to inject arbitrary web (no CVSS) - [CVE-2007-4901](https://cve.now/CVE-2007-4901.md): The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly (no CVSS) - [CVE-2007-3739](https://cve.now/CVE-2007-3739.md): mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memor (no CVSS) - [CVE-2007-3740](https://cve.now/CVE-2007-3740.md): The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which (no CVSS) - [CVE-2007-4138](https://cve.now/CVE-2007-4138.md): The Winbind nss\_info extension (nsswitch/idmap\_ad.c) in idmap\_ad.so in Samba 3.0.25 through 3.0.25c, when the "winbind nss info" option is s (no CVSS) - [CVE-2007-4889](https://cve.now/CVE-2007-4889.md): The MySQL extension in PHP 5.2.4 and earlier allows remote attackers to bypass safe\_mode and open\_basedir restrictions via the MySQL (1) LOA (no CVSS) - [CVE-2007-4890](https://cve.now/CVE-2007-4890.md): Absolute directory traversal vulnerability in a certain ActiveX control in the VB To VSI Support Library (VBTOVSI.DLL) 1.0.0.0 in Microsoft (no CVSS) - [CVE-2007-4891](https://cve.now/CVE-2007-4891.md): A certain ActiveX control in PDWizard.ocx 6.0.0.9782 and earlier in Microsoft Visual Studio 6.0 exposes dangerous (1) StartProcess, (2) Sync (no CVSS) - [CVE-2005-4862](https://cve.now/CVE-2005-4862.md): The search functionality in XWiki 0.9.793 indexes cleartext user passwords, which allows remote attackers to obtain sensitive information vi (no CVSS) - [CVE-2006-7223](https://cve.now/CVE-2006-7223.md): PreviewAction in XWiki 0.9.543 through 0.9.1252 does not set the Author field to the identity of the user who last modified a document, whic (no CVSS, org.xwiki.platform:xwiki-platform-oldcore) - [CVE-2007-1688](https://cve.now/CVE-2007-1688.md): Buffer overflow in the PhPInfo ActiveX control in PhPCtrl.dll in Callisto PhotoParade Player allows remote attackers to execute arbitrary co (no CVSS) - [CVE-2007-4465](https://cve.now/CVE-2007-4465.md): Cross-site scripting (XSS) vulnerability in mod\_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated p (CVSS 6.1) - [CVE-2007-4749](https://cve.now/CVE-2007-4749.md): The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs tha (no CVSS) - [CVE-2007-4881](https://cve.now/CVE-2007-4881.md): SQL injection vulnerability in profile/myprofile.php in psi-labs.com social networking script (psisns), probably 1.0, allows remote attacker (no CVSS) - [CVE-2007-4882](https://cve.now/CVE-2007-4882.md): Multiple cross-site scripting (XSS) vulnerabilities in TechExcel CustomerWise (formerly TechExcel CRM) allow remote attackers to inject arbi (no CVSS) - [CVE-2007-4883](https://cve.now/CVE-2007-4883.md): Cross-site scripting (XSS) vulnerability in the BotQuery extension in MediaWiki 1.7.x and earlier before SVN 20070910 allows remote attacker (no CVSS) - [CVE-2007-4884](https://cve.now/CVE-2007-4884.md): Media Player Classic (MPC) allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file t (no CVSS) - [CVE-2007-4885](https://cve.now/CVE-2007-4885.md): Avnex AV MP3 Player allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that tri (no CVSS) - [CVE-2007-4886](https://cve.now/CVE-2007-4886.md): Incomplete blacklist vulnerability in index.php in AuraCMS 1.x and probably 2.x allows remote attackers to execute arbitrary PHP code via a (no CVSS) - [CVE-2007-4887](https://cve.now/CVE-2007-4887.md): The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long stri (no CVSS) - [CVE-2007-4888](https://cve.now/CVE-2007-4888.md): The "You are not allowed..." error handler in XWiki 1.0 B1 and 1.0 B2 associates the doc variable with the entire document content and metad (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-09-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.