# CVEs published 2007-09-26

34 CVEs were published on September 26, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2007-5107](https://cve.now/CVE-2007-5107.md): Stack-based buffer overflow in the AskJeevesToolBar.SettingsPlugin.1 ActiveX control in askBar.dll in IAC Search & Media ask.com Ask Toolbar (no CVSS)
- [CVE-2007-5108](https://cve.now/CVE-2007-5108.md): Unspecified vulnerability in IAC Search & Media ask.com toolbar has unknown impact and remote attack vectors. (no CVSS)
- [CVE-2007-5109](https://cve.now/CVE-2007-5109.md): Cross-site request forgery (CSRF) vulnerability in index.php in FlatNuke 2.6, and possibly 3, allows remote attackers to change the password (no CVSS)
- [CVE-2007-5110](https://cve.now/CVE-2007-5110.md): Absolute path traversal vulnerability in the EbCrypt.eb\_c\_PRNGenerator.1 ActiveX control in EBCRYPT.DLL 2.0.0.2087 and earlier in EB Design (no CVSS)
- [CVE-2007-5111](https://cve.now/CVE-2007-5111.md): A certain ActiveX control in EBCRYPT.DLL 2.0 in EB Design ebCrypt allows remote attackers to cause a denial of service (crash) via a string (no CVSS)
- [CVE-2007-5112](https://cve.now/CVE-2007-5112.md): Cross-site scripting (XSS) vulnerability in session.cgi (aka the login page) in Google Urchin 5 5.7.03 and earlier allows remote attackers t (no CVSS)
- [CVE-2007-5113](https://cve.now/CVE-2007-5113.md): report.cgi in Google Urchin allows remote attackers to bypass authentication and obtain sensitive information (web server logs) via certain (no CVSS)
- [CVE-2007-5114](https://cve.now/CVE-2007-5114.md): PHP remote file inclusion vulnerability in include/plugin/block.t.php in Peter Schmidt phpmyProfiler 0.9.6b allows remote attackers to execu (no CVSS)
- [CVE-2007-5115](https://cve.now/CVE-2007-5115.md): Multiple PHP remote file inclusion vulnerabilities in Ekke Doerre Contenido 42VariablVersion (42VV10) in contenido\_hacks in Mods 4 Xoops Con (no CVSS)
- [CVE-2007-5094](https://cve.now/CVE-2007-5094.md): Heap-based buffer overflow in iaspam.dll in the SMTP Server in Ipswitch IMail Server 8.01 through 8.11 allows remote attackers to execute ar (no CVSS)
- [CVE-2007-5095](https://cve.now/CVE-2007-5095.md): Microsoft Windows Media Player (WMP) 9 on Windows XP SP2 invokes Internet Explorer to render HTML documents contained inside some media file (no CVSS)
- [CVE-2007-5096](https://cve.now/CVE-2007-5096.md): PHP remote file inclusion vulnerability in modules/webmail2/inc/rfc822.php in guanxiCRM Business Solution 0.9.1 allows remote attackers to e (no CVSS)
- [CVE-2007-5097](https://cve.now/CVE-2007-5097.md): PHP remote file inclusion vulnerability in lib/classes/offl\_nflteam.php in Online Fantasy Football League (OFFL) 0.2.6 allows remote attacke (CVSS 9.8)
- [CVE-2007-5098](https://cve.now/CVE-2007-5098.md): Multiple PHP remote file inclusion vulnerabilities in DFD Cart 1.1.4 and earlier, when register\_globals is enabled, allow remote attackers t (no CVSS)
- [CVE-2007-5099](https://cve.now/CVE-2007-5099.md): PHP remote file inclusion vulnerability in show.php in David Watters Helplink 0.1.0 allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2007-5100](https://cve.now/CVE-2007-5100.md): Multiple PHP remote file inclusion vulnerabilities in phpBB Plus 1.53, and 1.53a before 20070922, when register\_globals is enabled, allow re (no CVSS)
- [CVE-2007-5101](https://cve.now/CVE-2007-5101.md): ChironFS before 1.0 RC7 sets user/group ownership to the mounter account instead of the creator account when files are created, which allows (no CVSS)
- [CVE-2007-5102](https://cve.now/CVE-2007-5102.md): PHP remote file inclusion vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register\_globals is enabled, allows remote attackers to (no CVSS)
- [CVE-2007-5103](https://cve.now/CVE-2007-5103.md): Directory traversal vulnerability in config.inc.php in Wordsmith 1.0 RC1, when register\_globals is enabled, allows remote attackers to inclu (no CVSS)
- [CVE-2007-5104](https://cve.now/CVE-2007-5104.md): SQL injection vulnerability in index.php in the Arcade module in bcoos 1.0.10 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-5105](https://cve.now/CVE-2007-5105.md): Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-5106](https://cve.now/CVE-2007-5106.md): Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-5093](https://cve.now/CVE-2007-5093.md): The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device (no CVSS)
- [CVE-2007-4874](https://cve.now/CVE-2007-4874.md): Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-5088](https://cve.now/CVE-2007-5088.md): Cross-site scripting (XSS) vulnerability in search/cust\_bill\_event.cgi in Freeside 1.7.2 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2007-5089](https://cve.now/CVE-2007-5089.md): PHP remote file inclusion vulnerability in php-inc/log.inc.php in sk.log 0.5.3 and earlier allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-5090](https://cve.now/CVE-2007-5090.md): Unspecified vulnerability in IBM Rational ClearQuest (CQ), when a Microsoft SQL Server or an IBM DB2 database is used, allows attackers to c (no CVSS)
- [CVE-2007-5091](https://cve.now/CVE-2007-5091.md): Multiple cross-site scripting (XSS) vulnerabilities in eGroupWare 1.4.001 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-5092](https://cve.now/CVE-2007-5092.md): Directory traversal vulnerability in index.php in the Dance Music module for phpNuke, when register\_globals is enabled, allows remote attack (no CVSS)
- [CVE-2007-4571](https://cve.now/CVE-2007-4571.md): The snd\_mem\_proc\_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 (no CVSS)
- [CVE-2007-5085](https://cve.now/CVE-2007-5085.md): Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and (no CVSS)
- [CVE-2007-5086](https://cve.now/CVE-2007-5086.md): Kaspersky Anti-Virus (KAV) and Internet Security 7.0 build 125 do not properly validate certain parameters to System Service Descriptor Tabl (no CVSS)
- [CVE-2007-5087](https://cve.now/CVE-2007-5087.md): The ATM module in the Linux kernel before 2.4.35.3, when CLIP support is enabled, allows local users to cause a denial of service (kernel pa (no CVSS)
- [CVE-2002-2227](https://cve.now/CVE-2002-2227.md): Buffer underflow in ssldump 0.9b2 and earlier allows remote attackers to cause a denial of service (memory corruption) via a crafted SSLv2 c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.