# CVEs published 2007-09-27 31 CVEs were published on September 27, 2007: 0 critical, 0 high. Days are UTC. - [CVE-2007-3758](https://cve.now/CVE-2007-3758.md): Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers (no CVSS) - [CVE-2007-3759](https://cve.now/CVE-2007-3759.md): Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari (no CVSS) - [CVE-2007-3760](https://cve.now/CVE-2007-3760.md): Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 (no CVSS) - [CVE-2007-3761](https://cve.now/CVE-2007-3761.md): Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by c (no CVSS) - [CVE-2007-4671](https://cve.now/CVE-2007-4671.md): Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.1 (no CVSS) - [CVE-2007-3753](https://cve.now/CVE-2007-3753.md): Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service (application termination) and (no CVSS) - [CVE-2007-3754](https://cve.now/CVE-2007-3754.md): Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote (no CVSS) - [CVE-2007-3755](https://cve.now/CVE-2007-3755.md): Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a (no CVSS) - [CVE-2007-3756](https://cve.now/CVE-2007-3756.md): Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to (no CVSS) - [CVE-2007-3757](https://cve.now/CVE-2007-3757.md): Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers (no CVSS) - [CVE-2007-5135](https://cve.now/CVE-2007-5135.md): Off-by-one error in the SSL\_get\_shared\_ciphers function in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f, might allow remote attackers (no CVSS) - [CVE-2007-4872](https://cve.now/CVE-2007-4872.md): SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct r (no CVSS) - [CVE-2007-4873](https://cve.now/CVE-2007-4873.md): SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS) - [CVE-2007-5124](https://cve.now/CVE-2007-5124.md): The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitra (no CVSS) - [CVE-2007-5126](https://cve.now/CVE-2007-5126.md): Unspecified vulnerability in the client in Symantec Veritas Backup Exec for Windows Servers 11d has unknown impact and remote attack vectors (no CVSS) - [CVE-2007-5127](https://cve.now/CVE-2007-5127.md): Multiple cross-site scripting (XSS) vulnerabilities in SimpGB 1.46.02 allow remote attackers to inject arbitrary web script or HTML via (1) (no CVSS) - [CVE-2007-5128](https://cve.now/CVE-2007-5128.md): SimpNews 2.41.03 on Windows, when PHP before 5.0.0 is used, allows remote attackers to obtain sensitive information via an certain link\_date (no CVSS) - [CVE-2007-5129](https://cve.now/CVE-2007-5129.md): SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain (no CVSS) - [CVE-2007-5130](https://cve.now/CVE-2007-5130.md): SimpGB 1.46.02 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php or (2) a direct (no CVSS) - [CVE-2007-5131](https://cve.now/CVE-2007-5131.md): SQL injection vulnerability in index.php in Interspire ActiveKB NX 2.x allows remote attackers to execute arbitrary SQL commands via the cat (no CVSS) - [CVE-2007-5132](https://cve.now/CVE-2007-5132.md): Race condition in the kernel in Sun Solaris 8 through 10 allows local users to cause a denial of service (panic) via unspecified vectors rel (no CVSS) - [CVE-2007-5133](https://cve.now/CVE-2007-5133.md): Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service (CPU consumption) via a certain (no CVSS) - [CVE-2007-5134](https://cve.now/CVE-2007-5134.md): Cisco Catalyst 6500 and Cisco 7600 series devices use 127/8 IP addresses for Ethernet Out-of-Band Channel (EOBC) internal communication, whi (no CVSS) - [CVE-2007-4993](https://cve.now/CVE-2007-4993.md): pygrub (tools/pygrub/src/GrubConf.py) in Xen 3.0.3, when booting a guest domain, allows local users with elevated privileges in the guest do (no CVSS) - [CVE-2007-5117](https://cve.now/CVE-2007-5117.md): Multiple PHP remote file inclusion vulnerabilities in FrontAccounting (FA) 1.13, when register\_globals is enabled, allow remote attackers to (no CVSS) - [CVE-2007-5118](https://cve.now/CVE-2007-5118.md): Unspecified vulnerability in the HID (Human Interface Device) class driver in Sun Solaris 8, 9, and 10 before 20070925 allows local users to (no CVSS) - [CVE-2007-5119](https://cve.now/CVE-2007-5119.md): JSPWiki 2.4.103 and 2.5.139-beta allows remote attackers to obtain sensitive information (full path) via an invalid integer in the version p (no CVSS) - [CVE-2007-5120](https://cve.now/CVE-2007-5120.md): Multiple cross-site scripting (XSS) vulnerabilities in JSPWiki 2.4.103 and 2.5.139-beta allow remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2007-5121](https://cve.now/CVE-2007-5121.md): Cross-site scripting (XSS) vulnerability in JSPWiki 2.5.139-beta allows remote attackers to inject arbitrary web script or HTML via the redi (no CVSS) - [CVE-2007-5122](https://cve.now/CVE-2007-5122.md): SQL injection vulnerability in store\_info.php in SoftBiz Classifieds PLUS allows remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2007-5123](https://cve.now/CVE-2007-5123.md): SQL injection vulnerability in notas.asp in Novus 1.0 allows remote attackers to execute arbitrary SQL commands via the nota\_id parameter. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-09-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.