# CVEs published 2007-10-05

24 CVEs were published on October 5, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-5227](https://cve.now/CVE-2007-5227.md): Multiple cross-site scripting (XSS) vulnerabilities in messaging/course/composeMessage.jsp in BlackBoard Learning System 6.3.1.593 and earli (no CVSS)
- [CVE-2007-5228](https://cve.now/CVE-2007-5228.md): Cross-site scripting (XSS) vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x (no CVSS)
- [CVE-2007-5229](https://cve.now/CVE-2007-5229.md): Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change setti (no CVSS)
- [CVE-2007-5230](https://cve.now/CVE-2007-5230.md): admin/upload\_files.php in Zomplog 3.8.1 and earlier does not check for administrative credentials, which allows remote attackers to perform (no CVSS)
- [CVE-2007-5231](https://cve.now/CVE-2007-5231.md): Unrestricted file upload vulnerability in admin/upload\_files.php in Zomplog 3.8.1 and earlier allows remote authenticated administrators to (no CVSS)
- [CVE-2007-5232](https://cve.now/CVE-2007-5232.md): Sun Java Runtime Environment (JRE) in JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2\_15 and ea (no CVSS)
- [CVE-2007-5233](https://cve.now/CVE-2007-5233.md): SQL injection vulnerability in index.php in Web Template Management System 1.3 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-5234](https://cve.now/CVE-2007-5234.md): PHP remote file inclusion vulnerability in upload/common/footer.php in Ossigeno CMS 2.2 alpha3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-3918](https://cve.now/CVE-2007-3918.md): Cross-site scripting (XSS) vulnerability in account/verify.php in GForge 4.6b2 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-0447](https://cve.now/CVE-2007-0447.md): Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via m (no CVSS)
- [CVE-2007-3699](https://cve.now/CVE-2007-3699.md): The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain va (no CVSS)
- [CVE-2007-4568](https://cve.now/CVE-2007-4568.md): Integer overflow in the build\_range function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitra (no CVSS)
- [CVE-2007-4990](https://cve.now/CVE-2007-4990.md): The swap\_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) Quer (no CVSS)
- [CVE-2007-5226](https://cve.now/CVE-2007-5226.md): irc\_server.c in dircproxy 1.2.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via an ACTION command (no CVSS)
- [CVE-2007-5078](https://cve.now/CVE-2007-5078.md): Multiple cross-site scripting (XSS) vulnerabilities in eGov Manager allow remote attackers to inject arbitrary web script or HTML via unspec (no CVSS)
- [CVE-2007-5217](https://cve.now/CVE-2007-5217.md): Stack-based buffer overflow in the ADM4 ActiveX control in adm4.dll in Altnet Download Manager 4.0.0.6, as used in (1) Kazaa 3.2.7 and (2) G (no CVSS)
- [CVE-2007-5218](https://cve.now/CVE-2007-5218.md): Cross-site scripting (XSS) vulnerability in index.php in Don Barnes DRBGuestbook 1.1.13 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2007-5219](https://cve.now/CVE-2007-5219.md): Directory traversal vulnerability in the CLAVSetting.CLSetting.1 ActiveX control in CLAVSetting.DLL 1.00.1829 in the CLAVSetting module in C (no CVSS)
- [CVE-2007-5220](https://cve.now/CVE-2007-5220.md): SQL injection vulnerability in catalog.asp in ASP Product Catalog allows remote attackers to execute arbitrary SQL commands via the cid para (no CVSS)
- [CVE-2007-5221](https://cve.now/CVE-2007-5221.md): PHP remote file inclusion vulnerability in mail/childwindow.inc.php in Poppawid 2.7 allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2007-5222](https://cve.now/CVE-2007-5222.md): SQL injection vulnerability in index.php in MAXdev MDPro (MD-Pro) 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Fi (no CVSS)
- [CVE-2007-5223](https://cve.now/CVE-2007-5223.md): Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspec (no CVSS)
- [CVE-2007-5224](https://cve.now/CVE-2007-5224.md): inc/exif.inc.php in Original Photo Gallery 0.11.2 and earlier allows remote attackers to execute arbitrary programs via the exif\_prog parame (no CVSS)
- [CVE-2007-5225](https://cve.now/CVE-2007-5225.md): Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecifie (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.