# CVEs published 2007-10-06

76 CVEs were published on October 6, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2001-1584](https://cve.now/CVE-2001-1584.md): CardBoard 2.4 greeting card CGI by Michael Barretto allows remote attackers to execute arbitrary commands via shell metacharacters in the re (no CVSS)
- [CVE-2001-1585](https://cve.now/CVE-2001-1585.md): SSH protocol 2 (aka SSH-2) public key authentication in the development snapshot of OpenSSH 2.3.1, available from 2001-01-18 through 2001-02 (no CVSS)
- [CVE-2004-2695](https://cve.now/CVE-2004-2695.md): SQL injection vulnerability in the Authorize.net callback code (subscriptions/authorize.php) in Jelsoft vBulletin 3.0 through 3.0.3 allows r (no CVSS)
- [CVE-2004-2696](https://cve.now/CVE-2004-2696.md): BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP (no CVSS)
- [CVE-2004-2697](https://cve.now/CVE-2004-2697.md): The Inventory Scout daemon (invscoutd) 1.3.0.0 and 2.0.2 for AIX 4.3.3 and 5.1 allows local users to gain privileges via a symlink attack on (no CVSS)
- [CVE-2004-2698](https://cve.now/CVE-2004-2698.md): Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel (no CVSS)
- [CVE-2004-2699](https://cve.now/CVE-2004-2699.md): deleteicon.aspx in AspDotNetStorefront 3.3 allows remote attackers to delete arbitrary product images via a modified ProductID parameter. (no CVSS)
- [CVE-2004-2700](https://cve.now/CVE-2004-2700.md): Unrestricted file upload vulnerability in AspDotNetStorefront 3.3 allows remote authenticated administrators to upload arbitrary files with (no CVSS)
- [CVE-2004-2701](https://cve.now/CVE-2004-2701.md): Cross-site scripting (XSS) vulnerability in signin.aspx for AspDotNetStorefront 3.3 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2004-2702](https://cve.now/CVE-2004-2702.md): Cross-site scripting (XSS) vulnerability in login\_up.php3 in Plesk 7.0 and 7.1 Reloaded allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2004-2703](https://cve.now/CVE-2004-2703.md): Clearswift MIMEsweeper 5.0.5, when it has been upgraded from MAILsweeper for SMTP version 4.3 or MAILsweeper Business Suite I or II, allows (no CVSS)
- [CVE-2004-2704](https://cve.now/CVE-2004-2704.md): Hastymail 1.0.1 and earlier (stable) and 1.1 and earlier (development) does not send the "attachment" parameter in the Content-Disposition f (no CVSS)
- [CVE-2004-2705](https://cve.now/CVE-2004-2705.md): Unspecified vulnerability in Player vs. (no CVSS)
- [CVE-2004-2706](https://cve.now/CVE-2004-2706.md): Unspecified vulnerability in Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service (crash) via conferen (no CVSS)
- [CVE-2004-2707](https://cve.now/CVE-2004-2707.md): Multiple unspecified vulnerabilities in Gyach Enhanced (Gyach-E) before 1.0.5 have unknown impact and attack vectors related to "several sec (no CVSS)
- [CVE-2004-2708](https://cve.now/CVE-2004-2708.md): Gyach Enhanced (Gyach-E) before 1.0.0 stores passwords in plaintext, which allows attackers to obtain user passwords by reading the configur (no CVSS)
- [CVE-2004-2709](https://cve.now/CVE-2004-2709.md): Buffer overflow in the strip\_html\_tags method for Gyach Enhanced (Gyach-E) before 1.0.4 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2004-2710](https://cve.now/CVE-2004-2710.md): Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.3 allow remote attackers to cause a denial of service (crash) and possibly (no CVSS)
- [CVE-2004-2711](https://cve.now/CVE-2004-2711.md): Multiple buffer overflows in Gyach Enhanced (Gyach-E) before 1.0.2 allow remote attackers to cause a denial of service (crash) and possibly (no CVSS)
- [CVE-2004-2712](https://cve.now/CVE-2004-2712.md): Buffer overflow in Gyach Enhanced (Gyach-E) before 1.0.0-SneakPeek-3 allows remote attackers to cause a denial of service (crash) via unspec (no CVSS)
- [CVE-2004-2713](https://cve.now/CVE-2004-2713.md): Zone Alarm Pro 1.0 through 5.1 gives full access to %windir%\\Internet Logs\\\* to the EVERYONE group, which allows local users to cause a deni (no CVSS)
- [CVE-2004-2714](https://cve.now/CVE-2004-2714.md): Unspecified vulnerability in Window Maker 0.80.2 and earlier allows attackers to perform unknown actions via format string specifiers in a f (no CVSS)
- [CVE-2004-2715](https://cve.now/CVE-2004-2715.md): edituser.php3 in PHPMyChat 0.14.5 allow remote attackers to bypass authentication and gain administrative privileges by setting the do\_not\_l (no CVSS)
- [CVE-2004-2716](https://cve.now/CVE-2004-2716.md): Multiple SQL injection vulnerabilities in usersL.php3 in PHPMyChat 0.14.5 allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2004-2717](https://cve.now/CVE-2004-2717.md): Multiple directory traversal vulnerabilities in admin.php3 in PHPMyChat 0.14.5 allow remote attackers with administrative privileges to read (no CVSS)
- [CVE-2004-2718](https://cve.now/CVE-2004-2718.md): PHPMyChat 0.14.5 does not remove or protect setup.php3 after installation, which allows attackers to obtain sensitive information including (no CVSS)
- [CVE-2004-2719](https://cve.now/CVE-2004-2719.md): Buffer overflow in the UrlToLocal function in PunyLib.dll of Foxmail 5.0.300 allows remote attackers to execute arbitrary code via a mail me (no CVSS)
- [CVE-2004-2720](https://cve.now/CVE-2004-2720.md): Cross-site scripting (XSS) vulnerability in register.asp in Snitz Forums 2000 3.4.04 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2004-2721](https://cve.now/CVE-2004-2721.md): The CheckGroup function in openSkat VTMF before 2.1 generates public key pairs in which the "p" variable might not be prime, which allows re (no CVSS)
- [CVE-2004-2722](https://cve.now/CVE-2004-2722.md): Nessus 2.0.10a stores account passwords in plaintext in .nessusrc files, which allows local users to obtain passwords. (no CVSS)
- [CVE-2004-2723](https://cve.now/CVE-2004-2723.md): NessusWX 1.4.4 stores account passwords in plaintext in .session files, which allows local users to obtain passwords. (no CVSS)
- [CVE-2004-2724](https://cve.now/CVE-2004-2724.md): LionMax Software Chat Anywhere 2.72a allows remote attackers to cause a denial of service (server crash and client CPU consumption) via a us (no CVSS)
- [CVE-2004-2725](https://cve.now/CVE-2004-2725.md): Multiple cross-site scripting (XSS) vulnerabilities in Aztek Forum 4.0 allow remote attackers to inject arbitrary web script or HTML via (1) (no CVSS)
- [CVE-2005-4863](https://cve.now/CVE-2005-4863.md): Stack-based buffer overflow in db2fmp in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long parameter. (no CVSS)
- [CVE-2005-4864](https://cve.now/CVE-2005-4864.md): Stack-based buffer overflow in libdb2.so in IBM DB2 7.x and 8.1 allows local users to execute arbitrary code via a long DB2LPORT environment (no CVSS)
- [CVE-2005-4865](https://cve.now/CVE-2005-4865.md): Stack-based buffer overflow in call in IBM DB2 7.x and 8.1 allows remote attackers to execute arbitrary code via a long libname. (no CVSS)
- [CVE-2005-4866](https://cve.now/CVE-2005-4866.md): Stack-based buffer overflow in JDBC Applet Server in IBM DB2 8.1 allows remote attackers to execute arbitrary by connecting and sending a lo (no CVSS)
- [CVE-2005-4867](https://cve.now/CVE-2005-4867.md): Stack-based buffer overflow in the SATENCRYPT function in IBM DB2 8.1, when Satellite Administration (SATADMIN) is enabled, allows remote at (no CVSS)
- [CVE-2005-4868](https://cve.now/CVE-2005-4868.md): Shared memory sections and events in IBM DB2 8.1 have default permissions of read and write for the Everyone group, which allows local users (no CVSS)
- [CVE-2005-4869](https://cve.now/CVE-2005-4869.md): The (1) to\_char and (2) to\_date function in IBM DB2 8.1 allows local users to cause a denial of service (application crash) via an empty str (no CVSS)
- [CVE-2005-4870](https://cve.now/CVE-2005-4870.md): Stack-based buffer overflows in the (1) xmlvarcharfromfile, (2) xmlclobfromfile, (3) xmlfilefromvarchar, and (4) xmlfilefromclob function ca (no CVSS)
- [CVE-2005-4871](https://cve.now/CVE-2005-4871.md): Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create o (no CVSS)
- [CVE-2004-2688](https://cve.now/CVE-2004-2688.md): Cross-site scripting (XSS) vulnerability in index.php in NewsPHP allows remote attackers to inject arbitrary web script or HTML via the cat\_ (no CVSS)
- [CVE-2004-2689](https://cve.now/CVE-2004-2689.md): NewsPHP allows remote attackers to gain unauthorized administrative access by setting a cookie to the "autorized=admin; root=admin" value. (no CVSS)
- [CVE-2004-2690](https://cve.now/CVE-2004-2690.md): Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and exec (no CVSS)
- [CVE-2004-2691](https://cve.now/CVE-2004-2691.md): Unspecified vulnerability in 3Com SuperStack 3 4400 switches with firmware version before 3.31 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2004-2692](https://cve.now/CVE-2004-2692.md): The exec\_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute (no CVSS)
- [CVE-2004-2693](https://cve.now/CVE-2004-2693.md): HP-UX B.11.00 and B.11.11 with B6848AB GTK+ Support Libraries installed uses insecure directory permissions, which allows local users to gai (no CVSS)
- [CVE-2004-2694](https://cve.now/CVE-2004-2694.md): Microsoft Outlook Express 6.0 allows remote attackers to bypass intended access restrictions, load content from arbitrary sources into the O (no CVSS)
- [CVE-2007-5243](https://cve.now/CVE-2007-5243.md): Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote a (no CVSS)
- [CVE-2007-5244](https://cve.now/CVE-2007-5244.md): Stack-based buffer overflow in Borland InterBase LI 8.0.0.53 through 8.1.0.253 on Linux, and possibly unspecified versions on Solaris, allow (no CVSS)
- [CVE-2007-5245](https://cve.now/CVE-2007-5245.md): Multiple stack-based buffer overflows in Firebird LI 1.5.3.4870 and 1.5.4.4910, and WI 1.5.3.4870 and 1.5.4.4910, allow remote attackers to (no CVSS)
- [CVE-2007-5246](https://cve.now/CVE-2007-5246.md): Multiple stack-based buffer overflows in Firebird LI 2.0.0.12748 and 2.0.1.12855, and WI 2.0.0.12748 and 2.0.1.12855, allow remote attackers (no CVSS)
- [CVE-2007-5247](https://cve.now/CVE-2007-5247.md): Multiple format string vulnerabilities in the Monolith Lithtech engine, as used by First Encounter Assault Recon (F.E.A.R.) 1.08 and earlier (no CVSS)
- [CVE-2007-5248](https://cve.now/CVE-2007-5248.md): Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.4.2 and earlier, and (no CVSS)
- [CVE-2007-5249](https://cve.now/CVE-2007-5249.md): Multiple buffer overflows in the logging function in the Unreal engine, as used by America's Army and America's Army Special Forces 2.8.2 an (no CVSS)
- [CVE-2007-5250](https://cve.now/CVE-2007-5250.md): The Windows dedicated server for the Unreal engine, as used by America's Army and America's Army Special Forces 2.8.2 and earlier, when Punk (no CVSS)
- [CVE-2007-5251](https://cve.now/CVE-2007-5251.md): Multiple cross-site scripting (XSS) vulnerabilities in Helm 3.2.16 allow remote attackers to inject arbitrary web script or HTML via (1) the (no CVSS)
- [CVE-2007-5252](https://cve.now/CVE-2007-5252.md): Buffer overflow in NetSupport Manager (NSM) Client 10.00 and 10.20, and NetSupport School Student (NSS) 9.00, allows remote NSM servers to c (no CVSS)
- [CVE-2007-5253](https://cve.now/CVE-2007-5253.md): c32web.exe in McMurtrey/Whitaker Cart32 before 6.4 allows remote attackers to read arbitrary files via the ImageName parameter in a GetImage (no CVSS)
- [CVE-2007-5254](https://cve.now/CVE-2007-5254.md): VirusBlokAda Vba32 AntiVirus 3.12.2 uses weak permissions (Everyone:Write) for its installation directory, which allows local users to gain (no CVSS)
- [CVE-2007-5255](https://cve.now/CVE-2007-5255.md): Cross-site scripting (XSS) vulnerability in Google Mini Search Appliance 3.4.14 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2007-5256](https://cve.now/CVE-2007-5256.md): Multiple stack-based buffer overflows in FSD 2.052 d9 and earlier, and FSFDT FSD 3.000 d9 and earlier, allow (1) remote attackers to execute (no CVSS)
- [CVE-2007-5257](https://cve.now/CVE-2007-5257.md): Stack-based buffer overflow in the EDraw.OfficeViewer ActiveX control in officeviewer.ocx in EDraw Office Viewer Component 5.3.220.1 and ear (no CVSS)
- [CVE-2007-5258](https://cve.now/CVE-2007-5258.md): PHP remote file inclusion vulnerability in log.php in phpFreeLog alpha 0.2.0 allows remote attackers to include and execute arbitrary files (no CVSS)
- [CVE-2007-5259](https://cve.now/CVE-2007-5259.md): Cross-site request forgery (CSRF) vulnerability in Ilient SysAid 4.5.03 and 4.5.04 allows remote attackers to perform some actions as admini (no CVSS)
- [CVE-2007-5260](https://cve.now/CVE-2007-5260.md): ASP-CMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a da (no CVSS)
- [CVE-2007-5261](https://cve.now/CVE-2007-5261.md): Multiple SQL injection vulnerabilities in MultiCart 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) catid parameter (no CVSS)
- [CVE-2007-5241](https://cve.now/CVE-2007-5241.md): Buffer overflow in NET$CSMACD.EXE in HP OpenVMS 8.3 and earlier allows local users to cause a denial of service (machine crash) via the "MCR (no CVSS)
- [CVE-2007-5242](https://cve.now/CVE-2007-5242.md): Unspecified vulnerability in (1) SYS$EI1000.EXE and (2) SYS$EI1000\_MON.EXE in HP OpenVMS 8.3 and earlier allows remote attackers to cause a (no CVSS)
- [CVE-2007-5235](https://cve.now/CVE-2007-5235.md): Cross-site scripting (XSS) vulnerability in index.php in Uebimiau 2.7.2 through 2.7.10 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-5236](https://cve.now/CVE-2007-5236.md): Java Web Start in Sun JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2\_15 and earlier, on Windows does not properly enforce acce (no CVSS)
- [CVE-2007-5237](https://cve.now/CVE-2007-5237.md): Java Web Start in Sun JDK and JRE 6 Update 2 and earlier does not properly enforce access restrictions for untrusted applications, which all (no CVSS)
- [CVE-2007-5238](https://cve.now/CVE-2007-5238.md): Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, and SDK and JRE 1.4.2\_15 and earlier does n (no CVSS)
- [CVE-2007-5239](https://cve.now/CVE-2007-5239.md): Java Web Start in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and earlier, SDK and JRE 1.4.2\_15 and earlier, and SDK a (no CVSS)
- [CVE-2007-5240](https://cve.now/CVE-2007-5240.md): Visual truncation vulnerability in the Java Runtime Environment in Sun JDK and JRE 6 Update 2 and earlier, JDK and JRE 5.0 Update 12 and ear (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.