# CVEs published 2007-10-09

63 CVEs were published on October 9, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2217](https://cve.now/CVE-2007-2217.md): Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute a (no CVSS)
- [CVE-2007-2228](https://cve.now/CVE-2007-2228.md): rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64 (no CVSS)
- [CVE-2007-3892](https://cve.now/CVE-2007-3892.md): Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecif (no CVSS)
- [CVE-2007-3893](https://cve.now/CVE-2007-3893.md): Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified ve (no CVSS)
- [CVE-2007-3897](https://cve.now/CVE-2007-3897.md): Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Proto (no CVSS)
- [CVE-2007-3899](https://cve.now/CVE-2007-3899.md): Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execut (no CVSS)
- [CVE-2007-4466](https://cve.now/CVE-2007-4466.md): Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbi (no CVSS)
- [CVE-2007-5319](https://cve.now/CVE-2007-5319.md): Unspecified vulnerability in the vuidmice STREAMS modules in Sun Solaris 8, 9, and 10 allows local users with console (/dev/console) access (no CVSS)
- [CVE-2007-5320](https://cve.now/CVE-2007-5320.md): Multiple absolute path traversal vulnerabilities in Pegasus Imaging ImagXpress 8.0 allow remote attackers to (1) delete arbitrary files via (no CVSS)
- [CVE-2007-5321](https://cve.now/CVE-2007-5321.md): Directory traversal vulnerability in index.php in Verlihub Control Panel (VHCP) 1.7 and earlier allows remote attackers to include arbitrary (no CVSS)
- [CVE-2007-5322](https://cve.now/CVE-2007-5322.md): Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute (no CVSS)
- [CVE-2007-5309](https://cve.now/CVE-2007-5309.md): PHP remote file inclusion vulnerability in admin.wmtgallery.php in the webmaster-tips.net Flash Image Gallery (com\_wmtgallery) 1.0 component (no CVSS)
- [CVE-2007-5310](https://cve.now/CVE-2007-5310.md): PHP remote file inclusion vulnerability in admin.wmtportfolio.php in the webmaster-tips.net wmtportfolio 1.0 (com\_wmtportfolio) component fo (no CVSS)
- [CVE-2007-5311](https://cve.now/CVE-2007-5311.md): Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic Edition 1.07 allows remote attackers to include an (no CVSS)
- [CVE-2007-5312](https://cve.now/CVE-2007-5312.md): Cross-site scripting (XSS) vulnerability in TorrentTrader Classic 1.07 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-5313](https://cve.now/CVE-2007-5313.md): PHP remote file inclusion vulnerability in install/config.php in Picturesolution 2.1 and earlier allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2007-5314](https://cve.now/CVE-2007-5314.md): PHP remote file inclusion vulnerability in system/funcs/xkurl.php in xKiosk WEB 3.0.1i, when register\_globals is enabled, allows remote atta (no CVSS)
- [CVE-2007-5315](https://cve.now/CVE-2007-5315.md): PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register\_globals is enabled, allows remote attackers to execu (no CVSS)
- [CVE-2007-5316](https://cve.now/CVE-2007-5316.md): SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-5318](https://cve.now/CVE-2007-5318.md): Unspecified vulnerability in preview.php in TYPOlight webCMS 2.4.6 allows remote attackers to download arbitrary files via the src parameter (no CVSS)
- [CVE-2007-5290](https://cve.now/CVE-2007-5290.md): Multiple cross-site scripting (XSS) vulnerabilities in MailBee WebMail Pro 3.4 and earlier; and possibly MailBee WebMail Pro ASP before 3.4. (no CVSS)
- [CVE-2007-5291](https://cve.now/CVE-2007-5291.md): Cross-site scripting (XSS) vulnerability in Edit.asp in DB Manager 2.0 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-5292](https://cve.now/CVE-2007-5292.md): Cross-site scripting (XSS) vulnerability in photos.cfm in Directory Image Gallery 1.1 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-5293](https://cve.now/CVE-2007-5293.md): Multiple cross-site scripting (XSS) vulnerabilities in IDMOS 1.0-beta (aka Phoenix) allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-5294](https://cve.now/CVE-2007-5294.md): PHP remote file inclusion vulnerability in core/aural.php in IDMOS 1.0-beta (aka Phoenix) allows remote attackers to execute arbitrary PHP c (no CVSS)
- [CVE-2007-5295](https://cve.now/CVE-2007-5295.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in (a) Wikepage Opus 13 2007.2 and (b) TipiWiki 2 allow remote attackers to (no CVSS)
- [CVE-2007-5296](https://cve.now/CVE-2007-5296.md): Multiple cross-site scripting (XSS) vulnerabilities in dblisttest.asp in dbList 8.1 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-5297](https://cve.now/CVE-2007-5297.md): Cross-site scripting (XSS) vulnerability in index.php in Minki 1.30 allows remote attackers to inject arbitrary web script or HTML via the p (no CVSS)
- [CVE-2007-5298](https://cve.now/CVE-2007-5298.md): Multiple PHP remote file inclusion vulnerabilities in CMS Creamotion allow remote attackers to execute arbitrary PHP code via a URL in the c (no CVSS)
- [CVE-2007-5299](https://cve.now/CVE-2007-5299.md): Multiple directory traversal vulnerabilities in SkaDate 5.0 and 6.0, and possibly later versions such as 6.482, allow remote attackers to re (no CVSS)
- [CVE-2007-5300](https://cve.now/CVE-2007-5300.md): Off-by-one error in the do\_login\_loop function in libwzd-core/wzd\_login.c in wzdftpd 0.8.0, 0.8.2, and possibly other versions allows remote (no CVSS)
- [CVE-2007-5301](https://cve.now/CVE-2007-5301.md): Buffer overflow in the vorbis\_stream\_info function in input/vorbis/vorbis\_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.8 (no CVSS)
- [CVE-2007-5302](https://cve.now/CVE-2007-5302.md): Multiple cross-site scripting (XSS) vulnerabilities in HP System Management Homepage (SMH) in HP-UX B.11.11, B.11.23, and B.11.31, and SMH b (no CVSS)
- [CVE-2007-5303](https://cve.now/CVE-2007-5303.md): Cross-site scripting (XSS) vulnerability in news\_page.php in SnewsCMS Rus 2.1 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-5304](https://cve.now/CVE-2007-5304.md): Multiple cross-site scripting (XSS) vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-5305](https://cve.now/CVE-2007-5305.md): Multiple PHP remote file inclusion vulnerabilities in ELSEIF CMS Beta 0.6 allow remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-5306](https://cve.now/CVE-2007-5306.md): ELSEIF CMS Beta 0.6 allows remote attackers to obtain sensitive information (full path) via unspecified vectors to utilisateurs/votesresulta (no CVSS)
- [CVE-2007-5307](https://cve.now/CVE-2007-5307.md): ELSEIF CMS Beta 0.6 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric (no CVSS)
- [CVE-2007-5308](https://cve.now/CVE-2007-5308.md): SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to exe (no CVSS)
- [CVE-2004-2726](https://cve.now/CVE-2004-2726.md): HTTPMail service in MailEnable Professional 1.18 does not properly handle arguments to the Authorization header, which allows remote attacke (no CVSS)
- [CVE-2004-2727](https://cve.now/CVE-2004-2727.md): Buffer overflow in MEHTTPS (HTTPMail) of MailEnable Professional 1.5 through 1.7 allows remote attackers to cause a denial of service (appli (no CVSS)
- [CVE-2004-2728](https://cve.now/CVE-2004-2728.md): Buffer overflow in the FTP server of Hummingbird Connectivity 7.1 and 9.0 allows remote, authenticated users to cause a denial of service (a (no CVSS)
- [CVE-2004-2729](https://cve.now/CVE-2004-2729.md): Inetd32 Administration Tool of Hummingbird Connectivity 7.1 and 9.0 allows local users to execute arbitrary code by changing the program for (no CVSS)
- [CVE-2004-2730](https://cve.now/CVE-2004-2730.md): Sysinternals PsTools before 2.05, including (1) PsExec before 1.54, (2) PsGetsid before 1.41, (3) PsInfo before 1.61, (4) PsKill before 1.03 (no CVSS)
- [CVE-2004-2731](https://cve.now/CVE-2004-2731.md): Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, an (no CVSS)
- [CVE-2004-2732](https://cve.now/CVE-2004-2732.md): nbmember.cgi in Netbilling 2.0 allows remote attackers to obtain sensitive information via the cmd=test option, which can be leveraged to de (no CVSS)
- [CVE-2004-2733](https://cve.now/CVE-2004-2733.md): Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via p (no CVSS)
- [CVE-2004-2734](https://cve.now/CVE-2004-2734.md): webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag fo (no CVSS)
- [CVE-2004-2735](https://cve.now/CVE-2004-2735.md): Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET (no CVSS)
- [CVE-2004-2736](https://cve.now/CVE-2004-2736.md): Polar HelpDesk 3.0 allows remote attackers to bypass authentication by setting the UserId and UserType values in a cookie. (no CVSS)
- [CVE-2004-2737](https://cve.now/CVE-2004-2737.md): SQL injection vulnerability in problist.asp in NetSupport DNA HelpDesk 1.01 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2004-2738](https://cve.now/CVE-2004-2738.md): Cross-site scripting (XSS) vulnerability in check\_user\_id.php in ZeroBoard 4.1pl4 and earlier allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2004-2739](https://cve.now/CVE-2004-2739.md): The setup routine (setup.php) in PHProjekt 4.2.1 and earlier allows remote attackers to modify system configuration via unknown attack vecto (no CVSS)
- [CVE-2004-2740](https://cve.now/CVE-2004-2740.md): PHP remote file inclusion vulnerability in authform.inc.php in PHProjekt 4.2.3 and earlier allows remote attackers to include arbitrary PHP (no CVSS)
- [CVE-2004-2741](https://cve.now/CVE-2004-2741.md): Cross-site scripting (XSS) vulnerability in the "help window" (help.php) in Horde Application Framework 2.2.6 allows remote attackers to inj (no CVSS)
- [CVE-2004-2742](https://cve.now/CVE-2004-2742.md): Cross-site scripting (XSS) vulnerability in the report viewer in Crystal Enterprise 8.5, 9, and 10 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2004-2743](https://cve.now/CVE-2004-2743.md): upload.cgi in Mega Upload Progress Bar before 1.45 allows remote attackers to copy or overwrite arbitrary files via unspecified parameters r (no CVSS)
- [CVE-2004-2744](https://cve.now/CVE-2004-2744.md): Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update relea (no CVSS)
- [CVE-2007-5279](https://cve.now/CVE-2007-5279.md): Heap-based buffer overflow in ConeXware PowerArchiver before 10.20.21 might allow remote attackers to execute arbitrary code via a long file (no CVSS)
- [CVE-2007-5280](https://cve.now/CVE-2007-5280.md): Multiple cross-site scripting (XSS) vulnerabilities in messages.jsp in AppFuse before 2.0 Final allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-5281](https://cve.now/CVE-2007-5281.md): The Java Secure Socket Extension (JSSE) in the Hitachi Cosminexus Developer's Kit for Java in various Hitachi Cosminexus 7.5 products before (no CVSS)
- [CVE-2007-5282](https://cve.now/CVE-2007-5282.md): Hitachi Cosminexus Agent 03-00 through 03-05, and Cosminexus Library Standard and Web Edition 04-00 and 04-01, might allow remote attackers (no CVSS)
- [CVE-2007-5283](https://cve.now/CVE-2007-5283.md): The TSC Domain Manager in Hitachi TPBroker Object Transaction Monitor and Cosminexus TPBroker Object Transaction Monitor 01-00 through 03-00 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.