# CVEs published 2007-10-14

71 CVEs were published on October 14, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2002-2228](https://cve.now/CVE-2002-2228.md): MailScanner before 4.0 5-1 and before 3.2 6-1 allows remote attackers to bypass protection via attachments with a filename with (1) extra le (no CVSS)
- [CVE-2002-2229](https://cve.now/CVE-2002-2229.md): Directory traversal vulnerability in Sapio Design Ltd. (no CVSS)
- [CVE-2002-2230](https://cve.now/CVE-2002-2230.md): Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via a private mes (no CVSS)
- [CVE-2002-2231](https://cve.now/CVE-2002-2231.md): Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via (1) a javascr (no CVSS)
- [CVE-2002-2232](https://cve.now/CVE-2002-2232.md): Buffer overflow in Enceladus Server Suite 3.9 allows remote attackers to execute arbitrary code via a long CD (CWD) command. (no CVSS)
- [CVE-2002-2233](https://cve.now/CVE-2002-2233.md): Directory traversal vulnerability in Enceladus Server Suite 3.9 allows remote attackers to list arbitrary directories and possibly cause a d (no CVSS)
- [CVE-2002-2234](https://cve.now/CVE-2002-2234.md): NetScreen ScreenOS before 4.0.1 allows remote attackers to bypass the Malicious-URL blocking feature by splitting the URL into fragmented IP (no CVSS)
- [CVE-2002-2235](https://cve.now/CVE-2002-2235.md): member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message (no CVSS)
- [CVE-2002-2236](https://cve.now/CVE-2002-2236.md): Format string vulnerability in the awp\_log function in apt-www-proxy 0.1 allows remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2002-2237](https://cve.now/CVE-2002-2237.md): tftp32 TFTP server 2.21 and earlier allows remote attackers to cause a denial of service via a GET request with a DOS device name such as co (no CVSS)
- [CVE-2002-2238](https://cve.now/CVE-2002-2238.md): Directory traversal vulnerability in the Kunani ODBC FTP Server 1.0.10 allows remote attackers to read arbitrary files via a "..\\" (dot dot (no CVSS)
- [CVE-2002-2239](https://cve.now/CVE-2002-2239.md): The Cisco Optical Service Module (OSM) for the Catalyst 6500 and 7600 series running Cisco IOS 12.1(8)E through 12.1(13.4)E allows remote at (no CVSS)
- [CVE-2002-2240](https://cve.now/CVE-2002-2240.md): Directory traversal vulnerability in MyServer 0.11 and 0.2 allows remote attackers to read arbitrary files via a ".." (dot dot) in an HTTP G (no CVSS)
- [CVE-2002-2241](https://cve.now/CVE-2002-2241.md): Buffer overflow in httpd32.exe in Deerfield VisNetic WebSite before 3.5.15 allows remote attackers to cause a denial of service (crash) via (no CVSS)
- [CVE-2002-2242](https://cve.now/CVE-2002-2242.md): The Apple Package Manager in KisMAC 0.02a and earlier modifies file permissions of sensitive files after installation, which could allow att (no CVSS)
- [CVE-2002-2243](https://cve.now/CVE-2002-2243.md): Akfingerd 0.5 and possibly earlier versions only allows one connection at a time and does not time out connections, which allows remote atta (no CVSS)
- [CVE-2002-2244](https://cve.now/CVE-2002-2244.md): Akfingerd 0.5 and earlier versions allow local users to cause a denial of service (crash) via a .plan with a symlink to /dev/urandom or othe (no CVSS)
- [CVE-2002-2245](https://cve.now/CVE-2002-2245.md): ftpd in NetBSD 1.5 through 1.5.3 and 1.6 does not properly quote a digit in response to a STAT command for a filename that contains a carria (no CVSS)
- [CVE-2002-2246](https://cve.now/CVE-2002-2246.md): Cross-site scripting (XSS) vulnerability in VisNetic Website before 3.5.15 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2002-2247](https://cve.now/CVE-2002-2247.md): The administrator/phpinfo.php script in Mambo Site Server 4.0.11 allows remote attackers to obtain sensitive information such as the full we (no CVSS)
- [CVE-2002-2248](https://cve.now/CVE-2002-2248.md): Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in Netscape 4.0 allows remote attackers to execute arbi (no CVSS)
- [CVE-2002-2249](https://cve.now/CVE-2002-2249.md): PHP remote file inclusion vulnerability in News Evolution 2.0 allows remote attackers to execute arbitrary PHP commands via the neurl parame (no CVSS)
- [CVE-2002-2250](https://cve.now/CVE-2002-2250.md): Multiple buffer overflows in Sybase Adaptive Server 12.0 and 12.5 allow remote attackers to execute arbitrary code via (1) a long parameter (no CVSS)
- [CVE-2002-2251](https://cve.now/CVE-2002-2251.md): Buffer overflow in the changevalue function in libcgi.h for Marcos Luiz Onisto Lib CGI 0.1 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2002-2252](https://cve.now/CVE-2002-2252.md): SQL injection vulnerability in auth.inc.php in Thatware 0.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via a ba (no CVSS)
- [CVE-2002-2253](https://cve.now/CVE-2002-2253.md): Multiple buffer overflows in Cyrus Sieve / libSieve 2.1.2 and earlier allow remote attackers to execute arbitrary code via (1) a long header (no CVSS)
- [CVE-2002-2254](https://cve.now/CVE-2002-2254.md): The experimental IP packet queuing feature in Netfilter / IPTables in Linux kernel 2.4 up to 2.4.19 and 2.5 up to 2.5.31, when a privileged (no CVSS)
- [CVE-2002-2255](https://cve.now/CVE-2002-2255.md): Cross-site scripting (XSS) vulnerability in search.php in phpBB 2.0.3 and possibly earlier versions allows remote attackers to inject arbitr (no CVSS)
- [CVE-2002-2256](https://cve.now/CVE-2002-2256.md): Directory traversal vulnerability in pWins Webserver 0.2.5 and earlier allows remote attackers to read arbitrary files via Unicode character (no CVSS)
- [CVE-2002-2257](https://cve.now/CVE-2002-2257.md): Stack-based buffer overflow in the parse\_field function in cgi\_lib.c for LIBCGI 1.0.2 and 1.0.3 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2002-2258](https://cve.now/CVE-2002-2258.md): Moby NetSuite allows remote attackers to cause a denial of service (crash) via an HTTP POST request with a (1) large integer or (2) non-nume (no CVSS)
- [CVE-2003-1341](https://cve.now/CVE-2003-1341.md): The default installation of Trend Micro OfficeScan 3.0 through 3.54 and 5.x allows remote attackers to bypass authentication from cgiChkMast (no CVSS)
- [CVE-2003-1342](https://cve.now/CVE-2003-1342.md): Trend Micro Virus Control System (TVCS) 1.8 running with IIS allows remote attackers to cause a denial of service (memory consumption) in II (no CVSS)
- [CVE-2003-1343](https://cve.now/CVE-2003-1343.md): Trend Micro ScanMail for Exchange (SMEX) before 3.81 and before 6.1 might install a back door account in smg\_Smxcfg30.exe, which allows remo (no CVSS)
- [CVE-2003-1344](https://cve.now/CVE-2003-1344.md): Trend Micro Virus Control System (TVCS) Log Collector allows remote attackers to obtain usernames, encrypted passwords, and other sensitive (no CVSS)
- [CVE-2003-1345](https://cve.now/CVE-2003-1345.md): Directory traversal vulnerability in s.dll in WebCollection Plus 5.00 allows remote attackers to view arbitrary files in c:\\ via a full path (no CVSS)
- [CVE-2003-1346](https://cve.now/CVE-2003-1346.md): D-Link wireless access point DWL-900AP+ 2.2, 2.3 and possibly 2.5 allows remote attackers to set factory default settings by upgrading the f (no CVSS)
- [CVE-2003-1347](https://cve.now/CVE-2003-1347.md): Multiple cross-site scripting (XSS) vulnerabilities in Geeklog 1.3.7 allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2003-1348](https://cve.now/CVE-2003-1348.md): Cross-site scripting (XSS) vulnerability in guestbook.cgi in ftls.org Guestbook 1.1 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2003-1349](https://cve.now/CVE-2003-1349.md): Directory traversal vulnerability in NITE ftp-server (NiteServer) 1.83 allows remote attackers to list arbitrary directories via a "\\.." (ba (no CVSS)
- [CVE-2003-1350](https://cve.now/CVE-2003-1350.md): List Site Pro 2.0 allows remote attackers to hijack user accounts by inserting a "|" (pipe), which is used as a field delimiter, into the ba (no CVSS)
- [CVE-2003-1351](https://cve.now/CVE-2003-1351.md): Directory traversal vulnerability in edittag.cgi in EditTag 1.1 allows remote attackers to read arbitrary files via a "%2F.." (encoded slash (no CVSS)
- [CVE-2003-1352](https://cve.now/CVE-2003-1352.md): Gabber 0.8.7 sends an email to a specific address during user login and logout, which allows remote attackers to obtain user session activit (no CVSS)
- [CVE-2003-1353](https://cve.now/CVE-2003-1353.md): Multiple cross-site scripting (XSS) vulnerabilities in Outreach Project Tool (OPT) 0.946b allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2003-1354](https://cve.now/CVE-2003-1354.md): Multiple GameSpy 3D 2.62 compatible gaming servers generate very large UDP responses to small requests, which allows remote attackers to use (no CVSS)
- [CVE-2003-1355](https://cve.now/CVE-2003-1355.md): Buffer overflow in the remote console (rcon) in Battlefield 1942 1.2 and 1.3 allows remote attackers to cause a denial of service (crash) an (no CVSS)
- [CVE-2003-1356](https://cve.now/CVE-2003-1356.md): The "file handling" in sort in HP-UX 10.01 through 10.20, and 11.00 through 11.11 is "incorrect," which allows attackers to gain access or c (no CVSS)
- [CVE-2003-1357](https://cve.now/CVE-2003-1357.md): ProxyView has a default administrator password of Administrator for Embedded Windows NT, which allows remote attackers to gain access. (no CVSS)
- [CVE-2007-5457](https://cve.now/CVE-2007-5457.md): Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (com\_jfu or com\_joomla\_flash\_uploader) 2.5.1 com (no CVSS)
- [CVE-2007-5458](https://cve.now/CVE-2007-5458.md): SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic\_quotes\_gpc is disabled, allows remote attackers (no CVSS)
- [CVE-2007-5459](https://cve.now/CVE-2007-5459.md): Cross-site scripting (XSS) vulnerability in the sidebar HTML page in the MouseoverDictionary before 0.6.2 extension for Mozilla Firefox allo (no CVSS)
- [CVE-2007-5195](https://cve.now/CVE-2007-5195.md): Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterpri (no CVSS)
- [CVE-2007-5196](https://cve.now/CVE-2007-5196.md): Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterpri (no CVSS)
- [CVE-2007-5200](https://cve.now/CVE-2007-5200.md): hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a sym (no CVSS)
- [CVE-2007-5441](https://cve.now/CVE-2007-5441.md): CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perf (no CVSS)
- [CVE-2007-5442](https://cve.now/CVE-2007-5442.md): CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upl (no CVSS)
- [CVE-2007-5443](https://cve.now/CVE-2007-5443.md): Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-5444](https://cve.now/CVE-2007-5444.md): CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files. (no CVSS)
- [CVE-2007-5445](https://cve.now/CVE-2007-5445.md): Buffer overflow in the DB Software Laboratory VImpX (VImpAX1) ActiveX control in VImpX.ocx 4.7.3.0 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2007-5446](https://cve.now/CVE-2007-5446.md): Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows remote attackers to (no CVSS)
- [CVE-2007-5447](https://cve.now/CVE-2007-5447.md): ioncube\_loader\_win\_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe\_mode and disable\_functions restrictions, w (no CVSS)
- [CVE-2007-5448](https://cve.now/CVE-2007-5448.md): Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the (no CVSS)
- [CVE-2007-5449](https://cve.now/CVE-2007-5449.md): SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2007-5450](https://cve.now/CVE-2007-5450.md): Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a d (no CVSS)
- [CVE-2007-5451](https://cve.now/CVE-2007-5451.md): PHP remote file inclusion vulnerability in admin.color.php in the com\_colorlab (aka com\_color) 1.0 component for Joomla! allows remote attac (no CVSS)
- [CVE-2007-5452](https://cve.now/CVE-2007-5452.md): Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-5453](https://cve.now/CVE-2007-5453.md): Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing (no CVSS)
- [CVE-2007-5454](https://cve.now/CVE-2007-5454.md): Directory traversal vulnerability in index.php in PHP File Sharing System 1.5.1 allows remote attackers to list or create arbitrary director (no CVSS)
- [CVE-2007-5455](https://cve.now/CVE-2007-5455.md): Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2007-5456](https://cve.now/CVE-2007-5456.md): Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download a (no CVSS)
- [CVE-2007-5440](https://cve.now/CVE-2007-5440.md): Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCU (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.