# CVEs published 2007-10-19

45 CVEs were published on October 19, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-5379](https://cve.now/CVE-2007-5379.md): Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary fi (no CVSS, rails)
- [CVE-2007-5380](https://cve.now/CVE-2007-5380.md): Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecif (no CVSS, rails)
- [CVE-2007-5588](https://cve.now/CVE-2007-5588.md): Cross-site scripting (XSS) vulnerability in mnoGoSearch before 3.2.43 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-5589](https://cve.now/CVE-2007-5589.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-5590](https://cve.now/CVE-2007-5590.md): Multiple buffer overflows in Miranda before 0.7.1 allow remote attackers to execute arbitrary code via unspecified vectors involving (1) IRC (no CVSS)
- [CVE-2007-5591](https://cve.now/CVE-2007-5591.md): The CS1000 signaling server in Nortel Enterprise VoIP-Core-CS 1000M Chassis/Cabinet, Enterprise VoIP-Core-CS 1000E and 1000S, Meridian-Core- (no CVSS)
- [CVE-2007-5592](https://cve.now/CVE-2007-5592.md): Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-5593](https://cve.now/CVE-2007-5593.md): install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2007-5594](https://cve.now/CVE-2007-5594.md): Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete (no CVSS)
- [CVE-2007-5595](https://cve.now/CVE-2007-5595.md): CRLF injection vulnerability in the drupal\_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote a (no CVSS)
- [CVE-2007-5596](https://cve.now/CVE-2007-5596.md): The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whitelist, which allows remote attack (no CVSS)
- [CVE-2007-5597](https://cve.now/CVE-2007-5597.md): The hook\_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypas (no CVSS)
- [CVE-2007-5598](https://cve.now/CVE-2007-5598.md): Cross-site scripting (XSS) vulnerability in Weblinks for Drupal 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.8 allows remote attackers to inj (no CVSS)
- [CVE-2007-5599](https://cve.now/CVE-2007-5599.md): Multiple PHP remote file inclusion vulnerabilities in awrate 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the toroo (no CVSS)
- [CVE-2007-5600](https://cve.now/CVE-2007-5600.md): Incomplete blacklist vulnerability in index.php in Artmedic CMS 3.4 and earlier allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-5587](https://cve.now/CVE-2007-5587.md): Buffer overflow in Macrovision SafeDisc secdrv.sys before 4.3.86.0, as shipped in Microsoft Windows XP SP2, XP Professional x64 and x64 SP2, (no CVSS)
- [CVE-2007-5585](https://cve.now/CVE-2007-5585.md): xscreensaver 5.03 and earlier, when running without xscreensaver-gl-extras (GL extras) installed, crashes when /usr/bin/xscreensaver-gl-help (no CVSS)
- [CVE-2002-2306](https://cve.now/CVE-2002-2306.md): Sharman Networks KaZaA Media Desktop 1.7.1 allows remote attackers to cause a denial of service (CPU consumption) by sending several large m (no CVSS)
- [CVE-2003-1374](https://cve.now/CVE-2003-1374.md): Buffer overflow in disable of HP-UX 11.0 may allow local users to execute arbitrary code via a long argument to the (1) -r or (2)-c options. (no CVSS)
- [CVE-2003-1375](https://cve.now/CVE-2003-1375.md): Buffer overflow in wall for HP-UX 10.20 through 11.11 may allow local users to execute arbitrary code by calling wall with a large file as a (no CVSS)
- [CVE-2003-1376](https://cve.now/CVE-2003-1376.md): WinZip 8.0 uses weak random number generation for password protected ZIP files, which allows local users to brute force the encryption keys (no CVSS)
- [CVE-2003-1377](https://cve.now/CVE-2003-1377.md): Buffer overflow in the reverse DNS lookup of Smart IRC Daemon (SIRCD) 0.4.0 and 0.4.4 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2003-1378](https://cve.now/CVE-2003-1378.md): Microsoft Outlook Express 6.0 and Outlook 2000, with the security zone set to Internet Zone, allows remote attackers to execute arbitrary pr (no CVSS)
- [CVE-2003-1379](https://cve.now/CVE-2003-1379.md): clarkconnectd in ClarkConnect Linux 1.2 allows remote attackers to obtain sensitive information about the server via the characters (1) A, w (no CVSS)
- [CVE-2003-1380](https://cve.now/CVE-2003-1380.md): Directory traversal vulnerability in BisonFTP Server 4 release 2 allows remote attackers to (1) list directories above the root via an 'ls @ (no CVSS)
- [CVE-2003-1381](https://cve.now/CVE-2003-1381.md): Format string vulnerability in AMX 0.9.2 and earlier, a plugin for Valve Software's Half-Life Server, allows remote attackers to execute arb (no CVSS)
- [CVE-2003-1382](https://cve.now/CVE-2003-1382.md): Buffer overflow in ISMail 1.4.3 and earlier allow remote attackers to execute arbitrary code via long domain names in (1) MAIL FROM or (2) R (no CVSS)
- [CVE-2003-1383](https://cve.now/CVE-2003-1383.md): WEB-ERP 0.1.4 and earlier allows remote attackers to obtain sensitive information via an HTTP request for the logicworks.ini file, which con (no CVSS)
- [CVE-2003-1384](https://cve.now/CVE-2003-1384.md): Cross-site scripting (XSS) vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via (no CVSS)
- [CVE-2003-1385](https://cve.now/CVE-2003-1385.md): ipchat.php in Invision Power Board 1.1.1 allows remote attackers to execute arbitrary PHP code, if register\_globals is enabled, by modifying (no CVSS)
- [CVE-2003-1386](https://cve.now/CVE-2003-1386.md): AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, w (no CVSS)
- [CVE-2003-1387](https://cve.now/CVE-2003-1387.md): Buffer overflow in Opera 6.05 and 6.06, and possibly other versions, allows remote attackers to execute arbitrary code via a URL with a long (no CVSS)
- [CVE-2003-1388](https://cve.now/CVE-2003-1388.md): Buffer overflow in Opera 7.02 Build 2668 allows remote attackers to crash Opera via a long HTTP request ending in a .ZIP extension. (no CVSS)
- [CVE-2003-1389](https://cve.now/CVE-2003-1389.md): RTS CryptoBuddy 1.2 and earlier truncates long passphrases without warning the user, which may make it easier to conduct certain brute force (no CVSS)
- [CVE-2003-1390](https://cve.now/CVE-2003-1390.md): RTS CryptoBuddy 1.2 and earlier stores bytes 53 through 55 of a 55-byte passphrase in plaintext, which makes it easier for local users to gu (no CVSS)
- [CVE-2003-1391](https://cve.now/CVE-2003-1391.md): RTS CryptoBuddy 1.0 and 1.2 uses a weak encryption algorithm for the passphrase and generates predictable keys, which makes it easier for at (no CVSS)
- [CVE-2003-1392](https://cve.now/CVE-2003-1392.md): CryptoBuddy 1.0 and 1.2 does not use the user-supplied passphrase to encrypt data, which could allow local users to use their own passphrase (no CVSS)
- [CVE-2003-1393](https://cve.now/CVE-2003-1393.md): Buffer overflow in Gupta SQLBase 8.1.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long E (no CVSS)
- [CVE-2003-1394](https://cve.now/CVE-2003-1394.md): CoffeeCup Software Password Wizard 4.0 stores sensitive information such as usernames and passwords in a .apw file under the web document ro (no CVSS)
- [CVE-2003-1395](https://cve.now/CVE-2003-1395.md): Buffer overflow in KaZaA Media Desktop 2.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (no CVSS)
- [CVE-2003-1396](https://cve.now/CVE-2003-1396.md): Heap-based buffer overflow in Opera 6.05 through 7.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbi (no CVSS)
- [CVE-2003-1397](https://cve.now/CVE-2003-1397.md): The PluginContext object of Opera 6.05 and 7.0 allows remote attackers to cause a denial of service (crash) via an HTTP request containing a (no CVSS)
- [CVE-2003-1398](https://cve.now/CVE-2003-1398.md): Cisco IOS 12.0 through 12.2, when IP routing is disabled, accepts false ICMP redirect messages, which allows remote attackers to cause a den (no CVSS)
- [CVE-2003-1399](https://cve.now/CVE-2003-1399.md): eject 2.0.10, when installed setuid on systems such as SuSE Linux 7.3, generates different error messages depending on whether a specified f (no CVSS)
- [CVE-2003-1400](https://cve.now/CVE-2003-1400.md): Cross-site scripting (XSS) vulnerability in the Your\_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.