# CVEs published 2007-10-20

29 CVEs were published on October 20, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-5601](https://cve.now/CVE-2007-5601.md): Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions incl (no CVSS)
- [CVE-2003-1401](https://cve.now/CVE-2003-1401.md): login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which a (no CVSS)
- [CVE-2003-1402](https://cve.now/CVE-2003-1402.md): PHP remote file inclusion vulnerability in hit.php for Kietu 2.0 and 2.3 allows remote attackers to execute arbitrary PHP code via the url\_h (no CVSS)
- [CVE-2003-1403](https://cve.now/CVE-2003-1403.md): foo.php3 in DotBr 0.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function. (no CVSS)
- [CVE-2003-1404](https://cve.now/CVE-2003-1404.md): DotBr 0.1 stores config.inc with insufficient access control under the web document root, which allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2003-1405](https://cve.now/CVE-2003-1405.md): DotBr 0.1 allows remote attackers to execute arbitrary shell commands via the cmd parameter to (1) exec.php3 or (2) system.php3. (no CVSS)
- [CVE-2003-1406](https://cve.now/CVE-2003-1406.md): PHP remote file inclusion vulnerability in D-Forum 1.00 through 1.11 allows remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2003-1407](https://cve.now/CVE-2003-1407.md): Buffer overflow in cmd.exe in Windows NT 4.0 may allow local users to execute arbitrary code via a long pathname argument to the cd command. (no CVSS)
- [CVE-2003-1408](https://cve.now/CVE-2003-1408.md): Lotus Domino Server 5.0 and 6.0 allows remote attackers to read the source code for files via an HTTP request with a filename with a trailin (no CVSS)
- [CVE-2003-1409](https://cve.now/CVE-2003-1409.md): TOPo 1.43 allows remote attackers to obtain sensitive information by sending an HTTP request with an invalid parameter to (1) in.php or (2) (no CVSS)
- [CVE-2003-1410](https://cve.now/CVE-2003-1410.md): PHP remote file inclusion vulnerability in email.php (aka email.php3) in Cedric Email Reader 0.2 and 0.3 allows remote attackers to execute (no CVSS)
- [CVE-2003-1411](https://cve.now/CVE-2003-1411.md): PHP remote file inclusion vulnerability in emailreader\_execute\_on\_each\_page.inc.php in Cedric Email Reader 0.4 allows remote attackers to ex (no CVSS)
- [CVE-2003-1412](https://cve.now/CVE-2003-1412.md): PHP remote file inclusion vulnerability in index.php for GONiCUS System Administrator (GOsa) 1.0 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2003-1413](https://cve.now/CVE-2003-1413.md): parse\_xml.cgi in Apple Darwin Streaming Server 4.1.1 allows remote attackers to determine the existence of arbitrary files by using ".." seq (no CVSS)
- [CVE-2003-1414](https://cve.now/CVE-2003-1414.md): Directory traversal vulnerability in parse\_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remo (no CVSS)
- [CVE-2003-1415](https://cve.now/CVE-2003-1415.md): NetCharts XBRL Server 4.0.0 allows remote attackers to obtain sensitive information via an HTTP request with an invalid chunked transfer enc (no CVSS)
- [CVE-2003-1416](https://cve.now/CVE-2003-1416.md): BisonFTP Server 4 release 2 allows remote attackers to cause a denial of service (CPU consumption) via a long (1) ls or (2) cwd command. (no CVSS)
- [CVE-2003-1417](https://cve.now/CVE-2003-1417.md): nCipher Support Software 6.00, when using generatekey KeySafe to import keys, does not delete the temporary copies of the key, which may all (no CVSS)
- [CVE-2003-1418](https://cve.now/CVE-2003-1418.md): Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which r (no CVSS)
- [CVE-2003-1419](https://cve.now/CVE-2003-1419.md): Netscape 7.0 allows remote attackers to cause a denial of service (crash) via a web page with an invalid regular expression argument to the (no CVSS)
- [CVE-2003-1420](https://cve.now/CVE-2003-1420.md): Cross-site scripting (XSS) vulnerability in Opera 6.0 through 7.0 with automatic redirection disabled allows remote attackers to inject arbi (no CVSS)
- [CVE-2003-1421](https://cve.now/CVE-2003-1421.md): Unspecified vulnerability in mod\_mysql\_logger shared object in SuckBot 0.006 allows remote attackers to cause a denial of service (seg fault (no CVSS)
- [CVE-2003-1422](https://cve.now/CVE-2003-1422.md): Multiple unspecified vulnerabilities in the installer for SYSLINUX 2.01, when running setuid root, allow local users to gain privileges via (no CVSS)
- [CVE-2003-1423](https://cve.now/CVE-2003-1423.md): Petitforum stores the liste.txt data file under the web document root with insufficient access control, which allows remote attackers to obt (no CVSS)
- [CVE-2003-1424](https://cve.now/CVE-2003-1424.md): message.php in Petitforum does not properly authenticate users, which allows remote attackers to impersonate forum users via a modified conn (no CVSS)
- [CVE-2003-1425](https://cve.now/CVE-2003-1425.md): guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter. (no CVSS)
- [CVE-2003-1426](https://cve.now/CVE-2003-1426.md): Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT\_FILENAME environment variable to Perl's @INC include a (no CVSS)
- [CVE-2003-1427](https://cve.now/CVE-2003-1427.md): Directory traversal vulnerability in the web configuration interface in Netgear FM114P 1.4 allows remote attackers to read arbitrary files, (no CVSS)
- [CVE-2003-1428](https://cve.now/CVE-2003-1428.md): Gallery 1.3.3 creates directories with insecure permissions, which allows local users to read, modify, or delete photos. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.