# CVEs published 2007-10-23

66 CVEs were published on October 23, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-5641](https://cve.now/CVE-2007-5641.md): Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-5642](https://cve.now/CVE-2007-5642.md): Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbi (no CVSS)
- [CVE-2007-5643](https://cve.now/CVE-2007-5643.md): Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) (no CVSS)
- [CVE-2007-5644](https://cve.now/CVE-2007-5644.md): Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1) ajax/sortcategories.php and (2) ajax/sortroles.php, which allows (no CVSS)
- [CVE-2007-5646](https://cve.now/CVE-2007-5646.md): SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to exe (no CVSS)
- [CVE-2007-5647](https://cve.now/CVE-2007-5647.md): Multiple cross-site scripting (XSS) vulnerabilities in SocketKB 1.1.5 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-5648](https://cve.now/CVE-2007-5648.md): Multiple cross-site scripting (XSS) vulnerabilities in rnote.php in rNote 0.9.7.5 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-5649](https://cve.now/CVE-2007-5649.md): Cross-site scripting (XSS) vulnerability in lostpwd.php in Creative Digital Resources SocketMail 2.2.1 allows remote attackers to inject arb (no CVSS)
- [CVE-2007-5650](https://cve.now/CVE-2007-5650.md): Directory traversal vulnerability in system.php in ReloadCMS 1.2.7 allows remote attackers to include and execute arbitrary local files via (no CVSS)
- [CVE-2007-5651](https://cve.now/CVE-2007-5651.md): Unspecified vulnerability in the Extensible Authentication Protocol (EAP) implementation in Cisco IOS 12.3 and 12.4 on Cisco Access Points a (no CVSS)
- [CVE-2007-5652](https://cve.now/CVE-2007-5652.md): IBM DB2 UDB 9.1 before Fixpak 4 does not properly manage storage of a list containing authentication information, which might allow attacker (no CVSS)
- [CVE-2007-5653](https://cve.now/CVE-2007-5653.md): The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe\_mode and disable\_functions restrictions, which allows co (no CVSS)
- [CVE-2007-5654](https://cve.now/CVE-2007-5654.md): LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed (no CVSS)
- [CVE-2007-5630](https://cve.now/CVE-2007-5630.md): SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2007-5631](https://cve.now/CVE-2007-5631.md): Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register\_globals is enabled, allow remote attackers to (no CVSS)
- [CVE-2007-5632](https://cve.now/CVE-2007-5632.md): Multiple unspecified vulnerabilities in the kernel in Sun Solaris 8 through 10 allow local users to cause a denial of service (panic), relat (no CVSS)
- [CVE-2007-5633](https://cve.now/CVE-2007-5633.md): Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbit (no CVSS)
- [CVE-2007-5634](https://cve.now/CVE-2007-5634.md): Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, does not properly check a buffer during a (no CVSS)
- [CVE-2007-5635](https://cve.now/CVE-2007-5635.md): Multiple unspecified vulnerabilities in Salford Software Support Incident Tracker (SiT!) before 3.30 have unknown impact and attack vectors. (no CVSS)
- [CVE-2007-5636](https://cve.now/CVE-2007-5636.md): Buffer overflow in the Nortel UNIStim IP Softphone 2050 allows remote attackers to cause a denial of service (application abort) and possibl (no CVSS)
- [CVE-2007-5637](https://cve.now/CVE-2007-5637.md): The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM (no CVSS)
- [CVE-2007-5638](https://cve.now/CVE-2007-5638.md): The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM (no CVSS)
- [CVE-2007-5639](https://cve.now/CVE-2007-5639.md): The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remot (no CVSS)
- [CVE-2007-5640](https://cve.now/CVE-2007-5640.md): The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM (no CVSS)
- [CVE-2007-5623](https://cve.now/CVE-2007-5623.md): Buffer overflow in the check\_snmp function in Nagios Plugins (nagios-plugins) 1.4.10 allows remote attackers to cause a denial of service (c (no CVSS)
- [CVE-2007-5624](https://cve.now/CVE-2007-5624.md): Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknow (no CVSS)
- [CVE-2007-5625](https://cve.now/CVE-2007-5625.md): Cross-site scripting (XSS) vulnerability in filename.asp in ASP Site Search SearchSimon Lite 1.0 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-5626](https://cve.now/CVE-2007-5626.md): make\_catalog\_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleart (no CVSS)
- [CVE-2007-5627](https://cve.now/CVE-2007-5627.md): PHP remote file inclusion vulnerability in content/fnc-readmail3.php in SocketMail 2.2.8 allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2007-5628](https://cve.now/CVE-2007-5628.md): PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute (no CVSS)
- [CVE-2007-5629](https://cve.now/CVE-2007-5629.md): Cross-site scripting (XSS) vulnerability in admin/logon.asp in ShoppingTree CandyPress Store 4.1 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-3850](https://cve.now/CVE-2007-3850.md): The eHCA driver in Linux kernel 2.6 before 2.6.22, when running on PowerPC, does not properly map userspace resources, which allows local us (no CVSS)
- [CVE-2007-4574](https://cve.now/CVE-2007-4574.md): Unspecified vulnerability in the "stack unwinder fixes" in kernel in Red Hat Enterprise Linux 5, when running on AMD64 and Intel 64, allows (no CVSS)
- [CVE-2003-1429](https://cve.now/CVE-2003-1429.md): Buffer overflow in Proxomitron Naoko 4.4 allows remote attackers to execute arbitrary code via a long request. (no CVSS)
- [CVE-2003-1430](https://cve.now/CVE-2003-1430.md): Directory traversal vulnerability in Unreal Tournament Server 436 and earlier allows remote attackers to access known files via a ".." (dot (no CVSS)
- [CVE-2003-1431](https://cve.now/CVE-2003-1431.md): Buffer overflow in Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (crash) via a long host st (no CVSS)
- [CVE-2003-1432](https://cve.now/CVE-2003-1432.md): Epic Games Unreal Engine 226f through 436 allows remote attackers to cause a denial of service (CPU consumption or crash) and possibly execu (no CVSS)
- [CVE-2003-1433](https://cve.now/CVE-2003-1433.md): Epic Games Unreal Engine 226f through 436 does not validate the challenge key, which allows remote attackers to exhaust the player limit by (no CVSS)
- [CVE-2003-1434](https://cve.now/CVE-2003-1434.md): login\_ldap 3.1 and 3.2 allows remote attackers to initiate unauthenticated bind requests if (1) bind\_anon\_dn is on, which allows a bind with (no CVSS)
- [CVE-2003-1435](https://cve.now/CVE-2003-1435.md): SQL injection vulnerability in PHP-Nuke 5.6 and 6.0 allows remote attackers to execute arbitrary SQL commands via the days parameter to the (no CVSS)
- [CVE-2003-1436](https://cve.now/CVE-2003-1436.md): PHP remote file inclusion vulnerability in nukebrowser.php in Nukebrowser 2.1 to 2.5 allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2003-1437](https://cve.now/CVE-2003-1437.md): BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or tr (no CVSS)
- [CVE-2003-1438](https://cve.now/CVE-2003-1438.md): Race condition in BEA WebLogic Server and Express 5.1 through 7.0.0.1, when using in-memory session replication or replicated stateful sessi (no CVSS)
- [CVE-2003-1439](https://cve.now/CVE-2003-1439.md): Secure Internet Live Conferencing (SILC) 0.9.11 and 0.9.12 stores passwords and sessions in plaintext in memory, which could allow local use (no CVSS)
- [CVE-2003-1440](https://cve.now/CVE-2003-1440.md): SpamProbe 0.8a allows remote attackers to cause a denial of service (crash) via HTML e-mail with newline characters within an href tag, whic (no CVSS)
- [CVE-2003-1441](https://cve.now/CVE-2003-1441.md): Posadis 0.50.4 through 0.50.8 allows remote attackers to cause a denial of service (crash) via a DNS message without a question section, whi (no CVSS)
- [CVE-2003-1442](https://cve.now/CVE-2003-1442.md): The web administration page for the Ericsson HM220dp ADSL modem does not require authentication, which could allow remote attackers to gain (no CVSS)
- [CVE-2003-1443](https://cve.now/CVE-2003-1443.md): Kaspersky Antivirus (KAV) 4.0.9.0 does not detect viruses in files with MS-DOS device names in their filenames, which allows local users to (no CVSS)
- [CVE-2003-1444](https://cve.now/CVE-2003-1444.md): Kaspersky Antivirus (KAV) 4.0.9.0 allows local users to cause a denial of service (CPU consumption or crash) and prevent malicious code from (no CVSS)
- [CVE-2003-1445](https://cve.now/CVE-2003-1445.md): Stack-based buffer overflow in Far Manager 1.70beta1 and earlier allows local users to cause a denial of service (crash) and possibly execut (no CVSS)
- [CVE-2003-1446](https://cve.now/CVE-2003-1446.md): Buffer overflow in the save\_into\_file function in save.c for Rogue 5.2-2 allows local users to execute arbitrary code with games group privi (no CVSS)
- [CVE-2003-1447](https://cve.now/CVE-2003-1447.md): IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt (no CVSS)
- [CVE-2003-1448](https://cve.now/CVE-2003-1448.md): Memory leak in the Windows 2000 kernel allows remote attackers to cause a denial of service (SMB request hang) via a NetBIOS continuation pa (no CVSS)
- [CVE-2003-1449](https://cve.now/CVE-2003-1449.md): Aladdin Knowlege Systems eSafe Gateway 3.5.126.0 does not check the entire stream of Content Vectoring Protocol (CVP) data, which allows rem (no CVSS)
- [CVE-2003-1450](https://cve.now/CVE-2003-1450.md): BitchX 75p3 and 1.0c16 through 1.0c20cvs allows remote attackers to cause a denial of service (segmentation fault) via a malformed RPL\_NAMRE (no CVSS)
- [CVE-2003-1451](https://cve.now/CVE-2003-1451.md): Buffer overflow in Symantec Norton AntiVirus 2002 allows remote attackers to execute arbitrary code via an e-mail attachment with a compress (no CVSS)
- [CVE-2003-1452](https://cve.now/CVE-2003-1452.md): Untrusted search path vulnerability in Qualcomm qpopper 4.0 through 4.05 allows local users to execute arbitrary code by modifying the PATH (no CVSS)
- [CVE-2003-1453](https://cve.now/CVE-2003-1453.md): Cross-site scripting (XSS) vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows rem (no CVSS)
- [CVE-2003-1454](https://cve.now/CVE-2003-1454.md): Invision Power Services Invision Board 1.0 through 1.1.1, when a forum is password protected, stores the administrator password in a cookie (no CVSS)
- [CVE-2003-1455](https://cve.now/CVE-2003-1455.md): Multiple buffer overflows in the launch\_bcrelay function in pptpctrl.c in PoPToP 1.1.4-b1 through PoPToP 1.1.4-b3 allow local users to execu (no CVSS)
- [CVE-2003-1456](https://cve.now/CVE-2003-1456.md): Album.pl 6.1 allows remote attackers to execute arbitrary commands, when an alternative configuration file is used, via unknown attack vecto (no CVSS)
- [CVE-2003-1457](https://cve.now/CVE-2003-1457.md): Auerswald COMsuite CTI ControlCenter 3.1 creates a default "runasositron" user account with an easily guessable password, which allows local (no CVSS)
- [CVE-2003-1458](https://cve.now/CVE-2003-1458.md): SQL injection vulnerability in Profile.php in ttCMS 2.2 and ttForum allows remote attackers to execute arbitrary SQL commands via the member (no CVSS)
- [CVE-2003-1459](https://cve.now/CVE-2003-1459.md): Multiple PHP remote file inclusion vulnerabilities in ttCMS 2.2 and ttForum allow remote attackers to execute arbitrary PHP code via the (1) (no CVSS)
- [CVE-2003-1460](https://cve.now/CVE-2003-1460.md): Worker Filemanager 1.0 through 2.7 sets the permissions on the destination directory to world-readable and executable while copying data, wh (no CVSS)
- [CVE-2003-1461](https://cve.now/CVE-2003-1461.md): Buffer overflow in rwrite for HP-UX 11.0 could allow local users to execute arbitrary code via a long argument. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.