# CVEs published 2007-10-24

40 CVEs were published on October 24, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2003-1462](https://cve.now/CVE-2003-1462.md): mod\_survey 3.0.0 through 3.0.15-pre6 does not check whether a survey exists before creating a subdirectory for it, which allows remote attac (no CVSS)
- [CVE-2003-1463](https://cve.now/CVE-2003-1463.md): Absolute path traversal vulnerability in Alt-N Technologies WebAdmin 2.0.0 through 2.0.2 allows remote attackers with administrator privileg (no CVSS)
- [CVE-2003-1464](https://cve.now/CVE-2003-1464.md): Buffer overflow in Siemens 45 series mobile phones allows remote attackers to cause a denial of service (disconnect and unavailable inbox) v (no CVSS)
- [CVE-2003-1465](https://cve.now/CVE-2003-1465.md): Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files. (no CVSS)
- [CVE-2003-1466](https://cve.now/CVE-2003-1466.md): Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) reg (no CVSS)
- [CVE-2003-1467](https://cve.now/CVE-2003-1467.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3. (no CVSS)
- [CVE-2003-1468](https://cve.now/CVE-2003-1468.md): The Web\_Links module in PHP-Nuke 6.0 through 6.5 final allows remote attackers to obtain the full web server path via an invalid cid paramet (no CVSS)
- [CVE-2003-1469](https://cve.now/CVE-2003-1469.md): The default configuration of ColdFusion MX has the "Enable Robust Exception Information" option selected, which allows remote attackers to o (no CVSS)
- [CVE-2003-1470](https://cve.now/CVE-2003-1470.md): Buffer overflow in IMAP service in MDaemon 6.7.5 and earlier allows remote authenticated users to cause a denial of service (crash) and exec (no CVSS)
- [CVE-2003-1471](https://cve.now/CVE-2003-1471.md): MDaemon POP server 6.0.7 and earlier allows remote authenticated users to cause a denial of service (crash) via a (1) DELE or (2) UIDL with (no CVSS)
- [CVE-2003-1472](https://cve.now/CVE-2003-1472.md): Buffer overflow in 3D-FTP client 4.0 allows remote FTP servers to cause a denial of service (crash) and possibly execute arbitrary code via (no CVSS)
- [CVE-2003-1473](https://cve.now/CVE-2003-1473.md): Buffer overflow in LTris 1.0.1 of FreeBSD Ports Collection 2003-02-25 and earlier allows local users to execute arbitrary code with gid "gam (no CVSS)
- [CVE-2003-1474](https://cve.now/CVE-2003-1474.md): slashem-tty in the FreeBSD Ports Collection is installed with write permissions for the games group, which allows local users with group gam (no CVSS)
- [CVE-2003-1475](https://cve.now/CVE-2003-1475.md): Netbus 1.5 through 1.7 allows more than one client to be connected at the same time, but only prompts the first connection for authenticatio (no CVSS)
- [CVE-2003-1476](https://cve.now/CVE-2003-1476.md): Cerberus FTP Server 2.1 stores usernames and passwords in plaintext, which could allow local users to gain access. (no CVSS)
- [CVE-2003-1477](https://cve.now/CVE-2003-1477.md): MAILsweeper for SMTP 4.3.6 and 4.3.7 allows remote attackers to cause a denial of service (CPU consumption) via a PowerPoint attachment that (no CVSS)
- [CVE-2003-1478](https://cve.now/CVE-2003-1478.md): Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that begins with a "xFFxFE" byte sequ (no CVSS)
- [CVE-2003-1479](https://cve.now/CVE-2003-1479.md): Cross-site scripting (XSS) vulnerability in webcamXP 1.02.432 and 1.02.535 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2003-1480](https://cve.now/CVE-2003-1480.md): MySQL 3.20 through 4.1.0 uses a weak algorithm for hashed passwords, which makes it easier for attackers to decrypt the password via brute f (no CVSS)
- [CVE-2003-1481](https://cve.now/CVE-2003-1481.md): CommuniGate Pro 3.1 through 4.0.6 sends the session ID in the referer field for an HTTP request for an image, which allows remote attackers (no CVSS)
- [CVE-2003-1482](https://cve.now/CVE-2003-1482.md): The backup configuration file for Microsoft MN-500 wireless base station stores administrative passwords in plaintext, which allows local us (no CVSS)
- [CVE-2003-1483](https://cve.now/CVE-2003-1483.md): FlashFXP 1.4 uses a weak encryption algorithm for user passwords, which allows attackers to decrypt the passwords and gain access. (no CVSS)
- [CVE-2003-1484](https://cve.now/CVE-2003-1484.md): Microsoft Internet Explorer 6.0 SP1 allows remote attackers to cause a denial of service (crash) by creating a DHTML link that uses the Anch (no CVSS)
- [CVE-2003-1485](https://cve.now/CVE-2003-1485.md): Clearswift MAILsweeper 4.0 through 4.3.7 allows remote attackers to bypass filtering via a file attachment that contains "multiple extension (no CVSS)
- [CVE-2003-1486](https://cve.now/CVE-2003-1486.md): Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (no CVSS)
- [CVE-2003-1487](https://cve.now/CVE-2003-1487.md): Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the (no CVSS)
- [CVE-2003-1488](https://cve.now/CVE-2003-1488.md): The (1) verif\_admin.php and (2) check\_admin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request (no CVSS)
- [CVE-2003-1489](https://cve.now/CVE-2003-1489.md): upload.php in Truegalerie 1.0 allows remote attackers to read arbitrary files by specifying the target filename in the file cookie in form.p (no CVSS)
- [CVE-2003-1490](https://cve.now/CVE-2003-1490.md): SonicWall Pro running firmware 6.4.0.1 allows remote attackers to cause a denial of service (device reset) via a long HTTP POST to the inter (no CVSS)
- [CVE-2003-1491](https://cve.now/CVE-2003-1491.md): Kerio Personal Firewall (KPF) 2.1.4 has a default rule to accept incoming packets from DNS (UDP port 53), which allows remote attackers to b (no CVSS)
- [CVE-2003-1492](https://cve.now/CVE-2003-1492.md): Netscape Navigator 7.0.2 and Mozilla allows remote attackers to access cookie information in a different domain via an HTTP request for a do (no CVSS)
- [CVE-2003-1493](https://cve.now/CVE-2003-1493.md): Memory leak in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (memory exhaustion) v (no CVSS)
- [CVE-2003-1494](https://cve.now/CVE-2003-1494.md): Unspecified vulnerability in HP OpenView Network Node Manager (NNM) 6.2 and 6.4 allows remote attackers to cause a denial of service (CPU co (no CVSS)
- [CVE-2007-5673](https://cve.now/CVE-2007-5673.md): Cross-site scripting (XSS) vulnerability in cgi-bin/webif.exe in ifnet WebIf allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-5674](https://cve.now/CVE-2007-5674.md): Directory traversal vulnerability in index.php in InstaGuide Weather (aka Weather for PHP) 1.0, when magic\_quotes\_gpc is disabled, allows re (no CVSS)
- [CVE-2007-5675](https://cve.now/CVE-2007-5675.md): Stack-based buffer overflow in the DebugPrint function in MultiXTpm Application Server before 4.0.2d allows remote attackers to execute arbi (no CVSS)
- [CVE-2007-5676](https://cve.now/CVE-2007-5676.md): PHP remote file inclusion vulnerability in modules/Forums/favorites.php in PHP-Nuke Platinum 7.6.b.5 allows remote attackers to execute arbi (no CVSS)
- [CVE-2007-5677](https://cve.now/CVE-2007-5677.md): Cross-site scripting (XSS) vulnerability in shoutbox/blocco.php in Hackish BETA 1.1 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-5678](https://cve.now/CVE-2007-5678.md): SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter i (no CVSS)
- [CVE-2007-5335](https://cve.now/CVE-2007-5335.md): Mozilla Firefox 2.0 before 2.0.0.8 allows remote attackers to obtain sensitive system information by using the addMicrosummaryGenerator side (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.