# CVEs published 2007-10-29

55 CVEs were published on October 29, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-4222](https://cve.now/CVE-2007-4222.md): Buffer overflow in the TagAttributeListCopy function in nnotes.dll in IBM Lotus Notes before 7.0.3 allows user-assisted remote attackers to (no CVSS)
- [CVE-2007-4999](https://cve.now/CVE-2007-4999.md): libpurple in Pidgin 2.1.0 through 2.2.1, when using HTML logging, allows remote attackers to cause a denial of service (NULL dereference and (no CVSS)
- [CVE-2007-5413](https://cve.now/CVE-2007-5413.md): httpd.tkd in Radia Integration Server in Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure 4.0 through 4.2i and Cli (no CVSS)
- [CVE-2007-5702](https://cve.now/CVE-2007-5702.md): Cross-site scripting (XSS) vulnerability in swamp/action/LoginActions (aka the login box) in the Novell OpenSUSE SWAMP Workflow Administrati (no CVSS)
- [CVE-2007-5703](https://cve.now/CVE-2007-5703.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) Request-spk.xuda and (2) Add-msie-request.xuda in RSA KEON Registration Authority (no CVSS)
- [CVE-2007-5704](https://cve.now/CVE-2007-5704.md): Multiple SQL injection vulnerabilities in CodeWidgets.com Online Event Registration Template allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-5705](https://cve.now/CVE-2007-5705.md): Unspecified vulnerability in the Settings component in the administration system in Jeebles Directory 2.9.60 allows remote authenticated adm (no CVSS)
- [CVE-2007-5706](https://cve.now/CVE-2007-5706.md): Absolute path traversal vulnerability in download.php in Jeebles Directory 2.9.60 allows remote attackers to read arbitrary files via a full (no CVSS)
- [CVE-2007-3510](https://cve.now/CVE-2007-3510.md): Buffer overflow in the IMAP service in IBM Lotus Domino before 6.5.6 FP2, and 7.x before 7.0.3, allows remote authenticated users to execute (no CVSS)
- [CVE-2007-3920](https://cve.now/CVE-2007-3920.md): GNOME screensaver 2.20 in Ubuntu 7.10, when used with Compiz, does not properly reserve input focus, which allows attackers with physical ac (no CVSS)
- [CVE-2007-5544](https://cve.now/CVE-2007-5544.md): IBM Lotus Notes before 6.5.6, and 7.x before 7.0.3; and Domino before 6.5.5 FP3, and 7.x before 7.0.2 FP1; uses weak permissions (Everyone:F (no CVSS)
- [CVE-2007-5622](https://cve.now/CVE-2007-5622.md): Double free vulnerability in the ftpprchild function in ftppr in 3proxy 0.5 through 0.5.3i allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2007-5697](https://cve.now/CVE-2007-5697.md): Multiple PHP remote file inclusion vulnerabilities in PHP Image 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the xa (no CVSS)
- [CVE-2007-5698](https://cve.now/CVE-2007-5698.md): Cross-site scripting (XSS) vulnerability in default.asp in CREApark GOLD KOY PORTALI allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-5699](https://cve.now/CVE-2007-5699.md): Stack-based buffer overflow in eIQNetworks Enterprise Security Analyzer (ESA) 2.5 allows remote attackers to execute arbitrary code via cert (no CVSS)
- [CVE-2007-5700](https://cve.now/CVE-2007-5700.md): The Evaluate LotusScript method in IBM Lotus Domino before 7.0.3 uses an incorrect security context for @ formula commands in some circumsta (no CVSS)
- [CVE-2007-5701](https://cve.now/CVE-2007-5701.md): Incomplete blacklist vulnerability in the Certificate Authority (CA) in IBM Lotus Domino before 7.0.3 allows local users, or attackers with (no CVSS)
- [CVE-2007-5692](https://cve.now/CVE-2007-5692.md): Multiple cross-site scripting (XSS) vulnerabilities in SiteBar 3.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) t (no CVSS)
- [CVE-2007-5693](https://cve.now/CVE-2007-5693.md): Eval injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitr (no CVSS)
- [CVE-2007-5694](https://cve.now/CVE-2007-5694.md): Absolute path traversal vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to read (no CVSS)
- [CVE-2007-5695](https://cve.now/CVE-2007-5695.md): Open redirect vulnerability in command.php in SiteBar 3.3.8 allows remote attackers to redirect users to arbitrary web sites via a URL in th (no CVSS)
- [CVE-2007-5696](https://cve.now/CVE-2007-5696.md): PHP remote file inclusion vulnerability in includes.php in phpBasic allows remote attackers to execute arbitrary PHP code via a URL in the r (no CVSS)
- [CVE-2002-2336](https://cve.now/CVE-2002-2336.md): Norton Personal Firewall 2002 4.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a (no CVSS)
- [CVE-2002-2337](https://cve.now/CVE-2002-2337.md): Kaspersky Anti-Hacker 1.0, when configured to automatically block attacks, allows remote attackers to block IP addresses and cause a denial (no CVSS)
- [CVE-2002-2338](https://cve.now/CVE-2002-2338.md): The POP3 mail client in Mozilla 1.0 and earlier, and Netscape Communicator 4.7 and earlier, allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2002-2339](https://cve.now/CVE-2002-2339.md): Cross-site scripting (XSS) vulnerability in configure.asp in Script-Shed GuestBook 1.0 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2002-2340](https://cve.now/CVE-2002-2340.md): Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) (no CVSS)
- [CVE-2002-2341](https://cve.now/CVE-2002-2341.md): Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2002-2342](https://cve.now/CVE-2002-2342.md): Bannermatic 1, 2, and 3 stores the (1) ban.log, (2) ban.bak, (3) ban.dat and (4) banmat.pwd data files under the web document root with insu (no CVSS)
- [CVE-2002-2343](https://cve.now/CVE-2002-2343.md): Cross-site scripting (XSS) vulnerability in NOCC 0.9 through 0.9.5 allows remote attackers to inject arbitrary web script or HTML via email (no CVSS)
- [CVE-2002-2344](https://cve.now/CVE-2002-2344.md): Ensim WEBppliance 3.0 and 3.1 allows remote attackers to read mail intended for other users by defining an alias that is the target's email (no CVSS)
- [CVE-2002-2345](https://cve.now/CVE-2002-2345.md): Oracle 9i Application Server 9.0.2 stores the web cache administrator interface password in plaintext, which allows remote attackers to gain (no CVSS)
- [CVE-2002-2346](https://cve.now/CVE-2002-2346.md): phpBB 2.0 through 2.0.3 generates names for uploaded avatar files with the hex-encoded IP address of the client system, which allows remote (no CVSS)
- [CVE-2002-2347](https://cve.now/CVE-2002-2347.md): Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean (no CVSS)
- [CVE-2002-2348](https://cve.now/CVE-2002-2348.md): Cross-site scripting (XSS) vulnerability in athcgi.exe in Authoria HR allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2002-2349](https://cve.now/CVE-2002-2349.md): phpinfo.php in phpBBmod 1.3.3 executes the phpinfo function, which allows remote attackers to obtain sensitive environment information. (no CVSS)
- [CVE-2002-2350](https://cve.now/CVE-2002-2350.md): Cross-site scripting (XSS) vulnerability in z\_user\_show.php in dbtreelistproperty\_method.php in Zorum 2.4 allows remote attackers to inject (no CVSS)
- [CVE-2002-2351](https://cve.now/CVE-2002-2351.md): Eudora 5.1 allows remote attackers to bypass security warnings and possibly execute arbitrary code via attachments with names containing a t (no CVSS)
- [CVE-2002-2352](https://cve.now/CVE-2002-2352.md): The NBActiveX.ocx ActiveX control in NeoBook 4 allows remote attackers to install and execute arbitrary programs. (no CVSS)
- [CVE-2002-2353](https://cve.now/CVE-2002-2353.md): tftpd32 2.50 and 2.50.2 allows remote attackers to read or write arbitrary files via a full pathname in GET and PUT requests. (no CVSS)
- [CVE-2002-2354](https://cve.now/CVE-2002-2354.md): Netgear FM114P firmware 1.3 wireless firewall allows remote attackers to cause a denial of service (crash or hang) via a large number of TCP (no CVSS)
- [CVE-2002-2355](https://cve.now/CVE-2002-2355.md): Netgear FM114P firmware 1.3 wireless firewall, when configured to backup configuration information, stores DDNS (DynDNS) user name and passw (no CVSS)
- [CVE-2002-2356](https://cve.now/CVE-2002-2356.md): HAMweather 2.x allows remote attackers to modify administrative settings and obtain sensitive information via a direct request to hwadmin.cg (no CVSS)
- [CVE-2002-2357](https://cve.now/CVE-2002-2357.md): MailEnable 1.5 015 through 1.5 018 allows remote attackers to cause a denial of service (crash) via a long USER string, possibly due to a bu (no CVSS)
- [CVE-2002-2358](https://cve.now/CVE-2002-2358.md): Cross-site scripting (XSS) vulnerability in the FTP view feature in Opera 6.0 and 6.01 through 6.04 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2002-2359](https://cve.now/CVE-2002-2359.md): Cross-site scripting (XSS) vulnerability in the FTP view feature in Mozilla 1.0 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2002-2360](https://cve.now/CVE-2002-2360.md): The RPC module in Webmin 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to ar (no CVSS)
- [CVE-2002-2361](https://cve.now/CVE-2002-2361.md): The installer in Yahoo! Messenger 4.0, 5.0 and 5.5 does not verify package signatures which could allow remote attackers to install trojan p (no CVSS)
- [CVE-2002-2362](https://cve.now/CVE-2002-2362.md): Cross-site scripting (XSS) vulnerability in form\_header.php in MyMarket 1.71 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2002-2363](https://cve.now/CVE-2002-2363.md): VJE.VJE-RUN in HP-UX 11.00 adds bin to /etc/PATH, which could allow local users to gain privileges. (no CVSS)
- [CVE-2002-2364](https://cve.now/CVE-2002-2364.md): Cross-site scripting (XSS) vulnerability in PHP Ticket 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a (no CVSS)
- [CVE-2007-5688](https://cve.now/CVE-2007-5688.md): Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision (no CVSS)
- [CVE-2007-5689](https://cve.now/CVE-2007-5689.md): The Java Virtual Machine (JVM) in Sun Java Runtime Environment (JRE) in SDK and JRE 1.3.x through 1.3.1\_20 and 1.4.x through 1.4.2\_15, and J (no CVSS)
- [CVE-2007-5690](https://cve.now/CVE-2007-5690.md): Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface nam (no CVSS)
- [CVE-2007-5691](https://cve.now/CVE-2007-5691.md): ParseFTPList.cpp in Mozilla Firefox 2.0.0.7 allows remote FTP servers to cause a denial of service (application crash) via a crafted reply t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.