# CVEs published 2007-10-30

39 CVEs were published on October 30, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-5731](https://cve.now/CVE-2007-5731.md): Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via (no CVSS)
- [CVE-2007-5732](https://cve.now/CVE-2007-5732.md): Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier (no CVSS)
- [CVE-2007-5733](https://cve.now/CVE-2007-5733.md): Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows rem (no CVSS)
- [CVE-2007-5734](https://cve.now/CVE-2007-5734.md): Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload\_file. (no CVSS)
- [CVE-2007-5735](https://cve.now/CVE-2007-5735.md): eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obta (no CVSS)
- [CVE-2007-5736](https://cve.now/CVE-2007-5736.md): Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified (no CVSS)
- [CVE-2007-5737](https://cve.now/CVE-2007-5737.md): Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspe (no CVSS)
- [CVE-2007-5738](https://cve.now/CVE-2007-5738.md): The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which (no CVSS)
- [CVE-2007-5739](https://cve.now/CVE-2007-5739.md): Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard allows remote attacke (no CVSS)
- [CVE-2007-1321](https://cve.now/CVE-2007-1321.md): Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a h (no CVSS)
- [CVE-2007-4277](https://cve.now/CVE-2007-4277.md): The Trend Micro AntiVirus scan engine before 8.550-1001, as used in Trend Micro PC-Cillin Internet Security 2007, and Tmxpflt.sys 8.320.1004 (no CVSS)
- [CVE-2007-5729](https://cve.now/CVE-2007-5729.md): The NE2000 emulator in QEMU 0.8.2 allows local users to execute arbitrary code by writing Ethernet frames with a size larger than the MTU to (no CVSS)
- [CVE-2007-5730](https://cve.now/CVE-2007-5730.md): Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via craft (no CVSS)
- [CVE-2007-4861](https://cve.now/CVE-2007-4861.md): SAXON 5.4, with display\_errors enabled, allows remote attackers to obtain sensitive information via (1) a direct request for news.php, (2) a (no CVSS)
- [CVE-2007-4862](https://cve.now/CVE-2007-4862.md): Cross-site scripting (XSS) vulnerability in admin/menu.php in SAXON 5.4 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2007-4863](https://cve.now/CVE-2007-4863.md): SQL injection vulnerability in example.php in SAXON 5.4 allows remote attackers to execute arbitrary SQL commands via the template parameter (no CVSS)
- [CVE-2007-5716](https://cve.now/CVE-2007-5716.md): Unspecified vulnerability in the Internet Protocol (IP) functionality in Sun Solaris 10 allows local users to cause a denial of service (pan (no CVSS)
- [CVE-2007-5717](https://cve.now/CVE-2007-5717.md): Unspecified vulnerability in Sun Fire X2100 M2 and X2200 M2 Embedded Lights Out Manager (ELOM) on x86 before firmware 2.70 allows remote att (no CVSS)
- [CVE-2007-5718](https://cve.now/CVE-2007-5718.md): vobcopy 0.5.14 allows local users to append data to an arbitrary file, or create an arbitrary new file, via a symlink attack on the (1) /tmp (no CVSS)
- [CVE-2007-5719](https://cve.now/CVE-2007-5719.md): SQL injection vulnerability in bb\_func\_search.php in miniBB 2.1 allows remote attackers to execute arbitrary SQL commands via the table para (no CVSS)
- [CVE-2007-5720](https://cve.now/CVE-2007-5720.md): Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and execute arbitrary PHP (no CVSS)
- [CVE-2007-5721](https://cve.now/CVE-2007-5721.md): PHP remote file inclusion vulnerability in \_theme/breadcrumb.php in MySpacePros MySpace Resource Script (MSRS) 1.21 allows remote attackers (no CVSS)
- [CVE-2007-5722](https://cve.now/CVE-2007-5722.md): Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8, as used in Ourgame GLWorld and possib (no CVSS)
- [CVE-2007-5723](https://cve.now/CVE-2007-5723.md): Heap-based buffer overflow in the samp\_send function in nuauth/sasl.c in NuFW before 2.2.7 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2007-5724](https://cve.now/CVE-2007-5724.md): Multiple cross-site scripting (XSS) vulnerabilities in Omnistar Live allow remote attackers to inject arbitrary web script or HTML via (1) t (no CVSS)
- [CVE-2007-5725](https://cve.now/CVE-2007-5725.md): Multiple cross-site scripting (XSS) vulnerabilities in Smart-Shop allow remote attackers to inject arbitrary web script or HTML via (1) the (no CVSS)
- [CVE-2007-5726](https://cve.now/CVE-2007-5726.md): Unspecified vulnerability in the Stream Control Transmission Protocol (sctp) functionality in Sun Solaris 10, when at least one SCTP socket (no CVSS)
- [CVE-2007-5727](https://cve.now/CVE-2007-5727.md): Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other ver (no CVSS)
- [CVE-2007-5728](https://cve.now/CVE-2007-5728.md): Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2007-4348](https://cve.now/CVE-2007-4348.md): Cross-site scripting (XSS) vulnerability in the CAD service in IBM Tivoli Storage Manager (TSM) Client 5.3.5.3 and 5.4.1.2 for Windows allow (no CVSS)
- [CVE-2007-5707](https://cve.now/CVE-2007-5707.md): OpenLDAP before 2.3.39 allows remote attackers to cause a denial of service (slapd crash) via an LDAP request with a malformed objectClasses (no CVSS)
- [CVE-2007-5708](https://cve.now/CVE-2007-5708.md): slapo-pcache (overlays/pcache.c) in slapd in OpenLDAP before 2.3.39, when running as a proxy-caching server, allocates memory using a malloc (no CVSS)
- [CVE-2007-5709](https://cve.now/CVE-2007-5709.md): Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file nam (no CVSS)
- [CVE-2007-5710](https://cve.now/CVE-2007-5710.md): Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2007-5711](https://cve.now/CVE-2007-5711.md): Massive Entertainment World in Conflict 1.001 and earlier allows remote attackers to cause a denial of service (failed assertion and daemon (no CVSS)
- [CVE-2007-5712](https://cve.now/CVE-2007-5712.md): The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the US (no CVSS, django)
- [CVE-2007-5713](https://cve.now/CVE-2007-5713.md): Off-by-one error in the GeoIP module in the AMX Mod X 1.76d plugin for Half-Life Server might allow attackers to execute arbitrary code or c (no CVSS)
- [CVE-2007-5714](https://cve.now/CVE-2007-5714.md): The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow (no CVSS)
- [CVE-2007-5715](https://cve.now/CVE-2007-5715.md): DenyHosts 2.6 processes OpenSSH sshd "not listed in AllowUsers" log messages with an incorrect regular expression that does not match an IP (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-10-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.