# CVEs published 2007-11-01

55 CVEs were published on November 1, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2002-2394](https://cve.now/CVE-2002-2394.md): InterScan VirusWall 3.6 for Linux and 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary cod (no CVSS)
- [CVE-2002-2395](https://cve.now/CVE-2002-2395.md): InterScan VirusWall 3.52 for Windows allows remote attackers to bypass virus protection and possibly execute arbitrary code via HTTP 1.1 gzi (no CVSS)
- [CVE-2002-2396](https://cve.now/CVE-2002-2396.md): Buffer overflow in Advanced TFTP (atftp) 0.5 and 0.6, if installed setuid or setgid, may allow local users to execute arbitrary code via a l (no CVSS)
- [CVE-2002-2397](https://cve.now/CVE-2002-2397.md): Sygate personal firewall 5.0 could allow remote attackers to bypass firewall filters via spoofed (1) source IP address of 127.0.0.1 or (2) n (no CVSS)
- [CVE-2002-2398](https://cve.now/CVE-2002-2398.md): The new thread posting page in APBoard 2.02 and 2.03 allows remote attackers to post messages to protected forums by modifying the insertint (no CVSS)
- [CVE-2002-2399](https://cve.now/CVE-2002-2399.md): Directory traversal vulnerability in viewAttachment.cgi in W3Mail 1.0.6 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-2400](https://cve.now/CVE-2002-2400.md): Buffer overflow in the httpdProcessRequest function in LibHTTPD 1.2 allows remote attackers to cause a denial of service (crash) and possibl (no CVSS)
- [CVE-2002-2401](https://cve.now/CVE-2002-2401.md): NT Virtual DOS Machine (NTVDM.EXE) in Windows 2000, NT and XP does not verify user execution permissions for 16-bit executable files, which (no CVSS)
- [CVE-2002-2402](https://cve.now/CVE-2002-2402.md): SURECOM broadband router EP-4501 uses a default SNMP read community string of "public" and a default SNMP read/write community string of "se (no CVSS)
- [CVE-2002-2403](https://cve.now/CVE-2002-2403.md): Directory traversal vulnerability in KeyFocus web server 1.0.8 allows remote attackers to read arbitrary files for recognized MIME type file (no CVSS)
- [CVE-2002-2404](https://cve.now/CVE-2002-2404.md): Buffer overflow in IISPop email server 1.161 and 1.181 allows remote attackers to cause a denial of service (crash) via a long request to th (no CVSS)
- [CVE-2002-2405](https://cve.now/CVE-2002-2405.md): Check Point FireWall-1 4.1 and Next Generation (NG), with UserAuth configured to proxy HTTP traffic only, allows remote attackers to pass un (no CVSS)
- [CVE-2002-2406](https://cve.now/CVE-2002-2406.md): Buffer overflow in HTTP server in LiteServe 2.0, 2.0.1 and 2.0.2 allows remote attackers to cause a denial of service (hang) via a large num (no CVSS)
- [CVE-2002-2407](https://cve.now/CVE-2002-2407.md): Certain patches for QNX Neutrino realtime operating system (RTOS) 6.2.0 set insecure permissions for the files (1) /sbin/io-audio by OS Upda (no CVSS)
- [CVE-2002-2408](https://cve.now/CVE-2002-2408.md): Gordano Messaging Server (GMS) Mail 8 (a.k.a. (no CVSS)
- [CVE-2002-2409](https://cve.now/CVE-2002-2409.md): Photon microGUI in QNX Neutrino realtime operating system (RTOS) 6.1.0 and 6.2.0 allows attackers to read user clipboard information via a d (no CVSS)
- [CVE-2002-2410](https://cve.now/CVE-2002-2410.md): openwebmail.pl in Open WebMail 1.7 and 1.71 reveals sensitive information in error messages and generates different responses whether a user (no CVSS)
- [CVE-2002-2411](https://cve.now/CVE-2002-2411.md): Buffer overflow in badmin.c in BannerWheel 1.0 allows remote attackers to execute arbitrary code via a long rcmd command. (no CVSS)
- [CVE-2002-2412](https://cve.now/CVE-2002-2412.md): Winamp 2.80 stores authentication credentials in plaintext in the (1) \[HTTP-AUTH\] and (2) \[winamp\] sections in winamp.ini, which allows loca (no CVSS)
- [CVE-2002-2413](https://cve.now/CVE-2002-2413.md): WebSite Pro 3.1.11.0 on Windows allows remote attackers to read script source code for files with extensions greater than 3 characters via a (no CVSS)
- [CVE-2002-2414](https://cve.now/CVE-2002-2414.md): Opera 6.0.3, when using Squid 2.4 for HTTPS proxying, does not properly handle when accepting a non-global certificate authority (CA) certif (no CVSS)
- [CVE-2002-2415](https://cve.now/CVE-2002-2415.md): Allied Telesyn AT-8024 1.3.1 and Rapier 24 switches allow remote authenticated users to cause a denial of service in the management interfac (no CVSS)
- [CVE-2002-2416](https://cve.now/CVE-2002-2416.md): Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2002-2417](https://cve.now/CVE-2002-2417.md): acFTP 1.4 does not properly handle when an invalid password is provided by the user during authentication, which allows remote attackers to (no CVSS)
- [CVE-2002-2418](https://cve.now/CVE-2002-2418.md): Cross-site scripting (XSS) vulnerability in acFreeProxy (aka acFP) 1.33 beta 7 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2002-2419](https://cve.now/CVE-2002-2419.md): Direct connect text client (DCTC) client 0.83.3 allows remote attackers to cause a denial of service (crash) via a string ending with a NULL (no CVSS)
- [CVE-2002-2420](https://cve.now/CVE-2002-2420.md): site\_searcher.cgi in Super Site Searcher allows remote attackers to execute arbitrary commands via shell metacharacters in the page paramete (no CVSS)
- [CVE-2002-2421](https://cve.now/CVE-2002-2421.md): acWEB 1.14 allows remote attackers to cause a denial of service (crash) via an HTTP request for a MS-DOS device name such as COM2. (no CVSS)
- [CVE-2002-2422](https://cve.now/CVE-2002-2422.md): Cross-site scripting (XSS) vulnerability in Compaq Insight Management Agents 2.0, 2.1, 3.6.0, 4.2 and 4.3.7 allows remote attackers to injec (no CVSS)
- [CVE-2002-2423](https://cve.now/CVE-2002-2423.md): Sendmail 8.12.0 through 8.12.6 truncates log messages longer than 100 characters, which allows remote attackers to prevent the IP address fr (no CVSS)
- [CVE-2002-2424](https://cve.now/CVE-2002-2424.md): Cross-site scripting (XSS) vulnerability in PHP(Reactor) 1.2.7 pl1 allows remote attackers to inject arbitrary web script or HTML via Javasc (no CVSS)
- [CVE-2002-2425](https://cve.now/CVE-2002-2425.md): Sun AnswerBook2 1.2 through 1.4.2 allows remote attackers to execute administrative scripts such as (1) AdminViewError and (2) AdminAddadmin (no CVSS)
- [CVE-2007-5793](https://cve.now/CVE-2007-5793.md): Stonesoft StoneGate IPS before 4.0 does not properly decode Fullwidth/Halfwidth Unicode encoded data, which makes it easier for remote attac (no CVSS)
- [CVE-2007-5771](https://cve.now/CVE-2007-5771.md): Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie. (no CVSS)
- [CVE-2007-5772](https://cve.now/CVE-2007-5772.md): Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitra (no CVSS)
- [CVE-2007-5773](https://cve.now/CVE-2007-5773.md): Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform cer (no CVSS)
- [CVE-2007-5774](https://cve.now/CVE-2007-5774.md): index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invalid argumentname param (no CVSS)
- [CVE-2007-5775](https://cve.now/CVE-2007-5775.md): Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024. (CVSS 9.8)
- [CVE-2007-5776](https://cve.now/CVE-2007-5776.md): Directory traversal vulnerability in igallery.asp in Blue-Collar Productions i-Gallery 3.4 allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2007-5777](https://cve.now/CVE-2007-5777.md): Blue-Collar Productions i-Gallery 3.4 stores sensitive information under the web root with insufficient access control, which allows remote (no CVSS)
- [CVE-2007-5778](https://cve.now/CVE-2007-5778.md): Mobile Spy (1) stores login credentials in cleartext under the RetinaxStudios registry key, and (2) sends login credentials and log data ove (no CVSS)
- [CVE-2007-5779](https://cve.now/CVE-2007-5779.md): Buffer overflow in the GomManager (GomWeb Control) ActiveX control in GomWeb3.dll 1.0.0.12 in Gretech Online Movie Player (GOM Player) 2.1.6 (no CVSS)
- [CVE-2007-5780](https://cve.now/CVE-2007-5780.md): PHP remote file inclusion vulnerability in pub/pub08\_comments.php in teatro 1.6 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-5781](https://cve.now/CVE-2007-5781.md): PHP remote file inclusion vulnerability in inc/sige\_init.php in Sige 0.1 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-5782](https://cve.now/CVE-2007-5782.md): Directory traversal vulnerability in dl.php in FireConfig 0.5 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-5783](https://cve.now/CVE-2007-5783.md): SQL injection vulnerability in emc.asp in emagiC CMS.Net 4.0 allows remote attackers to execute arbitrary SQL commands via the pageId parame (no CVSS)
- [CVE-2007-5784](https://cve.now/CVE-2007-5784.md): PHP remote file inclusion vulnerability in index.php in CaupoShop Pro 2.x allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-5785](https://cve.now/CVE-2007-5785.md): SQL injection vulnerability in file.php in JobSite Professional 2.0 allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2007-5786](https://cve.now/CVE-2007-5786.md): Multiple PHP remote file inclusion vulnerabilities in GoSamba 1.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the in (no CVSS)
- [CVE-2007-5787](https://cve.now/CVE-2007-5787.md): Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to do (no CVSS)
- [CVE-2007-5788](https://cve.now/CVE-2007-5788.md): Buffer overflow in the SIP parser on the Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a cr (no CVSS)
- [CVE-2007-5789](https://cve.now/CVE-2007-5789.md): The Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a flood of fragmented packets to port 506 (no CVSS)
- [CVE-2007-5790](https://cve.now/CVE-2007-5790.md): The Globe7 soft phone client 7.3 uses weak cryptography (reversed sequence of binary values) for the password, which might allow local users (no CVSS)
- [CVE-2007-5791](https://cve.now/CVE-2007-5791.md): The Vonage Motorola Phone Adapter VT 2142-VD does not properly verify that a SIP INVITE message originated from a legitimate server, which a (no CVSS)
- [CVE-2007-5792](https://cve.now/CVE-2007-5792.md): The Vonage Motorola Phone Adapter VT 2142-VD does not encrypt RTP packets, which might allow remote attackers to eavesdrop by sniffing the n (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.