CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-2982 Exec Code Overflow 2007-05-31 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Multiple buffer overflows in the British Telecommunications Business Connect webhelper ActiveX control before 1.0.0.7 in btbconnectwebcontrol.dll allow remote attackers to execute arbitrary code via unspecified vectors.
2 CVE-2007-2981 119 Exec Code Overflow 2007-05-31 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Buffer overflow in a certain ActiveX control in LEAD Technologies LEADTOOLS Raster OCR Document Object Library (ltrdc14e.dll) 14.5.0.44 allows remote attackers to execute arbitrary code via a long DictionaryFileName property.
3 CVE-2007-2980 119 DoS Exec Code Overflow 2007-05-31 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in a certain ActiveX control in LEADTOOLS LEAD Raster ISIS Object (LTRIS14e.DLL) 14.5.0.44 allows remote attackers to cause a denial of service (Internet Explorer crash) or execute arbitrary code via a long DriverName property, a different ActiveX control than CVE-2007-2827.
4 CVE-2007-2979 2007-05-31 2012-10-30
7.8
 None Remote Low Not required Complete None None
Techno Dreams Web Directory / Search Engine 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database.mdb.
5 CVE-2007-2978 59 2007-05-31 2009-01-20
6.8
 User Remote Medium Not required Partial Partial Partial
Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
6 CVE-2007-2977 DoS Overflow 2007-05-31 2008-11-15
7.8
 None Remote Low Not required None None Complete
Buffer overflow in the receive function in submit/submitcommon.c in the submit daemon in DOMjudge before 2.0.0RC1 allows remote attackers to cause a denial of service or have other unspecified impact. NOTE: some of these details are obtained from third party information.
7 CVE-2007-2976 XSS 2007-05-31 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Centrinity FirstClass 8.3 and earlier, and Server and Internet Services 8.0 and earlier, do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS) attacks. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
8 CVE-2007-2975 264 Exec Code +Priv 2007-05-31 2008-09-10
7.5
 User Remote Low Not required Partial Partial Partial
The admin console in Ignite Realtime Openfire 3.3.0 and earlier (formerly Wildfire) does not properly specify a filter mapping in web.xml, which allows remote attackers to gain privileges and execute arbitrary code by accessing functionality that is exposed through DWR, as demonstrated using the downloader.
9 CVE-2007-2974 Exec Code Overflow 2007-05-31 2008-11-15
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the file parsing engine in Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to execute arbitrary code via a crafted LZH archive file, resulting from an "integer cast around."
10 CVE-2007-2973 DoS 2007-05-31 2008-11-15
7.8
 None Remote Low Not required None None Complete
Avira Antivir Antivirus before 7.03.00.09 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed TAR archive.
11 CVE-2007-2972 DoS 2007-05-31 2012-10-30
7.8
 None Remote Low Not required None None Complete
The file parsing engine in Avira Antivir Antivirus before 7.04.00.24 allows remote attackers to cause a denial of service (application crash) via a crafted UPX compressed file, which triggers a divide-by-zero error.
12 CVE-2007-2971 Exec Code Sql 2007-05-31 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in getnewsitem.php in gCards 1.46 and earlier allows remote attackers to execute arbitrary SQL commands via the newsid parameter.
13 CVE-2007-2970 XSS 2007-05-31 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in cgi/block.cgi in 8e6 R3000 Internet Filter allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) CAT, and (3) USER parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
14 CVE-2007-2969 1 Exec Code File Inclusion 2007-05-31 2012-10-30
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the waroot parameter.
15 CVE-2007-2968 XSS 2007-05-31 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in register.php in cpCommerce 1.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter (Full Name field).
16 CVE-2007-2967 20 DoS 2007-05-31 2012-10-30
10.0
 Admin Remote Low Not required Complete Complete Complete
Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070522 allow remote attackers to cause a denial of service (file scanning infinite loop) via certain crafted (1) ARJ archives or (2) FSG packed files.
17 CVE-2007-2966 119 DoS Exec Code Overflow 2007-05-31 2012-10-30
7.5
 User Remote Low Not required Partial Partial Partial
Buffer overflow in the LHA decompresion component in F-Secure anti-virus products for Microsoft Windows and Linux before 20070529 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted LHA archive, related to an integer wrap, a similar issue to CVE-2006-4335.
18 CVE-2007-2965 +Priv 2007-05-31 2012-10-30
7.2
 Admin Local Low Not required Complete Complete Complete
Unspecified vulnerability in the Real-time Scanning component in multiple F-Secure products, including Internet Security 2005, 2006 and 2007; Anti-Virus 2005, 2006 and 2007; and Solutions based on F-Secure Protection Service for Consumers 6.40 and earlier allows local users to gain privileges via a crafted I/O request packet (IRP), related to IOCTL (Input/Output Control) and "access validation of the address space."
19 CVE-2007-2964 DoS 2007-05-31 2012-10-30
5.0
 None Remote Low Not required None None Partial
The fsmsh.dll host module in F-Secure Policy Manager Server 7.00 and earlier allows remote attackers to cause a denial of service (application crash) via NTFS reserved words in filenames in URLs.
20 CVE-2007-2963 XSS 2007-05-31 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB or IP.Board) 2.2.2, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via (1) module_bbcodeloader.php, (2) module_div.php, (3) module_email.php, (4) module_image.php, (5) module_link.php, or (6) the editorid parameter to module_table.php in jscripts/folder_rte_files/. NOTE: some details were obtained from third party sources.
21 CVE-2007-2962 XSS 2007-05-31 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in search.php in Particle Gallery 1.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the order parameter.
22 CVE-2007-2961 2007-05-31 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Unrestricted file upload vulnerability in FileCloset before 1.1.5 allows remote attackers to upload arbitrary PHP files via unspecified vectors.
23 CVE-2007-2960 Dir. Trav. 2007-05-31 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in Scallywag 2005-04-25 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin_name parameter to template.php in (1) skin/dark/, (2) skin/gold/, or (3) skin/original/, a different vector than CVE-2007-2900. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
24 CVE-2007-2959 Exec Code Sql 2007-05-31 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in manufacturer.php in cpCommerce before 1.1.0 allows remote attackers to execute arbitrary SQL commands via the id_manufacturer parameter.
25 CVE-2007-2947 1 Exec Code File Inclusion 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in OpenBASE Alpha 0.6 allow remote attackers to execute arbitrary PHP code via a URL in the root_prefix parameter to (1) index.php, (2) email_subscribe.php, (3) download.php, or (4) development.php.
26 CVE-2007-2946 1 DoS Exec Code Overflow 2007-05-30 2008-11-15
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in a certain ActiveX control in LeadTools Raster Dialog File_D Object (LTRDFD14e.DLL) 14.5.0.44 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) or execute arbitrary code via a long DestinationPath property value.
27 CVE-2007-2945 2007-05-30 2008-11-15
5.0
 None Remote Low Not required Partial None None
RMForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for rmforum.mdb.
28 CVE-2007-2944 264 2007-05-30 2008-11-15
5.0
 None Remote Low Not required Partial None None
WabCMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/wabcmsn.mdb. NOTE: this issue was originally reported for "webCMS," but this was an error by an unreliable researcher.
29 CVE-2007-2943 1 Exec Code File Inclusion 2007-05-30 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
PHP remote file inclusion vulnerability in class/class.php in Webavis 0.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
30 CVE-2007-2942 1 Exec Code Sql 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in user.php in My Little Forum 1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
31 CVE-2007-2941 1 Exec Code File Inclusion 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in the creator in vBulletin Google Yahoo Site Map (vBGSiteMap) 2.41 for vBulletin allow remote attackers to execute arbitrary PHP code via a URL in the base parameter to (1) vbgsitemap/vbgsitemap-config.php or (2) vbgsitemap/vbgsitemap-vbseo.php.
32 CVE-2007-2940 1 Exec Code File Inclusion 2007-05-30 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in FlaP 1.0b (1.0 Beta) allow remote attackers to execute arbitrary PHP code via a URL in the pachtofile parameter to (1) skin/html/table.php or (2) login.php.
33 CVE-2007-2939 1 Exec Code File Inclusion 2007-05-30 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Mazen's PHP Chat 3.0.0 allow remote attackers to execute arbitrary PHP code via a URL in the basepath parameter to (1) ITX.php, (2) IT_Error.php, or (3) IT.php in include/pear/.
34 CVE-2007-2938 1 Exec Code Overflow 2007-05-30 2008-11-15
10.0
 Admin Remote Low Not required Complete Complete Complete
Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6, when Internet Explorer 6 is used, allows remote attackers to execute arbitrary code via a long argument to the (1) Send485CMD method, and possibly the (2) SetLoginID, (3) AddSite, (4) SetScreen, and (5) SetVideoServer methods.
35 CVE-2007-2937 1 Exec Code File Inclusion 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the site_url parameter.
36 CVE-2007-2936 1 Exec Code File Inclusion 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in Frequency Clock 0.1b (Beta 0.1) allow remote attackers to execute arbitrary PHP code via a URL in the securelib parameter to (1) conf.php or (2) cp2.php.
37 CVE-2007-2935 1 Exec Code 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
core/spellcheck/spellcheck.php in Fundanemt before 2.2.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dict parameter.
38 CVE-2007-2934 1 Dir. Trav. 2007-05-30 2008-11-15
7.8
 None Remote Low Not required Complete None None
Directory traversal vulnerability in skins/common.css.php in Vistered Little 1.6a allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter.
39 CVE-2007-2933 1 Exec Code Sql 2007-05-30 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the form_id parameter.
40 CVE-2007-2932 XSS 2007-05-30 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in BoastMachine allows remote attackers to inject arbitrary web script or HTML via the blog parameter in a content search action.
41 CVE-2007-2918 DoS Exec Code Overflow 2007-05-31 2008-11-15
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) StarClient.dll, (4) ComLink in (c) uicomlink.dll, and (5) WebCamXMP in (d) wcamxmp.dll in Logitech VideoCall allow remote attackers to cause a denial of service (browser crash) and execute arbitrary code via unspecified vectors.
42 CVE-2007-2917 Exec Code Overflow 2007-05-31 2008-11-15
9.3
 Admin Remote Medium Not required Complete Complete Complete
Multiple buffer overflows in a certain ActiveX control in odapi.dll in Authentium Command Antivirus before 4.93.8 allow remote attackers to execute arbitrary code via unspecified vectors.
43 CVE-2007-2916 XSS 2007-05-30 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in showown.php in GMTT Music Distro 1.2 allows remote attackers to inject arbitrary web script or HTML via the st parameter.
44 CVE-2007-2915 XSS 2007-05-30 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the title field in an email.
45 CVE-2007-2914 XSS 2007-05-30 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in PsychoStats 3.0.6b allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) awards.php, (2) login.php, (3) register.php, (4) weapons.php, and possibly other unspecified files.
46 CVE-2007-2913 XSS 2007-05-30 2008-11-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in ClonusWiki .5 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
47 CVE-2007-2912 2007-05-30 2008-11-15
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user.
48 CVE-2007-2911 Exec Code Sql 2007-05-30 2008-11-13
8.5
 Admin Remote Medium Single system Complete Complete Complete
SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin before 3.6.6 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached After" field (GPC['search']['datelineafter'] variable), a related issue to CVE-2007-1573.
49 CVE-2007-2910 79 XSS 2007-05-30 2012-11-05
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_367_xss_fix_plugin.xml update, a related issue to CVE-2007-2909.
50 CVE-2007-2909 XSS 2007-05-30 2012-11-05
3.5
 None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb_calendar366_xss_fix_plugin.xml update.
Total number of vulnerabilities : 589   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.