CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Published In August 2007

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2007-4649 264 +Priv 2007-08-31 2017-07-29
7.2
 None Local Low Not required Complete Complete Complete
MicroWorld eScan Virus Control 9.0.722.1, Anti-Virus 9.0.722.1, and Internet Security 9.0.722.1 use weak permissions (Everyone:Full Control) for their installation directory trees, which allows local users to gain privileges by replacing application files, as demonstrated by traysser.exe.
2 CVE-2007-4648 119 Overflow +Priv 2007-08-31 2018-10-15
7.2
 None Local Low Not required Complete Complete Complete
The nvcoaft51 driver in Norman Virus Control (NVC) 5.82 uses weak permissions (unrestricted write access) for the NvcOa device, which allows local users to gain privileges by (1) triggering a buffer overflow in a kernel pool via a string argument to ioctl 0xBF67201C; or by (2) sending a crafted KEVENT structure through ioctl 0xBF672028 to overwrite arbitrary memory locations.
3 CVE-2007-4647 264 2007-08-31 2017-09-29
5.0
 None Remote Low Not required None Partial None
newswire/uploadmedia.cgi in 2coolcode Our Space (Ourspace) 2.0.9 allows remote attackers to upload certain files via unspecified vectors, probably involving unrestricted functionality in uploadmedia.cgi.
4 CVE-2007-4646 94 DoS Exec Code Overflow 2007-08-31 2017-09-29
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the pop3 service in Hexamail Server 3.0.0.001 Lite allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long USER command.
5 CVE-2007-4645 94 Exec Code Sql 2007-08-31 2017-09-29
6.4
 None Remote Low Not required Partial Partial None
SQL injection vulnerability in index.php in NMDeluxe 2.0.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a newspost do action, a different vulnerability than CVE-2006-1108.
6 CVE-2007-4644 94 Exec Code 2007-08-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
Format string vulnerability in the Cl_GetPackets function in cl_main.c in the client in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows remote Doomsday servers to execute arbitrary code via format string specifiers in a PSV_CONSOLE_TEXT message.
7 CVE-2007-4643 119 DoS Overflow 2007-08-31 2018-10-15
5.0
 None Remote Low Not required None None Partial
Integer underflow in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via a PKT_CHAT packet with a data length less than 3, which triggers an erroneous malloc, possibly related to the Sv_HandlePacket function in sv_main.c.
8 CVE-2007-4642 119 DoS Exec Code Overflow 2007-08-31 2018-10-15
10.0
 None Remote Low Not required Complete Complete Complete
Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat (PKT_CHAT) message that is not properly handled by the (1) D_NetPlayerEvent function in d_net.c or the (2) Msg_Write function in net_msg.c, or (3) many commands that are not properly handled by the NetSv_ReadCommands function in d_netsv.c; or (4) cause a denial of service (daemon crash) via a chat (PKT_CHAT) message without a final '\0' character.
9 CVE-2007-4641 22 Exec Code Dir. Trav. 2007-08-31 2017-09-29
6.4
 None Remote Low Not required Partial Partial None
Directory traversal vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter, as demonstrated by injecting code into an Apache log file.
10 CVE-2007-4640 264 2007-08-31 2017-09-29
6.4
 None Remote Low Not required Partial Partial None
Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload and execute arbitrary PHP files in uploads/ via an Uploads action.
11 CVE-2007-4639 94 DoS Exec Code 2007-08-31 2018-10-15
6.5
 None Remote Low ??? Partial Partial Partial
EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which allows remote authenticated users to cause a denial of service (daemon crash) and possibly execute arbitrary code via a SELECT statement that invokes a pldbg_ function, as demonstrated by (1) pldbg_get_stack and (2) pldbg_abort_target, which triggers use of an uninitialized pointer.
12 CVE-2007-4638 DoS 2007-08-31 2018-10-15
4.3
 None Remote Medium Not required None None Partial
Blizzard Entertainment StarCraft Brood War 1.15.1 and earlier allows remote attackers to cause a denial of service (application crash) via a malformed map, which triggers an out-of-bounds read during a minimap preview.
13 CVE-2007-4637 2007-08-31 2017-09-29
6.4
 None Remote Low Not required Partial Partial None
xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspecified changes via an unknown series of steps.
14 CVE-2007-4636 20 Exec Code File Inclusion 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to (1) intern/admin/other/backup.php, (2) intern/admin/, (3) intern/clan/member_add.php, (4) intern/config/key_2.php, or (5) intern/config/forum.php.
15 CVE-2007-4635 119 DoS Overflow 2007-08-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Yahoo! Messenger 8.1.0.209 and 8.1.0.402 allows remote attackers to cause a denial of service (application crash) via certain file-transfer packets, possibly involving a buffer overflow, as demonstrated by ym8bug.exe. NOTE: this might be related to CVE-2007-4515. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
16 CVE-2007-4634 89 Exec Code Sql 2007-08-31 2017-07-29
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the (1) user or (2) admin logon page, aka CSCsi64265.
17 CVE-2007-4633 79 XSS 2007-08-31 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to inject arbitrary web script or HTML via the lang variable to the (1) user or (2) admin logon page, aka CSCsi10728.
18 CVE-2007-4632 287 Bypass 2007-08-31 2018-10-26
4.3
 None Local Network High Not required Partial Partial Partial
Cisco IOS 12.2E, 12.2F, and 12.2S places a "no login" line into the VTY configuration when an administrator makes certain changes to a (1) VTY/AUX or (2) CONSOLE setting on a device without AAA enabled, which allows remote attackers to bypass authentication and obtain a terminal session, a different vulnerability than CVE-1999-0293 and CVE-2005-2105.
19 CVE-2007-4631 59 Exec Code 2007-08-31 2017-07-29
6.9
 None Local Medium Not required Complete Complete Complete
The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames.
20 CVE-2007-4630 XSS 2007-08-31 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in xlaapmview.asp in Absolute Poll Manager XE 4.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
21 CVE-2007-4629 119 DoS Exec Code Overflow 2007-08-31 2016-06-15
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in the processLine function in maptemplate.c in MapServer before 4.10.3 allows attackers to cause a denial of service and possibly execute arbitrary code via a mapfile with a long layer name, group name, or metadata entry name.
22 CVE-2007-4628 Exec Code Sql 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in shownews.php in phpns 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
23 CVE-2007-4627 Exec Code Sql 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in ABC eStore 3.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
24 CVE-2007-4626 DoS 2007-08-31 2008-09-05
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in Polipo before 1.0.2 allows remote attackers to cause a denial of service (daemon crash) via certain network traffic associated with entities larger than 2 Gb.
25 CVE-2007-4625 DoS 2007-08-31 2017-07-29
4.3
 None Remote Medium Not required None None Partial
Polipo before 1.0.2 allows remote HTTP servers to cause a denial of service (daemon crash) by aborting the response to a POST request.
26 CVE-2007-4624 XSS 2007-08-31 2018-10-15
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in pframe.php in AbleDesign Dynamic Picture Frame 1.00 allows remote attackers to inject arbitrary web script or HTML via the img_url parameter. NOTE: some of these details are obtained from third party information.
27 CVE-2007-4618 399 DoS 2007-08-31 2018-10-26
7.8
 None Remote Low Not required None None Complete
Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7 and 7.0 Gold through SP7 allows remote attackers to cause a denial of service (disk consumption) via certain malformed HTTP headers.
28 CVE-2007-4617 399 DoS 2007-08-31 2018-10-26
7.8
 None Remote Low Not required None None Complete
Unspecified vulnerability in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP4 allows remote attackers to cause a denial of service (server thread hang) via unspecified vectors.
29 CVE-2007-4616 2007-08-31 2018-10-26
6.4
 None Remote Low Not required Partial Partial None
The SSL server implementation in BEA WebLogic Server 7.0 Gold through SP7, 8.1 Gold through SP6, 9.0, 9.1, 9.2 Gold through MP1, and 10.0 sometimes selects the null cipher when no other cipher is compatible between the server and client, which might allow remote attackers to intercept communications.
30 CVE-2007-4615 2007-08-31 2017-07-29
6.4
 None Remote Low Not required Partial Partial None
The SSL client implementation in BEA WebLogic Server 7.0 SP7, 8.1 SP2 through SP6, 9.0, 9.1, 9.2 Gold through MP2, and 10.0 sometimes selects the null cipher when others are available, which might allow remote attackers to intercept communications.
31 CVE-2007-4614 264 Bypass 2007-08-31 2008-11-13
7.5
 None Remote Low Not required Partial Partial Partial
BEA WebLogic Server 9.1 does not properly handle propagation of an admin server's security policy change log to temporarily unavailable managed servers, which might allow attackers to bypass intended restrictions, a different vulnerability than CVE-2007-0426.
32 CVE-2007-4613 310 2007-08-31 2018-10-26
6.8
 None Remote Medium Not required Partial Partial Partial
SSL libraries in BEA WebLogic Server 6.1 Gold through SP7, 7.0 Gold through SP7, and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response, a different vulnerability than CVE-2006-2461.
33 CVE-2007-4612 20 2007-08-31 2018-10-15
4.3
 None Remote Medium Not required Partial None None
CRLF injection vulnerability in contact.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to add arbitrary mail headers via CRLF sequences in the subject parameter. NOTE: this can be leveraged for spam by adding To or Cc headers.
34 CVE-2007-4611 89 Exec Code Sql 2007-08-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in viewevent.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to execute arbitrary SQL commands via the id parameter.
35 CVE-2007-4610 264 2007-08-31 2018-10-15
6.8
 None Remote Medium Not required Partial Partial Partial
Unrestricted file upload vulnerability in config/upload.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to upload and execute arbitrary PHP files in images/, possibly related to config/admin.php.
36 CVE-2007-4609 264 DoS 2007-08-31 2018-10-15
6.4
 None Remote Low Not required Partial None Partial
eyeOS uses predictable checksum values in the checknum parameter for access control, which allows remote attackers to register many accounts via doCreateUser actions, add many eyeBoard messages via addMsg actions, and cause a denial of service or conduct certain unauthorized activities, by guessing valid parameter values.
37 CVE-2007-4608 94 Exec Code File Inclusion 2007-08-31 2018-10-15
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in protection.php in ePersonnel RC_2004_02 allows remote attackers to execute arbitrary PHP code via a URL in the logout_page parameter.
38 CVE-2007-4607 119 Exec Code Overflow 2007-08-31 2018-08-28
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object, as used in Postcast Server Pro 3.0.61 and other products, allows remote attackers to execute arbitrary code via a long argument to the SubmitToExpress method, a different vulnerability than CVE-2007-1029. NOTE: this may have been fixed in version 6.0.3.15.
39 CVE-2007-4606 94 Exec Code File Inclusion 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in convert/mvcw_conver.php in the Virtual War (VWar) module for PHPNuke-Clan (PNC) 4.2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter, a different vector than CVE-2006-1602. NOTE: it is possible that this issue stems from a problem in VWar itself.
40 CVE-2007-4605 94 Exec Code File Inclusion 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
PHP remote file inclusion vulnerability in convert/mvcw.php in Virtual War (VWar) 1.5.0 R15 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the vwar_root parameter, a different vector than CVE-2006-1503, CVE-2006-1636, and CVE-2006-1747.
41 CVE-2007-4604 89 Exec Code Sql 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in viewitem.php in DL PayCart 1.01 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
42 CVE-2007-4603 89 Exec Code Sql 2007-08-31 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in ACG News 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the aid parameter in a showarticle action or (2) the catid parameter in a showcat action.
43 CVE-2007-4602 89 Exec Code Sql 2007-08-31 2017-09-29
6.8
 None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in cms/revert-content.php in Implied by Design Micro CMS (Micro-CMS) 3.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
44 CVE-2007-4601 264 Bypass 2007-08-30 2017-07-29
5.0
 None Remote Low Not required Partial None None
A regression error in tcp-wrappers 7.6.dbs-10 and 7.6.dbs-11 might allow remote attackers to bypass intended access restrictions when a service uses libwrap but does not specify server connection information.
45 CVE-2007-4598 255 2007-08-30 2008-11-15
4.6
 None Local Low Not required Partial Partial Partial
IBM SurePOS 500 has (1) a default password of "12345" for the manager and (2) blank default passwords for operator accounts.
46 CVE-2007-4597 89 Exec Code Sql 2007-08-30 2017-09-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in TurnkeyWebTools SunShop Shopping Cart 4.0 RC 6 allows remote attackers to execute arbitrary SQL commands via the s[cid] parameter in a search_list action, a different vector than CVE-2007-2549.
47 CVE-2007-4596 94 Exec Code 2007-08-30 2021-03-29
7.5
 None Remote Low Not required Partial Partial Partial
The perl extension in PHP does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code via the Perl eval function. NOTE: this might only be a vulnerability in limited environments.
48 CVE-2007-4595 79 XSS 2007-08-29 2017-07-29
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Mayaa before 1.1.12 allows remote attackers to inject arbitrary web script or HTML in certain circumstances involving (1) lack of charset specification within a META element or (2) a META element that specifies an unrecognized charset, which trigger automatic character set recognition by the web browser, as demonstrated by improper handling of UTF-7 data.
49 CVE-2007-4594 255 2007-08-29 2017-07-29
6.4
 None Remote Low Not required Partial Partial None
Entrust Entelligence Security Provider (ESP) 8 does not properly validate certificates in certain circumstances involving (1) a chain that omits the root Certification Authority (CA) certificate, or an application that specifies disregarding (2) unknown revocation statuses during path validation or (3) certain errors in the certification path, which might allow context-dependent attackers to spoof certificate authentication. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
50 CVE-2007-4593 DoS 2007-08-29 2008-11-15
6.9
 None Local Medium Not required Complete Complete Complete
Unspecified vulnerability in vstor2-ws60.sys in VMWare Workstation 6.0 allows local users to cause a denial of service (host operating system crash) via unspecified vectors, as demonstrated by the DC2 test suite, possibly a related issue to CVE-2007-4591. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Total number of vulnerabilities : 522   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.