CVE-2007-5601

Public exploit
Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions including 10, RealOne Player, and RealOne Player 2, allows remote attackers to execute arbitrary code via certain playlist names, as demonstrated via the import method to the IERPCtl ActiveX control in ierpplug.dll.
Max CVSS
9.3
EPSS Score
96.16%
Published
2007-10-20
Updated
2017-07-29

CVE-2007-5511

Public exploit
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. NOTE: this is probably covered by CVE-2007-5510, but there are insufficient details to be certain.
Max CVSS
6.5
EPSS Score
97.48%
Published
2007-10-17
Updated
2018-10-15

CVE-2007-5423

Public exploit
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.
Max CVSS
7.5
EPSS Score
96.25%
Published
2007-10-12
Updated
2018-10-15

CVE-2007-5244

Public exploit
Stack-based buffer overflow in Borland InterBase LI 8.0.0.53 through 8.1.0.253 on Linux, and possibly unspecified versions on Solaris, allows remote attackers to execute arbitrary code via a long attach request on TCP port 3050 to the open_marker_file function.
Max CVSS
9.3
EPSS Score
63.25%
Published
2007-10-06
Updated
2017-07-29

CVE-2007-5243

Public exploit
Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote attackers to execute arbitrary code via (1) a long service attach request on TCP port 3050 to the (a) SVC_attach or (b) INET_connect function, (2) a long create request on TCP port 3050 to the (c) isc_create_database or (d) jrd8_create_database function, (3) a long attach request on TCP port 3050 to the (e) isc_attach_database or (f) PWD_db_aliased function, or unspecified vectors involving the (4) jrd8_attach_database or (5) expand_filename2 function.
Max CVSS
9.3
EPSS Score
48.58%
Published
2007-10-06
Updated
2017-07-29

CVE-2007-5217

Public exploit
Stack-based buffer overflow in the ADM4 ActiveX control in adm4.dll in Altnet Download Manager 4.0.0.6, as used in (1) Kazaa 3.2.7 and (2) Grokster, allows remote attackers to execute arbitrary code via a long argument to the Install method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Max CVSS
6.8
EPSS Score
68.22%
Published
2007-10-05
Updated
2017-07-29

CVE-2007-5208

Public exploit
hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.
Max CVSS
7.6
EPSS Score
22.32%
Published
2007-10-13
Updated
2018-10-03

CVE-2007-5082

Public exploit
Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to execute arbitrary code via unspecified CsAgent service commands with certain opcodes, related to missing validation of a length parameter.
Max CVSS
10.0
EPSS Score
80.47%
Published
2007-10-01
Updated
2021-04-07

CVE-2007-5003

Public exploit
Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 allow remote attackers to execute arbitrary code via a long (1) username or (2) password to the rxrLogin command in rxRPC.dll, or a long (3) username argument to the GetUserInfo function.
Max CVSS
10.0
EPSS Score
94.52%
Published
2007-10-01
Updated
2021-04-08

CVE-2007-4466

Public exploit
Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbitrary code via unspecified methods and parameters.
Max CVSS
6.8
EPSS Score
89.14%
Published
2007-10-09
Updated
2017-07-29
The Globe7 soft phone client 7.3 sends username and password information in cleartext, which allows remote attackers to obtain sensitive information by sniffing the HTTP traffic.
Max CVSS
5.0
EPSS Score
0.23%
Published
2007-10-31
Updated
2008-11-15
PHP remote file inclusion vulnerability in urlinn_includes/config.php in phpFaber URLInn 2.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the dir_ws parameter.
Max CVSS
6.8
EPSS Score
2.47%
Published
2007-10-31
Updated
2017-09-29
Unspecified vulnerability in Light FMan PHP (lfman or lightfman) before 2.0rc1 has unknown impact and attack vectors related to "actions."
Max CVSS
7.5
EPSS Score
0.44%
Published
2007-10-31
Updated
2017-07-29
adduser.php in PHP-AGTC Membership (AGTC-Membership) System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin (userlevel 4) privileges.
Max CVSS
7.5
EPSS Score
4.68%
Published
2007-10-31
Updated
2018-10-15
Liferea before 1.4.6 uses weak permissions (0644) for the feedlist.opml backup file, which allows local users to obtain credentials.
Max CVSS
2.1
EPSS Score
0.04%
Published
2007-10-31
Updated
2017-07-29
The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbitrary code via an IMAP tag with a null byte followed by a format string specifier, which is not counted by the mechanism.
Max CVSS
7.5
EPSS Score
26.86%
Published
2007-10-31
Updated
2018-10-15
Directory traversal vulnerability in component/flashupload/download.jsp in the FlashUpload component in Korean GHBoard allows remote attackers to read arbitrary files via a .. (dot dot) in the name parameter.
Max CVSS
5.0
EPSS Score
1.03%
Published
2007-10-30
Updated
2018-10-15
The FlashUpload component in Korean GHBoard uses a client-side protection mechanism to prevent uploading of dangerous file extensions, which allows remote attackers to bypass restrictions and upload arbitrary files via a modified copy of component/flashupload/upload.html.
Max CVSS
6.8
EPSS Score
0.68%
Published
2007-10-30
Updated
2018-10-15
Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspecified vectors, probably involving a direct request.
Max CVSS
7.5
EPSS Score
0.71%
Published
2007-10-30
Updated
2018-10-15
Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors. NOTE: these files are stored with .html extensions, so the scope of the attack might be limited to resource consumption and possibly XSS.
Max CVSS
6.4
EPSS Score
0.32%
Published
2007-10-30
Updated
2018-10-15
eFileMan 7.1.0.87-88 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain unspecified user information via a direct request for cgi-bin/efileman/efileman_config.pm.
Max CVSS
5.0
EPSS Score
0.34%
Published
2007-10-30
Updated
2018-10-15
Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files, with "uploads/upload_file." destination filenames, via unspecified vectors to upload.cgi, accessed from upload.html.
Max CVSS
6.4
EPSS Score
0.42%
Published
2007-10-30
Updated
2018-10-15
Unrestricted file upload vulnerability in upload/upload.php in Japanese PHP Gallery Hosting, when Open directory mode is enabled, allows remote attackers to upload and execute arbitrary PHP code via a ServerPath parameter specifying a filename with a double extension. NOTE: some of these details are obtained from third party information.
Max CVSS
7.5
EPSS Score
1.05%
Published
2007-10-30
Updated
2018-10-15
Directory traversal vulnerability in downloadfile.php in eLouai's Force Download of media files script, as available on 20071030 and earlier, allows remote attackers to read arbitrary files via the file parameter. NOTE: this issue only occurs in environments where the system administrator has not followed the vendor recommendations that this product should only be used internally.
Max CVSS
5.0
EPSS Score
0.36%
Published
2007-10-30
Updated
2018-10-15
Absolute path traversal vulnerability in Apache Jakarta Slide 2.1 and earlier allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag, a related issue to CVE-2007-5461.
Max CVSS
3.5
EPSS Score
0.32%
Published
2007-10-30
Updated
2017-09-29
546 vulnerabilities found
1 2 3 4 5 6 ...... 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!