Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2007

55 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-0015
    42Plan

    Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.

    MediumCVSS 6.8WeaponizedEPSS 48%

    apple · quicktimeJan 1, 2007

  • CVE-2007-0017
    31Monitor

    Multiple format string vulnerabilities in (1) the cdio_log_handler function in modules/access/cdda/access.c in the CDDA (libcdda_plugin) plu

    MediumCVSS 6.8Proof of conceptEPSS 12%

    videolan · vlc media playerJan 2, 2007

  • CVE-2007-0044
    34Monitor

    Adobe Acrobat Reader Plugin before 8.0.0 for the Firefox, Internet Explorer, and Opera web browsers allows remote attackers to force the bro

    MediumCVSS 4.3Proof of conceptEPSS 56%

    adobe · acrobatJan 3, 2007

  • CVE-2007-0045
    31Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Ad

    MediumCVSS 4.3No exploitEPSS 47%

    adobe · acrobatJan 3, 2007

  • CVE-2007-0046
    47Plan

    Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to ex

    HighCVSS 7.5Proof of conceptEPSS 56%

    adobe · acrobat readerJan 3, 2007

  • CVE-2007-0048
    30Monitor

    Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x

    MediumCVSS 5.0No exploitEPSS 33%

    adobe · acrobatJan 3, 2007

  • CVE-2007-0086
    34Monitor

    The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of servic

    HighCVSS 7.8No exploitEPSS 10%

    apache · http serverJan 5, 2007

  • CVE-2007-0087
    38Monitor

    Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to c

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · internet information serverJan 5, 2007

  • CVE-2007-0099
    45Plan

    Race condition in the msxml3 module in Microsoft XML Core Services 3.0, as used in Internet Explorer 6 and other applications, allows remote

    CriticalCVSS 9.3No exploitEPSS 25%

    microsoft · xml core servicesJan 8, 2007

  • CVE-2007-0103
    32Monitor

    The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly i

    MediumCVSS 6.8Proof of conceptEPSS 16%

    adobe · acrobat readerJan 8, 2007

  • CVE-2007-0105
    33Monitor

    Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engin

    HighCVSS 7.5No exploitEPSS 11%

    cisco · secure access control serverJan 8, 2007

  • CVE-2007-0107
    31Monitor

    WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote

    MediumCVSS 6.8Proof of conceptEPSS 11%

    wordpress · wordpressJan 8, 2007

  • CVE-2007-0126
    40Plan

    Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index b

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    opera · opera browserJan 8, 2007

  • CVE-2007-0134
    34Monitor

    Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, w

    HighCVSS 7.5Proof of conceptEPSS 11%

    igeneric · ig shopJan 9, 2007

  • CVE-2007-0027
    46Plan

    Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · excelJan 9, 2007

  • CVE-2007-0024
    50Plan

    Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000

    CriticalCVSS 9.3Proof of conceptEPSS 44%

    microsoft · windows 2000Jan 9, 2007

  • CVE-2007-0028
    47Plan

    Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which a

    CriticalCVSS 9.3No exploitEPSS 33%

    microsoft · excelJan 9, 2007

  • CVE-2007-0029
    46Plan

    Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · excelJan 9, 2007

  • CVE-2007-0030
    47Plan

    Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · excelJan 9, 2007

  • CVE-2007-0031
    50Plan

    Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attack

    CriticalCVSS 9.3Proof of conceptEPSS 42%

    microsoft · excelJan 9, 2007

  • CVE-2007-0033
    47Plan

    Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal me

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeJan 9, 2007

  • CVE-2007-0034
    48Plan

    Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers

    CriticalCVSS 9.3No exploitEPSS 37%

    microsoft · officeJan 9, 2007

  • CVE-2007-0167
    33Monitor

    Multiple PHP file inclusion vulnerabilities in WGS-PPC (aka PPC Search Engine), as distributed with other aliases, allow remote attackers to

    HighCVSS 7.5Proof of conceptEPSS 10%

    ppc search engine · ppc search engineJan 9, 2007

  • CVE-2007-0168
    36Monitor

    The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Busi

    HighCVSS 7.5Proof of conceptEPSS 20%

    broadcom · brightstor arcserve backupJan 11, 2007

  • CVE-2007-0169
    51Plan

    Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Bu

    HighCVSS 7.5WeaponizedEPSS 70%

    broadcom · brightstor arcserve backupJan 11, 2007

  • CVE-2007-0233
    34Monitor

    wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a va

    HighCVSS 7.5Proof of conceptEPSS 11%

    wordpress · wordpressJan 12, 2007

  • CVE-2007-0236
    47Plan

    Double free vulnerability in the _ATPsndrsp function in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to cause

    CriticalCVSS 10.0Proof of conceptEPSS 21%

    apple · mac os xJan 16, 2007

  • CVE-2007-0247
    26Monitor

    squid/src/ftp.c in Squid before 2.6.STABLE7 allows remote FTP servers to cause a denial of service (core dump) via crafted FTP directory lis

    MediumCVSS 5.0Proof of conceptEPSS 20%

    squid · squidJan 16, 2007

  • CVE-2006-5171
    45Plan

    Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5, E

    CriticalCVSS 10.0No exploitEPSS 16%

    ca · protection suitesJan 16, 2007

  • CVE-2006-5172
    45Plan

    Stack-based buffer overflow in the RPC interface in Mediasvr.exe in Computer Associates (CA) Brightstor ARCserve Backup 9.01 through 11.5, E

    CriticalCVSS 10.0No exploitEPSS 15%

    ca · protection suitesJan 16, 2007

  • CVE-2007-0256
    35Monitor

    VideoLAN VLC 0.8.6a allows remote attackers to cause a denial of service (application crash) via a crafted .wmv file.

    HighCVSS 7.8Proof of conceptEPSS 11%

    videolan · vlc media playerJan 16, 2007

  • CVE-2007-0222
    24Monitor

    Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read

    MediumCVSS 5.0No exploitEPSS 13%

    oracle · application serverJan 16, 2007

  • CVE-2007-0243
    30Monitor

    Buffer overflow in Sun JDK and Java Runtime Environment (JRE) 5.0 Update 9 and earlier, SDK and JRE 1.4.2_12 and earlier, and SDK and JRE 1.

    MediumCVSS 6.8Proof of conceptEPSS 11%

    sun · jdkJan 17, 2007

  • CVE-2007-0352
    48Plan

    Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a craft

    CriticalCVSS 9.3Proof of conceptEPSS 36%

    microsoft · html help workshopJan 18, 2007

  • CVE-2007-0356
    25Monitor

    The Common Controls Replacement Project (CCRP) FolderTreeview (FTV) ActiveX control (ccrpftv6.ocx) allows remote attackers to cause a denial

    MediumCVSS 5.0Proof of conceptEPSS 18%

    common controls replacement project · foldertreeview activex controlJan 18, 2007

  • CVE-2007-0373
    31Monitor

    Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword

    MediumCVSS 6.8No exploitEPSS 12%

    joomla · joomlaJan 19, 2007

  • CVE-2007-0021
    37Monitor

    Format string vulnerability in Apple iChat 3.1.6 allows remote attackers to cause a denial of service (null pointer dereference and applicat

    HighCVSS 7.5Proof of conceptEPSS 23%

    apple · ichatJan 22, 2007

  • CVE-2007-0427
    46Plan

    Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help

    CriticalCVSS 9.3Proof of conceptEPSS 31%

    microsoft · html help workshopJan 22, 2007

  • CVE-2007-0449
    64This week

    Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r

    CriticalCVSS 10.0WeaponizedEPSS 79%

    broadcom · brightstor arcserve backup laptops desktopsJan 23, 2007

  • CVE-2007-0468
    34Monitor

    Stack-based buffer overflow in rcdll.dll in msdev.exe in Visual C++ (MSVC) in Microsoft Visual Studio 6.0 SP6 allows user-assisted remote at

    MediumCVSS 6.8No exploitEPSS 24%

    microsoft · visual studioJan 23, 2007

  • CVE-2007-0018
    48Plan

    Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), as used by multiple products, allows remote

    CriticalCVSS 9.3WeaponizedEPSS 36%

    altdo · convert mp3 masterJan 24, 2007

  • CVE-2007-0444
    32Monitor

    Stack-based buffer overflow in the print provider library (cpprov.dll) in Citrix Presentation Server 4.0, MetaFrame Presentation Server 3.0,

    HighCVSS 7.2Proof of conceptEPSS 13%

    citrix · metaframeJan 24, 2007

  • CVE-2007-0493
    35Monitor

    Use-after-free vulnerability in ISC BIND 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum

    HighCVSS 7.8No exploitEPSS 12%

    isc · bindJan 25, 2007

  • CVE-2007-0494
    30Monitor

    ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum

    MediumCVSS 4.3No exploitEPSS 44%

    isc · bindJan 25, 2007

  • CVE-2007-0515
    49Plan

    Unspecified vulnerability in Microsoft Word allows user-assisted remote attackers to execute arbitrary code on Word 2000, and cause a denial

    CriticalCVSS 9.3Proof of conceptEPSS 38%

    microsoft · officeJan 25, 2007

  • CVE-2006-6956
    20Monitor

    Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nest

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerJan 29, 2007

  • CVE-2007-0463
    25Monitor

    Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (applicat

    MediumCVSS 5.0Proof of conceptEPSS 17%

    apple · software updateJan 29, 2007

  • CVE-2007-0561
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the

    HighCVSS 7.5Proof of conceptEPSS 10%

    xero portal · xero portalJan 30, 2007

  • CVE-2007-0562
    21Monitor

    Windows Explorer (explorer.exe) 6.0.2900.2180 in Microsoft Windows XP SP2 allows user-assisted remote attackers to cause a denial of service

    MediumCVSS 4.3Proof of conceptEPSS 13%

    microsoft · windows explorerJan 30, 2007

  • CVE-2007-0455
    34Monitor

    Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a den

    HighCVSS 7.5No exploitEPSS 11%

    gd graphics library project · gd graphics libraryJan 30, 2007

  • CVE-2007-0464
    24Monitor

    The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause

    MediumCVSS 5.0Proof of conceptEPSS 14%

    apple · mac os xJan 30, 2007

  • CVE-2007-0584
    51Plan

    PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote att

    HighCVSS 7.5Proof of conceptEPSS 70%

    g-neric · php generic library and frameworkJan 30, 2007

  • CVE-2007-0465
    36Monitor

    Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via

    HighCVSS 7.6Proof of conceptEPSS 18%

    apple · installerJan 30, 2007

  • CVE-2007-0612
    44Plan

    Multiple ActiveX controls in Microsoft Windows 2000, XP, 2003, and Vista allows remote attackers to cause a denial of service (Internet Expl

    HighCVSS 7.8Proof of conceptEPSS 43%

    microsoft · ieJan 31, 2007

  • CVE-2007-0646
    31Monitor

    Format string vulnerability in iMovie HD 6.0.3, and Safari in Apple Mac OS X 10.4 through 10.4.10, allows remote user-assisted attackers to

    HighCVSS 7.1Proof of conceptEPSS 10%

    apple · mac os xJan 31, 2007