Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2007

50 records · 1 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-0656
    35Monitor

    PHP remote file inclusion vulnerability in includes/functions.php in phpBB2-MODificat 0.2.0 and earlier allows remote attackers to execute a

    HighCVSS 7.5Proof of conceptEPSS 16%

    phpbb2-modificat · phpbb2-modificatFeb 1, 2007

  • CVE-2007-0671
    78This week

    Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assist

    HighCVSS 8.8KEVWeaponizedEPSS 43%

    microsoft · accessFeb 2, 2007

  • CVE-2007-0674
    33Monitor

    Pictures and Videos on Windows Mobile 5.0 and Windows Mobile 2003 and 2003SE for Smartphones and PocketPC allows user-assisted remote attack

    HighCVSS 7.1No exploitEPSS 16%

    microsoft · windows mobileFeb 2, 2007

  • CVE-2007-0675
    35Monitor

    A certain ActiveX control in sapi.dll (aka the Speech API) in Speech Components in Microsoft Windows Vista, when the Speech Recognition feat

    HighCVSS 7.6No exploitEPSS 17%

    microsoft · windows vistaFeb 2, 2007

  • CVE-2007-0785
    51Plan

    PHP remote file inclusion vulnerability in previewtheme.php in Flipsource Flip 2.01-final 1.0 and earlier allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 68%

    flipsource · flipFeb 6, 2007

  • CVE-2007-0796
    34Monitor

    Blue Coat Systems WinProxy 6.1a and 6.0 r1c, and possibly earlier, allows remote attackers to cause a denial of service (daemon crash) or po

    HighCVSS 7.5No exploitEPSS 12%

    bluecoat · winproxyFeb 6, 2007

  • CVE-2007-0811
    22Monitor

    Microsoft Internet Explorer 6.0 SP1 on Windows 2000, and 6.0 SP2 on Windows XP, allows remote attackers to cause a denial of service (NULL p

    MediumCVSS 4.3Proof of conceptEPSS 18%

    microsoft · ieFeb 7, 2007

  • CVE-2007-0816
    23Monitor

    The RPC Server service (catirpc.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 SP2 and earlier allows remote atta

    MediumCVSS 5.0Proof of conceptEPSS 11%

    broadcom · brightstor arcserve backupFeb 7, 2007

  • CVE-2007-0446
    53Plan

    Stack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent 8.0 and 8.1, Performance Center Agent 8.0 and 8.1

    CriticalCVSS 10.0No exploitEPSS 44%

    hp · mercury loadrunner agentFeb 8, 2007

  • CVE-2007-0870
    36Monitor

    Unspecified vulnerability in Microsoft Word 2000 allows remote attackers to cause a denial of service (crash) via unknown vectors, a differe

    HighCVSS 7.6No exploitEPSS 21%

    microsoft · wordFeb 11, 2007

  • CVE-2007-0878
    37Monitor

    Unspecified vulnerability in Microsoft Internet Explorer on Windows Mobile 5.0 allows remote attackers to cause a denial of service (loss of

    HighCVSS 7.8No exploitEPSS 20%

    microsoft · windows mobileFeb 12, 2007

  • CVE-2007-0882
    69This week

    Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "

    CriticalCVSS 10.0WeaponizedEPSS 98%

    sun · sunosFeb 12, 2007

  • CVE-2007-0887
    34Monitor

    axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial of service (NULL der

    HighCVSS 7.8Proof of conceptEPSS 10%

    gecad technologies · axigen mail serverFeb 12, 2007

  • CVE-2006-1311
    46Plan

    The RichEdit component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1; Office 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac; and

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · learning essentialsFeb 13, 2007

  • CVE-2006-3448
    48Plan

    Buffer overflow in the Step-by-Step Interactive Training in Microsoft Windows 2000 SP4, XP SP2 and Professional, and Server 2003 SP1 allows

    CriticalCVSS 9.3No exploitEPSS 36%

    microsoft · step-by-step interactive trainingFeb 13, 2007

  • CVE-2006-5270
    46Plan

    Integer overflow in the Microsoft Malware Protection Engine (mpengine.dll), as used by Windows Live OneCare, Antigen, Defender, and Forefron

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · antigenFeb 13, 2007

  • CVE-2007-0025
    48Plan

    The MFC component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 and Visual Studio .NET 2000, 2002 SP1, 2003, and 2003 SP1 allows user-

    CriticalCVSS 9.3No exploitEPSS 36%

    microsoft · visual studio .netFeb 13, 2007

  • CVE-2007-0026
    37Monitor

    The OLE Dialog component in Microsoft Windows 2000 SP4, XP SP2, and 2003 SP1 allows user-assisted remote attackers to execute arbitrary code

    HighCVSS 7.6No exploitEPSS 24%

    microsoft · windows 2000Feb 13, 2007

  • CVE-2007-0214
    45Plan

    The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execu

    CriticalCVSS 9.3No exploitEPSS 26%

    microsoft · windows 2000Feb 13, 2007

  • CVE-2007-0900
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in TagIt! Tagboard 2.1.B Build 2 and earlier, when register_globals is enabled, allow rem

    HighCVSS 7.5Proof of conceptEPSS 10%

    tagit · tagboardFeb 13, 2007

  • CVE-2007-0208
    46Plan

    Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac does not correctly check the p

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · officeFeb 13, 2007

  • CVE-2007-0209
    46Plan

    Microsoft Word in Office 2000 SP3, XP SP3, Office 2003 SP2, Works Suite 2004 to 2006, and Office 2004 for Mac allows user-assisted remote at

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · officeFeb 13, 2007

  • CVE-2006-4697
    46Plan

    Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from Imjpcksid.dll as ActiveX controls, which allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · windows 2000Feb 13, 2007

  • CVE-2007-0217
    58Plan

    The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow remote attackers to execute arbitrary code via an FTP

    CriticalCVSS 10.0Proof of conceptEPSS 58%

    microsoft · windows 2000Feb 13, 2007

  • CVE-2007-0219
    52Plan

    Microsoft Internet Explorer 5.01, 6, and 7 uses certain COM objects from (1) Msb1fren.dll, (2) Htmlmm.ocx, and (3) Blnmgrps.dll as ActiveX c

    CriticalCVSS 10.0No exploitEPSS 39%

    microsoft · windows 2000Feb 13, 2007

  • CVE-2007-0908
    24Monitor

    The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variabl

    MediumCVSS 5.0Proof of conceptEPSS 12%

    php · phpFeb 13, 2007

  • CVE-2007-0913
    41Plan

    Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · powerpointFeb 13, 2007

  • CVE-2007-0927
    43Plan

    Heap-based buffer overflow in uTorrent 1.6 allows remote attackers to execute arbitrary code via a torrent file with a crafted announce head

    HighCVSS 7.5Proof of conceptEPSS 44%

    utorrent · utorrentFeb 14, 2007

  • CVE-2007-0949
    45Plan

    Stack-based buffer overflow in iTinySoft Studio Total Video Player 1.03, and possibly earlier, allows remote attackers to execute arbitrary

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    itinysoft studio · total video playerFeb 14, 2007

  • CVE-2007-0977
    34Monitor

    IBM Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores HTTPPassword hashes from names.nsf in a manner acces

    HighCVSS 7.1WeaponizedEPSS 19%

    ibm · lotus dominoFeb 15, 2007

  • CVE-2007-0981
    34Monitor

    Mozilla based browsers, including Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8, allow remote attackers to bypa

    HighCVSS 7.5Proof of conceptEPSS 12%

    mozilla · firefoxFeb 15, 2007

  • CVE-2006-5276
    64This week

    Stack-based buffer overflow in the DCE/RPC preprocessor in Snort before 2.6.1.3, and 2.7 before beta 2; and Sourcefire Intrusion Sensor; all

    CriticalCVSS 10.0WeaponizedEPSS 79%

    snort · snortFeb 19, 2007

  • CVE-2007-0325
    48Plan

    Multiple buffer overflows in the Trend Micro OfficeScan Web-Deployment SetupINICtrl ActiveX control in OfficeScanSetupINI.dll, as used in Of

    CriticalCVSS 9.3WeaponizedEPSS 35%

    trend micro · client-server-messaging securityFeb 20, 2007

  • CVE-2007-1036
    55Plan

    The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attack

    HighCVSS 7.5WeaponizedEPSS 82%

    jboss · jboss application serverFeb 21, 2007

  • CVE-2007-1070
    62This week

    Multiple stack-based buffer overflows in Trend Micro ServerProtect for Windows and EMC 5.58, and for Network Appliance Filer 5.61 and 5.62,

    CriticalCVSS 10.0WeaponizedEPSS 72%

    trend micro · serverprotectFeb 21, 2007

  • CVE-2007-1061
    46Plan

    SQL injection vulnerability in index.php in Francisco Burzi PHP-Nuke 8.0 Final and earlier, when the "HTTP Referers" block is enabled, allow

    MediumCVSS 6.8Proof of conceptEPSS 61%

    francisco burzi · php-nukeFeb 21, 2007

  • CVE-2006-6490
    43Plan

    Multiple buffer overflows in the SupportSoft (1) SmartIssue (tgctlsi.dll) and (2) ScriptRunner (tgctlsr.dll) ActiveX controls, as used by Sy

    CriticalCVSS 10.0No exploitEPSS 10%

    supportsoft · scriptrunnerFeb 22, 2007

  • CVE-2007-1071
    37Monitor

    Integer overflow in the gifGetBandProc function in ImageIO in Apple Mac OS X 10.4.8 allows remote attackers to cause a denial of service (se

    HighCVSS 7.8Proof of conceptEPSS 18%

    apple · mac os xFeb 22, 2007

  • CVE-2006-7027
    45Plan

    Microsoft Internet Security and Acceleration (ISA) Server 2004 logs unusual ASCII characters in the Host header, including the tab, which al

    CriticalCVSS 10.0No exploitEPSS 15%

    microsoft · isa serverFeb 22, 2007

  • CVE-2006-7029
    24Monitor

    Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a frameset with only one fram

    MediumCVSS 5.0No exploitEPSS 12%

    microsoft · internet explorerFeb 22, 2007

  • CVE-2006-7030
    25Monitor

    Microsoft Internet Explorer 6 SP2 and earlier allows remote attackers to cause a denial of service (crash) via certain malformed HTML, possi

    MediumCVSS 5.0No exploitEPSS 17%

    microsoft · windows 2000Feb 22, 2007

  • CVE-2006-7031
    31Monitor

    Microsoft Internet Explorer 6.0.2900 SP2 and earlier allows remote attackers to cause a denial of service (crash) via a table element with a

    MediumCVSS 6.5Proof of conceptEPSS 18%

    microsoft · windows 2000Feb 22, 2007

  • CVE-2007-1085
    33Monitor

    Cross-site scripting (XSS) vulnerability in Google Desktop allows remote attackers to bypass protection schemes and inject arbitrary web scr

    HighCVSS 7.6Proof of conceptEPSS 11%

    google · desktopFeb 22, 2007

  • CVE-2007-1090
    33Monitor

    Microsoft Windows Explorer on Windows XP and 2003 allows remote user-assisted attackers to cause a denial of service (crash) via a malformed

    HighCVSS 7.1Proof of conceptEPSS 17%

    microsoft · windows 2003 serverFeb 26, 2007

  • CVE-2007-1091
    35Monitor

    Microsoft Internet Explorer 7 allows remote attackers to prevent users from leaving a site, spoof the address bar, and conduct phishing and

    MediumCVSS 6.8No exploitEPSS 25%

    microsoft · ieFeb 26, 2007

  • CVE-2007-1094
    37Monitor

    Microsoft Internet Explorer 7 allows remote attackers to cause a denial of service (NULL dereference and application crash) via JavaScript o

    HighCVSS 7.8No exploitEPSS 18%

    microsoft · internet explorerFeb 26, 2007

  • CVE-2007-0009
    42Plan

    Stack-based buffer overflow in the SSLv2 support in Mozilla Network Security Services (NSS) before 3.11.5, as used by Firefox before 1.5.0.1

    MediumCVSS 6.8No exploitEPSS 50%

    mozilla · firefoxFeb 26, 2007

  • CVE-2007-1114
    21Monitor

    The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an H

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · ieFeb 26, 2007

  • CVE-2007-1117
    45Plan

    Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspecified vecto

    CriticalCVSS 10.0No exploitEPSS 17%

    microsoft · publisherFeb 26, 2007

  • CVE-2007-1122
    30Monitor

    Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00 and 1.01 allow remote

    MediumCVSS 6.4No exploitEPSS 15%

    zephyrsoft toolbox · address book continuedFeb 26, 2007