Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2007

67 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2006-7065
    26Monitor

    Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL style

    MediumCVSS 5.0Proof of conceptEPSS 20%

    microsoft · ieMar 2, 2007

  • CVE-2006-7066
    35Monitor

    Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating an object inside an

    HighCVSS 7.1Proof of conceptEPSS 22%

    microsoft · windows xpMar 2, 2007

  • CVE-2006-7079
    43Plan

    Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program v

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    exv2 · content management systemMar 2, 2007

  • CVE-2007-1232
    32Monitor

    Directory traversal vulnerability in SQLiteManager 1.2.0 allows remote attackers to read arbitrary files via a ..

    MediumCVSS 5.1Proof of conceptEPSS 38%

    sqlite manager · sqlite managerMar 3, 2007

  • CVE-2007-1238
    20Monitor

    Microsoft Office 2003 allows user-assisted remote attackers to cause a denial of service (application crash) by attempting to insert a corru

    MediumCVSS 4.3No exploitEPSS 11%

    microsoft · officeMar 3, 2007

  • CVE-2007-1239
    21Monitor

    Microsoft Excel 2003 does not properly parse .XLS files, which allows remote attackers to cause a denial of service (application crash) via

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · excelMar 3, 2007

  • CVE-2007-0774
    54Plan

    Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Serv

    HighCVSS 7.5WeaponizedEPSS 81%

    apache · tomcat jk web server connectorMar 4, 2007

  • CVE-2007-1277
    38Monitor

    WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backd

    HighCVSS 7.5Proof of conceptEPSS 27%

    wordpress · wordpressMar 5, 2007

  • CVE-2007-1285
    36Monitor

    The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PH

    HighCVSS 7.5Proof of conceptEPSS 18%

    php · phpMar 6, 2007

  • CVE-2007-1286
    40Plan

    Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unser

    MediumCVSS 6.8WeaponizedEPSS 40%

    php · phpMar 6, 2007

  • CVE-2007-1301
    40Plan

    Stack-based buffer overflow in the IMAP service in MailEnable Enterprise and Professional Editions 2.37 and earlier allows remote authentica

    CriticalCVSS 9.0Proof of conceptEPSS 12%

    mailenable · mailenable enterpriseMar 6, 2007

  • CVE-2007-1306
    37Monitor

    Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation

    HighCVSS 7.8Proof of conceptEPSS 20%

    digium · asteriskMar 6, 2007

  • CVE-2007-1327
    34Monitor

    The SILC_SERVER_CMD_FUNC function in apps/silcd/command.c in silc-server 1.0.2 allows remote attackers to cause a denial of service (NULL de

    HighCVSS 7.8Proof of conceptEPSS 10%

    silc · silc-serverMar 7, 2007

  • CVE-2007-1347
    37Monitor

    Microsoft Windows Explorer on Windows 2000 SP4 FR and XP SP2 FR, and possibly other versions and platforms, allows remote attackers to cause

    HighCVSS 7.1Proof of conceptEPSS 31%

    microsoft · windows 2000Mar 8, 2007

  • CVE-2007-1350
    33Monitor

    Stack-based buffer overflow in webadmin.exe in Novell NetMail 3.5.2 allows remote attackers to execute arbitrary code via a long username du

    MediumCVSS 6.8No exploitEPSS 19%

    novell · netmailMar 8, 2007

  • CVE-2007-1373
    58Plan

    Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary

    CriticalCVSS 10.0WeaponizedEPSS 60%

    pmail · mercury mail transport systemMar 9, 2007

  • CVE-2007-1376
    33Monitor

    The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resour

    HighCVSS 7.5Proof of conceptEPSS 10%

    php · phpMar 9, 2007

  • CVE-2007-1377
    25Monitor

    AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of servic

    MediumCVSS 5.0Proof of conceptEPSS 18%

    adobe · acrobat readerMar 9, 2007

  • CVE-2007-1383
    44Plan

    Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowi

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    php · phpMar 9, 2007

  • CVE-2007-1365
    45Plan

    Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets du

    CriticalCVSS 10.0Proof of conceptEPSS 17%

    openbsd · openbsdMar 10, 2007

  • CVE-2007-1399
    45Plan

    Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote atta

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    php · phpMar 10, 2007

  • CVE-2007-1403
    39Monitor

    Multiple stack-based buffer overflows in an ActiveX control in SwDir.dll 10.1.4.20 in Macromedia Shockwave allow remote attackers to cause a

    HighCVSS 7.5Proof of conceptEPSS 29%

    macromedia · shockwaveMar 10, 2007

  • CVE-2007-1404
    49Plan

    tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not pr

    HighCVSS 7.3Proof of conceptEPSS 68%

    prosysinfo · tftp server tftpdwinMar 10, 2007

  • CVE-2007-1413
    33Monitor

    Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 version

    HighCVSS 7.5Proof of conceptEPSS 11%

    php · phpMar 12, 2007

  • CVE-2007-1421
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in Premod SubDog 2 allow remote attackers to execute arbitrary PHP code via a URL in the

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    premod subdog · premod subdogMar 12, 2007

  • CVE-2007-1435
    54Plan

    Buffer overflow in D-Link TFTP Server 1.0 allows remote attackers to cause a denial of service (crash) via a long (1) GET or (2) PUT request

    CriticalCVSS 10.0WeaponizedEPSS 45%

    d-link · tftp serverMar 13, 2007

  • CVE-2007-1278
    24Monitor

    Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft I

    MediumCVSS 4.3No exploitEPSS 23%

    microsoft · internet information serverMar 16, 2007

  • CVE-2007-0450
    47Plan

    Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules

    MediumCVSS 5.0Proof of conceptEPSS 91%

    apache · http serverMar 16, 2007

  • CVE-2007-1492
    32Monitor

    winmm.dll in Microsoft Windows XP allows user-assisted remote attackers to cause a denial of service (infinite loop) via a large cch argumen

    HighCVSS 7.1Proof of conceptEPSS 14%

    microsoft · windows xpMar 16, 2007

  • CVE-2007-1447
    44Plan

    The Tape Engine in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to cause a denial o

    CriticalCVSS 10.0No exploitEPSS 14%

    broadcom · brightstor arcserve backupMar 16, 2007

  • CVE-2007-1499
    26Monitor

    Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary c

    MediumCVSS 4.3Proof of conceptEPSS 29%

    microsoft · windows vistaMar 17, 2007

  • CVE-2007-1512
    44Plan

    Stack-based buffer overflow in the AfxOleSetEditMenu function in the MFC component in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 Go

    CriticalCVSS 10.0No exploitEPSS 11%

    microsoft · windows 2000Mar 20, 2007

  • CVE-2007-1525
    38Monitor

    Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code v

    MediumCVSS 6.8Proof of conceptEPSS 37%

    dayfox designs · dayfox blogMar 20, 2007

  • CVE-2007-1527
    23Monitor

    The LLTD Mapper in Microsoft Windows Vista does not verify that an IP address in a TLV type 0x07 field in a HELLO packet corresponds to a va

    MediumCVSS 5.0No exploitEPSS 10%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1528
    23Monitor

    The LLTD Mapper in Microsoft Windows Vista allows remote attackers to spoof hosts, and nonexistent bridge relationships, into the network to

    MediumCVSS 5.0No exploitEPSS 10%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1530
    25Monitor

    The LLTD Mapper in Microsoft Windows Vista does not properly gather responses to EMIT packets, which allows remote attackers to cause a deni

    MediumCVSS 5.0No exploitEPSS 15%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1531
    27Monitor

    Microsoft Windows XP and Vista overwrites ARP table entries included in gratuitous ARP, which allows remote attackers to cause a denial of s

    MediumCVSS 5.0Proof of conceptEPSS 23%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1532
    28Monitor

    The neighbor discovery implementation in Microsoft Windows Vista allows remote attackers to conduct a redirect attack by (1) responding to q

    MediumCVSS 6.4No exploitEPSS 10%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1533
    23Monitor

    The Teredo implementation in Microsoft Windows Vista uses the same nonce for communication with different UDP ports within a solicitation se

    MediumCVSS 5.0No exploitEPSS 10%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1534
    41Plan

    DFSR.exe in Windows Meeting Space in Microsoft Windows Vista remains available for remote connections on TCP port 5722 for 2 minutes after W

    CriticalCVSS 9.3No exploitEPSS 13%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1535
    34Monitor

    Microsoft Windows Vista establishes a Teredo address without user action upon connection to the Internet, contrary to documentation that Ter

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · windows vistaMar 20, 2007

  • CVE-2007-1536
    41Plan

    Integer underflow in the file_printf function in the "file" program before 4.20 allows user-assisted attackers to execute arbitrary code via

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    file · fileMar 20, 2007

  • CVE-2007-1560
    28Monitor

    The clientProcessRequest() function in src/client_side.c in Squid 2.6 before 2.6.STABLE12 allows remote attackers to cause a denial of servi

    MediumCVSS 5.0No exploitEPSS 28%

    squid · squidMar 21, 2007

  • CVE-2007-0348
    48Plan

    Stack-based buffer overflow in the IASystemInfo.dll ActiveX control in (1) InterActual Player 2.60.12.0717, (2) Roxio CinePlayer 3.2, (3) Wi

    CriticalCVSS 9.3WeaponizedEPSS 36%

    roxio · cineplayerMar 21, 2007

  • CVE-2007-1561
    35Monitor

    The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP I

    HighCVSS 7.8Proof of conceptEPSS 14%

    asterisk · asteriskMar 21, 2007

  • CVE-2007-1562
    31Monitor

    The FTP protocol implementation in Mozilla Firefox before 1.5.0.11 and 2.x before 2.0.0.3 allows remote attackers to force the client to con

    MediumCVSS 6.8Proof of conceptEPSS 14%

    mozilla · firefoxMar 21, 2007

  • CVE-2007-1567
    55Plan

    Stack-based buffer overflow in War FTP Daemon 1.65, and possibly earlier, allows remote attackers to cause a denial of service or execute ar

    CriticalCVSS 10.0Proof of conceptEPSS 50%

    war ftp daemon · war ftp daemonMar 21, 2007

  • CVE-2007-1578
    45Plan

    Multiple integer signedness errors in the NTLM implementation in Atrium MERCUR IMAPD (mcrimap4.exe) 5.00.14, with SP4, allow remote attacker

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    atrium software · mercur imapdMar 21, 2007

  • CVE-2007-1579
    57Plan

    Stack-based buffer overflow in Atrium MERCUR IMAPD allows remote attackers to have an unknown impact via a certain SUBSCRIBE command.

    CriticalCVSS 10.0Proof of conceptEPSS 57%

    atrium software · mercur imapdMar 21, 2007

  • CVE-2007-1620
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    php db designer · php db designerMar 22, 2007

  • CVE-2007-1643
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote attackers to execute a

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    lan management system · lan management systemMar 23, 2007

  • CVE-2007-1644
    50Plan

    The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients in certain deployment

    CriticalCVSS 10.0Proof of conceptEPSS 32%

    microsoft · all windowsMar 23, 2007

  • CVE-2007-1645
    44Plan

    Buffer overflow in FutureSoft TFTP Server 2000 on Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via a long re

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    microsoft · windows 2000Mar 23, 2007

  • CVE-2007-1658
    48Plan

    Windows Mail in Microsoft Windows Vista might allow user-assisted remote attackers to execute certain programs via a link to a (1) local fil

    CriticalCVSS 9.3Proof of conceptEPSS 35%

    microsoft · windows vistaMar 24, 2007

  • CVE-2007-1692
    35Monitor

    The default configuration of Microsoft Windows uses the Web Proxy Autodiscovery Protocol (WPAD) without static WPAD entries, which might all

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · windows 2000Mar 26, 2007

  • CVE-2007-1697
    62This week

    PHP remote file inclusion vulnerability in header.inc.php in Philex 0.2.3 and earlier allows remote attackers to execute arbitrary PHP code

    CriticalCVSS 10.0Proof of conceptEPSS 73%

    philex · philexMar 26, 2007

  • CVE-2007-1699
    43Plan

    Multiple PHP remote file inclusion vulnerabilities in the SWmenu (com_swmenupro and com_swmenufree) 4.0 component for Mambo and Joomla! allo

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    joomla · swmenu componentMar 26, 2007

  • CVE-2007-1721
    44Plan

    Multiple PHP remote file inclusion vulnerabilities in C-Arbre 0.6PR7 and earlier allow remote attackers to execute arbitrary PHP code via a

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    realink · c-arbreMar 27, 2007

  • CVE-2007-1675
    58Plan

    Buffer overflow in the CRAM-MD5 authentication mechanism in the IMAP server (nimap.exe) in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.

    CriticalCVSS 10.0Proof of conceptEPSS 61%

    ibm · lotus dominoMar 28, 2007

  • CVE-2007-1733
    43Plan

    Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2)

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    intervations · navicopa web serverMar 28, 2007

  • CVE-2007-1349
    23Monitor

    PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular

    MediumCVSS 5.0No exploitEPSS 10%

    apache · mod perlMar 29, 2007

  • CVE-2007-1763
    33Monitor

    The ATI kernel driver (atikmdag.sys) in Microsoft Windows Vista allows user-assisted remote attackers to cause a denial of service (crash) v

    HighCVSS 7.1No exploitEPSS 18%

    microsoft · windows vistaMar 29, 2007

  • CVE-2007-1765
    53Plan

    Unspecified vulnerability in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbitrary code or cause a denial of

    CriticalCVSS 9.3WeaponizedEPSS 54%

    microsoft · windows 2000Mar 29, 2007

  • CVE-2007-1770
    45Plan

    Buffer overflow in the ArcSDE service (giomgr) in Environmental Systems Research Institute (ESRI) ArcGIS before 9.2 Service Pack 2, when usi

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    esri · arcsdeMar 29, 2007

  • CVE-2007-1777
    35Monitor

    Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive th

    HighCVSS 7.5Proof of conceptEPSS 15%

    php · phpMar 29, 2007

  • CVE-2007-0038
    59Plan

    Stack-based buffer overflow in the animated cursor code in Microsoft Windows 2000 SP4 through Vista allows remote attackers to execute arbit

    CriticalCVSS 9.3WeaponizedEPSS 72%

    microsoft · windows 2000Mar 30, 2007

  • CVE-2007-1785
    33Monitor

    The RPC service in mediasvr.exe in CA BrightStor ARCserve Backup 11.5 SP2 build 4237 allows remote attackers to execute arbitrary code via c

    HighCVSS 7.1Proof of conceptEPSS 15%

    ca · brightstor arcserve backupMar 30, 2007