Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2007

71 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-2426
    49Plan

    PHP remote file inclusion vulnerability in myfunctions/mygallerybrowser.php in the myGallery 1.4b4 and earlier plugin for WordPress allows r

    HighCVSS 7.5Proof of conceptEPSS 62%

    wildbits · mygalleryMay 1, 2007

  • CVE-2007-2434
    44Plan

    Buffer overflow in asnsp.dll in Aventail Connect 4.1.2.13 allows remote attackers to cause a denial of service (application crash) or execut

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    aventail · aventail connectMay 2, 2007

  • CVE-2007-2457
    34Monitor

    PHP remote file inclusion vulnerability in resources/includes/class.Smarty.php in Pixaria Gallery before 1.4.3 allows remote attackers to ex

    HighCVSS 7.5Proof of conceptEPSS 11%

    pixaria · pixaria galleryMay 2, 2007

  • CVE-2007-2458
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in Pixaria Gallery before 1.4.3 allow remote attackers to execute arbitrary PHP code via

    HighCVSS 7.5Proof of conceptEPSS 10%

    pixaria · pixaria galleryMay 2, 2007

  • CVE-2007-2481
    39Monitor

    PHP remote file inclusion vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals

    MediumCVSS 6.8Proof of conceptEPSS 40%

    ruben boelinger · wordtubeMay 3, 2007

  • CVE-2007-2484
    41Plan

    PHP remote file inclusion vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_global

    MediumCVSS 6.8Proof of conceptEPSS 45%

    ruben boelinger · wp-tableMay 3, 2007

  • CVE-2007-2485
    46Plan

    PHP remote file inclusion vulnerability in myflash-button.php in the myflash 1.00 and earlier plugin for WordPress allows remote attackers t

    HighCVSS 7.5Proof of conceptEPSS 54%

    ruben boelinger · myflashMay 3, 2007

  • CVE-2007-2498
    40Plan

    libmp4v2.dll in Winamp 5.02 through 5.34 allows user-assisted remote attackers to execute arbitrary code via a certain .MP4 file.

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    nullsoft · winampMay 3, 2007

  • CVE-2007-2239
    41Plan

    Stack-based buffer overflow in the SaveBMP method in the AXIS Camera Control (aka CamImage) ActiveX control before 2.40.0.0 in AxisCamContro

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    axis · 2100 network cameraMay 7, 2007

  • CVE-2007-0035
    47Plan

    Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly h

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · officeMay 8, 2007

  • CVE-2007-0215
    39Monitor

    Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, and 2003 Viewer allows user-assisted remote attackers to execut

    HighCVSS 7.6No exploitEPSS 31%

    microsoft · excelMay 8, 2007

  • CVE-2007-1203
    46Plan

    Unspecified vulnerability in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, 2004 for Mac, and 2007 allows user-assisted remote a

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · excelMay 8, 2007

  • CVE-2007-1214
    36Monitor

    Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2003 Viewer, and 2004 for Mac allows user-assisted remote attackers to execute arbitrary code

    MediumCVSS 6.8No exploitEPSS 28%

    microsoft · excelMay 8, 2007

  • CVE-2007-0039
    44Plan

    The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remot

    HighCVSS 7.8No exploitEPSS 44%

    microsoft · exchange serverMay 8, 2007

  • CVE-2007-0213
    60This week

    Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote at

    CriticalCVSS 10.0Proof of conceptEPSS 66%

    microsoft · exchange serverMay 8, 2007

  • CVE-2007-0220
    37Monitor

    Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remo

    MediumCVSS 6.8No exploitEPSS 33%

    microsoft · exchange serverMay 8, 2007

  • CVE-2007-0221
    42Plan

    Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (ser

    HighCVSS 7.8No exploitEPSS 37%

    microsoft · exchange serverMay 8, 2007

  • CVE-2007-0940
    60This week

    Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM an

    CriticalCVSS 9.3No exploitEPSS 75%

    microsoft · biztalk serverMay 8, 2007

  • CVE-2007-0942
    47Plan

    Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 o

    CriticalCVSS 9.3No exploitEPSS 32%

    microsoft · windows 2000May 8, 2007

  • CVE-2007-0944
    48Plan

    Unspecified vulnerability in the CTableCol::OnPropertyChange method in Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Wi

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · windows 2000May 8, 2007

  • CVE-2007-0945
    46Plan

    Microsoft Internet Explorer 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and 7 on Windows Vista

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows 2000May 8, 2007

  • CVE-2007-0946
    46Plan

    Unspecified vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows remote

    CriticalCVSS 9.3No exploitEPSS 30%

    microsoft · windows xpMay 8, 2007

  • CVE-2007-0947
    47Plan

    Use-after-free vulnerability in Microsoft Internet Explorer 7 on Windows XP SP2, Windows Server 2003 SP1 or SP2, or Windows Vista allows rem

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · windows 2003 serverMay 8, 2007

  • CVE-2007-1202
    36Monitor

    Word (or Word Viewer) in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly p

    MediumCVSS 6.8No exploitEPSS 29%

    microsoft · wordMay 8, 2007

  • CVE-2007-1747
    46Plan

    Unspecified vulnerability in MSO.dll in Microsoft Office 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and 2007 allows user-assisted remote at

    CriticalCVSS 9.3No exploitEPSS 31%

    microsoft · officeMay 8, 2007

  • CVE-2007-2221
    47Plan

    Unspecified vulnerability in the mdsauth.dll COM object in Microsoft Windows Media Server in the Microsoft Internet Explorer 5.01 SP4 on Win

    CriticalCVSS 9.3Proof of conceptEPSS 34%

    microsoft · windows 2000May 8, 2007

  • CVE-2007-2508
    63This week

    Multiple stack-based buffer overflows in Trend Micro ServerProtect 5.58 before Security Patch 2 Build 1174 allow remote attackers to execute

    CriticalCVSS 10.0WeaponizedEPSS 77%

    trend micro · serverprotectMay 8, 2007

  • CVE-2007-1669
    35Monitor

    zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399,

    HighCVSS 7.8Proof of conceptEPSS 12%

    barracuda networks · barracuda spam firewallMay 8, 2007

  • CVE-2007-2545
    51Plan

    Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute arbitrary PHP code via

    HighCVSS 7.5Proof of conceptEPSS 68%

    persism cms · persism cmsMay 8, 2007

  • CVE-2007-2581
    28Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Microsoft Windows SharePoint Services 3.0 for Windows Server 2003 and Office SharePoi

    MediumCVSS 4.3Proof of conceptEPSS 36%

    microsoft · sharepoint serverMay 9, 2007

  • CVE-2006-7196
    39Monitor

    Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0

    MediumCVSS 4.3Proof of conceptEPSS 72%

    apache · tomcatMay 9, 2007

  • CVE-2007-1358
    16Monitor

    Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows rem

    LowCVSS 2.6No exploitEPSS 19%

    apache · tomcatMay 9, 2007

  • CVE-2007-1858
    15Monitor

    The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain ins

    LowCVSS 2.6Proof of conceptEPSS 18%

    apache · tomcatMay 9, 2007

  • CVE-2007-2582
    48Plan

    Multiple buffer overflows in the DB2 JDBC Applet Server (DB2JDS) service in IBM DB2 9.x and earlier allow remote attackers to (1) execute ar

    CriticalCVSS 10.0No exploitEPSS 26%

    ibm · db2May 9, 2007

  • CVE-2007-2583
    19Monitor

    The in_decimal::set function in item_cmpfunc.cc in MySQL before 5.0.40, and 5.1 before 5.1.18-beta, allows context-dependent attackers to ca

    MediumCVSS 4.0Proof of conceptEPSS 11%

    oracle · mysqlMay 9, 2007

  • CVE-2007-2586
    41Plan

    The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary

    CriticalCVSS 9.3Proof of conceptEPSS 14%

    cisco · iosMay 9, 2007

  • CVE-2007-2522
    48Plan

    Stack-based buffer overflow in the inoweb Console Server in CA Anti-Virus for the Enterprise r8, Threat Manager r8, Anti-Spyware for the Ent

    CriticalCVSS 10.0No exploitEPSS 26%

    broadcom · antispyware for the enterpriseMay 11, 2007

  • CVE-2007-2597
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in telltarget CMS 1.3.3 allow remote attackers to execute arbitrary PHP code via a URL in

    HighCVSS 7.5Proof of conceptEPSS 10%

    telltargetcms · telltarget cmsMay 11, 2007

  • CVE-2007-2607
    51Plan

    PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers to execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 70%

    lavague · lavagueMay 11, 2007

  • CVE-2007-2617
    40Plan

    srsexec in Sun Remote Services (SRS) Net Connect Software Proxy Core package in Sun Solaris 10 does not enforce file permissions when openin

    LowCVSS 2.1WeaponizedEPSS 3%

    sun · solarisMay 11, 2007

  • CVE-2007-2446
    63This week

    Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary

    CriticalCVSS 10.0WeaponizedEPSS 77%

    samba · sambaMay 14, 2007

  • CVE-2007-2447
    40Plan

    The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.25rc3 allows remote attackers to execute arbitrary commands via shell metacharac

    MediumCVSS 6.0WeaponizedEPSS 49%

    samba · sambaMay 14, 2007

  • CVE-2007-2645
    41Plan

    Integer overflow in the exif_data_load_data_entry function in exif-data.c in libexif before 0.6.14 allows user-assisted remote attackers to

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    libexif · libexifMay 14, 2007

  • CVE-2007-2666
    35Monitor

    Stack-based buffer overflow in LexRuby.cxx (SciLexer.dll) in Scintilla 1.73, as used by notepad++ 4.1.1 and earlier, allows user-assisted re

    HighCVSS 7.6Proof of conceptEPSS 15%

    scintilla · scintillaMay 14, 2007

  • CVE-2007-2676
    51Plan

    PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitr

    HighCVSS 7.5Proof of conceptEPSS 70%

    open translation engine · open translation engineMay 14, 2007

  • CVE-2007-2699
    37Monitor

    The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policie

    HighCVSS 7.1No exploitEPSS 29%

    bea · weblogic serverMay 15, 2007

  • CVE-2007-2707
    47Plan

    PHP remote file inclusion vulnerability in linksnet_linkslog_rss.php in Linksnet Newsfeed 1.0 allows remote attackers to execute arbitrary P

    MediumCVSS 6.8Proof of conceptEPSS 68%

    linksnet · newsfeedMay 16, 2007

  • CVE-2007-2708
    49Plan

    PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 62%

    feindt computerservice · news-scriptMay 16, 2007

  • CVE-2007-2711
    59Plan

    Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 11

    CriticalCVSS 10.0WeaponizedEPSS 63%

    tinyirc · tinyidentdMay 16, 2007

  • CVE-2007-2714
    43Plan

    Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    matt mullenweg · akismetMay 16, 2007

  • CVE-2007-2715
    43Plan

    Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1) username, or the (2)

    CriticalCVSS 10.0Proof of conceptEPSS 10%

    snaps gallery · snaps galleryMay 16, 2007

  • CVE-2007-2718
    22Monitor

    Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet E

    MediumCVSS 4.3Proof of conceptEPSS 16%

    microsoft · internet explorerMay 16, 2007

  • CVE-2007-1689
    60This week

    Buffer overflow in the ISAlertDataCOM ActiveX control in ISLALERT.DLL for Norton Personal Firewall 2004 and Internet Security 2004 allows re

    CriticalCVSS 10.0WeaponizedEPSS 65%

    symantec · norton internet securityMay 16, 2007

  • CVE-2007-1355
    34Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.

    MediumCVSS 4.3Proof of conceptEPSS 58%

    apache · tomcatMay 21, 2007

  • CVE-2007-2772
    35Monitor

    (1) caloggerd.exe (camt70.dll) and (2) mediasvr.exe (catirpc.dll and rwxdr.dll) in CA BrightStor Backup 11.5.2.0 SP2 allow remote attackers

    HighCVSS 7.8Proof of conceptEPSS 12%

    ca · brightstor arcserve backupMay 21, 2007

  • CVE-2007-2788
    32Monitor

    Integer overflow in the embedded ICC profile image parser in Sun Java Development Kit (JDK) before 1.5.0_11-b03 and 1.6.x before 1.6.0_01-b0

    MediumCVSS 6.8Proof of conceptEPSS 18%

    sun · jdkMay 21, 2007

  • CVE-2007-2793
    49Plan

    PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitrary PHP code via a U

    HighCVSS 7.5Proof of conceptEPSS 64%

    geeklog · geeklogMay 21, 2007

  • CVE-2007-2815
    62This week

    The "hit-highlighting" functionality in webhits.dll in Microsoft Internet Information Services (IIS) Web Server 5.0 only uses Windows NT ACL

    CriticalCVSS 10.0Proof of conceptEPSS 73%

    microsoft · internet information servicesMay 22, 2007

  • CVE-2007-2816
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in ol'bookmarks 0.7.4 allow remote attackers to execute arbitrary PHP code via a URL in t

    HighCVSS 7.5Proof of conceptEPSS 10%

    ol bookmarks · ol bookmarksMay 22, 2007

  • CVE-2007-2386
    52Plan

    Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termi

    CriticalCVSS 9.4WeaponizedEPSS 49%

    apple · mac os xMay 24, 2007

  • CVE-2007-1860
    24Monitor

    mod_jk in Apache Tomcat JK Web Server Connector 1.2.x before 1.2.23 decodes request URLs within the Apache HTTP Server before passing the UR

    MediumCVSS 5.0No exploitEPSS 13%

    apache · tomcat jk web server connectorMay 25, 2007

  • CVE-2007-2881
    48Plan

    Multiple stack-based buffer overflows in the SOCKS proxy support (sockd) in Sun Java Web Proxy Server before 4.0.5 allow remote attackers to

    CriticalCVSS 10.0No exploitEPSS 25%

    sun · java system web proxy serverMay 29, 2007

  • CVE-2007-2884
    48Plan

    Multiple stack-based buffer overflows in Microsoft Visual Basic 6 allow user-assisted remote attackers to cause a denial of service (CPU con

    CriticalCVSS 9.3Proof of conceptEPSS 36%

    microsoft · visual basicMay 29, 2007

  • CVE-2007-2888
    46Plan

    Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FI

    HighCVSS 7.6WeaponizedEPSS 54%

    ezb systems · ultraisoMay 29, 2007

  • CVE-2007-2897
    52Plan

    Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang),

    HighCVSS 7.5No exploitEPSS 74%

    microsoft · internet information serverMay 30, 2007

  • CVE-2007-2903
    29Monitor

    Buffer overflow in the HelpPopup method in the Microsoft Office 2000 Controllo UA di Microsoft Office ActiveX control (OUACTRL.OCX) 1.0.1.9

    MediumCVSS 5.0Proof of conceptEPSS 28%

    microsoft · officeMay 30, 2007

  • CVE-2007-2937
    49Plan

    PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL i

    HighCVSS 7.5Proof of conceptEPSS 64%

    troforum · troforumMay 30, 2007

  • CVE-2007-2938
    52Plan

    Buffer overflow in the BaseRunner ActiveX control in the Ademco ATNBaseLoader100 Module (ATNBaseLoader100.dll) 5.4.0.6, when Internet Explor

    CriticalCVSS 10.0Proof of conceptEPSS 40%

    honeywell · ademco atnbaseloader100 moduleMay 30, 2007

  • CVE-2007-2939
    46Plan

    Multiple PHP remote file inclusion vulnerabilities in Mazen's PHP Chat 3.0.0 allow remote attackers to execute arbitrary PHP code via a URL

    MediumCVSS 6.8Proof of conceptEPSS 64%

    mazens php chat · mazens php chatMay 30, 2007

  • CVE-2007-2918
    40Plan

    Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) Star

    MediumCVSS 6.8WeaponizedEPSS 34%

    logitech · videocallMay 31, 2007

  • CVE-2007-2969
    49Plan

    PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP

    HighCVSS 7.5Proof of conceptEPSS 61%

    wanewsletter · wanewsletterMay 31, 2007