Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2007

55 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-2927
    28Monitor

    Unspecified vulnerability in Atheros 802.11 a/b/g wireless adapter drivers before 5.3.0.35, and 6.x before 6.0.3.67, on Windows allows remot

    MediumCVSS 5.0No exploitEPSS 25%

    atheros · wireless adapter driversAug 7, 2007

  • CVE-2007-4187
    33Monitor

    Multiple eval injection vulnerabilities in the com_search component in Joomla! 1.5 beta before RC1 (aka Mapya) allow remote attackers to exe

    HighCVSS 7.5No exploitEPSS 11%

    joomla · joomlaAug 7, 2007

  • CVE-2007-4227
    21Monitor

    Microsoft Windows Explorer (explorer.exe) allows user-assisted remote attackers to cause a denial of service via a certain JPG file, as demo

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · internet explorerAug 8, 2007

  • CVE-2007-4232
    42Plan

    PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote attackers to execute ar

    MediumCVSS 6.8Proof of conceptEPSS 51%

    andreas robertz · phpnewsAug 8, 2007

  • CVE-2007-4241
    43Plan

    Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller for Cisco Local Director on HP-UX 11.11i allows remote attackers to execute ar

    CriticalCVSS 10.0No exploitEPSS 11%

    hp · hp-uxAug 8, 2007

  • CVE-2007-4247
    21Monitor

    Windows Calendar on Microsoft Windows Vista allows remote attackers to cause a denial of service (NULL dereference and persistent applicatio

    MediumCVSS 4.3No exploitEPSS 14%

    microsoft · windows vistaAug 8, 2007

  • CVE-2007-4254
    30Monitor

    Stack-based buffer overflow in a certain ActiveX control in VDT70.DLL in Microsoft Visual Database Tools Database Designer 7.0 for Microsoft

    MediumCVSS 6.8Proof of conceptEPSS 11%

    microsoft · visual database tools database designerAug 8, 2007

  • CVE-2007-3872
    40Plan

    Multiple stack-based buffer overflows in the Shared Trace Service (OVTrace) service for HP OpenView Operations A.07.50 for Windows, and poss

    MediumCVSS 6.8WeaponizedEPSS 30%

    hp · openview operationsAug 9, 2007

  • CVE-2007-4279
    53Plan

    PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execute arbitrary PHP code

    HighCVSS 7.5Proof of conceptEPSS 75%

    frontaccounting · frontaccountingAug 9, 2007

  • CVE-2007-4286
    43Plan

    Buffer overflow in the Next Hop Resolution Protocol (NHRP) functionality in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a d

    CriticalCVSS 9.3Proof of conceptEPSS 19%

    cisco · iosAug 9, 2007

  • CVE-2007-4288
    21Monitor

    Microsoft Windows Media Player 11 (wmplayer.exe) allows user-assisted remote attackers to cause a denial of service (application crash) via

    MediumCVSS 4.3Proof of conceptEPSS 14%

    microsoft · windows media playerAug 9, 2007

  • CVE-2007-4313
    48Plan

    PHP remote file inclusion vulnerability in public_includes/pub_blocks/activecontent.php in Php Blue Dragon CMS 3.0.0 allows remote attackers

    MediumCVSS 6.8Proof of conceptEPSS 68%

    php blue dragon · php blue dragon cmsAug 13, 2007

  • CVE-2007-4320
    52Plan

    PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to execute arbitrary PH

    HighCVSS 7.5Proof of conceptEPSS 72%

    ncaster · ncasterAug 13, 2007

  • CVE-2007-4336
    32Monitor

    Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6

    MediumCVSS 4.3Proof of conceptEPSS 50%

    microsoft · directx mediaAug 14, 2007

  • CVE-2007-0943
    35Monitor

    Unspecified vulnerability in Internet Explorer 5.01 and 6 SP1 allows remote attackers to execute arbitrary code via crafted Cascading Style

    MediumCVSS 6.8No exploitEPSS 27%

    microsoft · ieAug 14, 2007

  • CVE-2007-2216
    49Plan

    The tblinf32.dll (aka vstlbinf.dll) ActiveX control for Internet Explorer 5.01, 6 SP1, and 7 uses an incorrect IObjectsafety implementation,

    CriticalCVSS 9.3Proof of conceptEPSS 41%

    microsoft · internet explorerAug 14, 2007

  • CVE-2007-2223
    52Plan

    Microsoft XML Core Services (MSXML) 3.0 through 6.0 allows remote attackers to execute arbitrary code via the substringData method on a (1)

    CriticalCVSS 9.3Proof of conceptEPSS 48%

    microsoft · xml core servicesAug 14, 2007

  • CVE-2007-2224
    47Plan

    Object linking and embedding (OLE) Automation, as used in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Office 2004 for Mac,

    CriticalCVSS 9.3No exploitEPSS 34%

    microsoft · windows 2000Aug 14, 2007

  • CVE-2007-3034
    53Plan

    Integer overflow in the AttemptWrite function in Graphics Rendering Engine (GDI) on Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1

    CriticalCVSS 9.3Proof of conceptEPSS 51%

    microsoft · windows 2000Aug 14, 2007

  • CVE-2007-3035
    38Monitor

    Unspecified vulnerability in Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin

    HighCVSS 7.6No exploitEPSS 25%

    microsoft · windows media playerAug 14, 2007

  • CVE-2007-3037
    23Monitor

    Microsoft Windows Media Player 7.1, 9, 10, and 11 allows remote attackers to execute arbitrary code via a skin file (WMZ or WMD) with crafte

    MediumCVSS 4.0No exploitEPSS 21%

    microsoft · windows media playerAug 14, 2007

  • CVE-2007-3041
    46Plan

    Unspecified vulnerability in the pdwizard.ocx ActiveX object for Internet Explorer 5.01, 6 SP1, and 7 allows remote attackers to execute arb

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · internet explorerAug 14, 2007

  • CVE-2007-3890
    46Plan

    Microsoft Excel in Office 2000 SP3, Office XP SP3, Office 2003 SP2, and Office 2004 for Mac allows remote attackers to execute arbitrary cod

    CriticalCVSS 9.3No exploitEPSS 28%

    microsoft · excelAug 14, 2007

  • CVE-2007-0948
    41Plan

    Heap-based buffer overflow in Microsoft Virtual PC 2004 and PC for Mac 7.1 and 7, and Virtual Server 2005 and 2005 R2, allows local guest OS

    CriticalCVSS 9.3No exploitEPSS 12%

    microsoft · virtual pcAug 14, 2007

  • CVE-2007-1749
    49Plan

    Integer underflow in the CDownloadSink class code in the Vector Markup Language (VML) component (VGX.DLL), as used in Internet Explorer 5.01

    CriticalCVSS 9.3Proof of conceptEPSS 41%

    microsoft · internet explorerAug 14, 2007

  • CVE-2007-3032
    35Monitor

    Unspecified vulnerability in Windows Vista Contacts Gadget in Windows Vista allows user-assisted remote attackers to execute arbitrary code

    MediumCVSS 6.8No exploitEPSS 25%

    microsoft · windows vistaAug 14, 2007

  • CVE-2007-3033
    26Monitor

    Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-

    MediumCVSS 4.3No exploitEPSS 28%

    microsoft · windows vistaAug 14, 2007

  • CVE-2007-3382
    28Monitor

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters

    MediumCVSS 4.3Proof of conceptEPSS 37%

    apache · tomcatAug 14, 2007

  • CVE-2007-3385
    22Monitor

    Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character

    MediumCVSS 4.3No exploitEPSS 16%

    apache · tomcatAug 14, 2007

  • CVE-2007-3386
    35Monitor

    Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote att

    MediumCVSS 4.3Proof of conceptEPSS 58%

    apache · tomcatAug 14, 2007

  • CVE-2007-3891
    35Monitor

    Unspecified vulnerability in Windows Vista Weather Gadgets in Windows Vista allows remote attackers to execute arbitrary code via crafted HT

    MediumCVSS 6.8No exploitEPSS 25%

    microsoft · windows vistaAug 14, 2007

  • CVE-2007-4370
    48Plan

    Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long

    HighCVSS 7.5WeaponizedEPSS 59%

    racer · racerAug 15, 2007

  • CVE-2007-4387
    40Plan

    Cross-site request forgery (CSRF) vulnerability in /xslt in 2wire 1701HG and 2071 Gateway routers, with 3.17.5 and 5.29.51 software, allows

    MediumCVSS 4.3WeaponizedEPSS 9%

    2wire · 1701hg routerAug 17, 2007

  • CVE-2007-4430
    24Monitor

    Unspecified vulnerability in Cisco IOS 12.0 through 12.4 allows context-dependent attackers to cause a denial of service (device restart and

    MediumCVSS 5.0Proof of conceptEPSS 13%

    cisco · cliAug 20, 2007

  • CVE-2007-4440
    49Plan

    Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers

    HighCVSS 7.5WeaponizedEPSS 64%

    pmail · mercury mail transport systemAug 20, 2007

  • CVE-2007-4459
    32Monitor

    Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware, and other SIP firmware before 8.7(0), allows remote attackers to cause a denial of

    HighCVSS 7.1Proof of conceptEPSS 13%

    cisco · voip phone cp-7940Aug 21, 2007

  • CVE-2007-4218
    44Plan

    Multiple buffer overflows in the ServerProtect service (SpntSvc.exe) in Trend Micro ServerProtect for Windows before 5.58 Security Patch 4 a

    CriticalCVSS 10.0No exploitEPSS 13%

    trend micro · serverprotectAug 22, 2007

  • CVE-2007-4219
    43Plan

    Integer overflow in the RPCFN_SYNC_TASK function in StRpcSrv.dll, as used by the ServerProtect service (SpntSvc.exe), in Trend Micro ServerP

    CriticalCVSS 10.0No exploitEPSS 10%

    trend micro · serverprotectAug 22, 2007

  • CVE-2007-4478
    20Monitor

    Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6.0 and 7 allows user-assisted remote attackers to inject arbitrary

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · internet explorerAug 22, 2007

  • CVE-2007-4498
    35Monitor

    The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7, Loader 1.0.0.6, and Boot 1.0.0.18 allows remote attackers to force silent call com

    HighCVSS 7.8Proof of conceptEPSS 13%

    grandstream · sip phoneAug 23, 2007

  • CVE-2007-3847
    24Monitor

    The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to

    MediumCVSS 5.0No exploitEPSS 12%

    apache · http serverAug 23, 2007

  • CVE-2007-4534
    33Monitor

    Buffer overflow in the VThinker::BroadcastPrintf function in p_thinker.cpp in Vavoom 1.24 and earlier allows remote attackers to execute arb

    HighCVSS 7.5Proof of conceptEPSS 11%

    vavoom · vavoomAug 24, 2007

  • CVE-2007-4556
    35Monitor

    Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all inp

    MediumCVSS 6.8Proof of conceptEPSS 25%

    opensymphony · xworkAug 27, 2007

  • CVE-2007-4559
    47Plan

    Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remot

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    python · pythonAug 27, 2007

  • CVE-2007-4560
    55Plan

    clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metachar

    HighCVSS 7.6WeaponizedEPSS 83%

    clam anti-virus · clamavAug 27, 2007

  • CVE-2007-4566
    45Plan

    Multiple buffer overflows in the login mechanism in sidvault in Alpha Centauri Software SIDVault LDAP Server before 2.0f allow remote attack

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    alpha centauri software · sidvault ldap serverAug 27, 2007

  • CVE-2007-4584
    44Plan

    Stack-based buffer overflow in BitchX 1.1 Final allows remote IRC servers to execute arbitrary code via a long string in a MODE command, rel

    CriticalCVSS 10.0Proof of conceptEPSS 14%

    bitchx · bitchxAug 28, 2007

  • CVE-2007-4467
    43Plan

    Multiple stack-based buffer overflows in the Oracle JInitiator ActiveX control (beans.ocx) 1.1.8.16 and earlier, as used by Oracle Forms app

    CriticalCVSS 9.3No exploitEPSS 21%

    oracle · jinitiatorAug 30, 2007

  • CVE-2007-4607
    54Plan

    Buffer overflow in the EasyMailSMTPObj ActiveX control in emsmtp.dll 6.0.1 in the Quiksoft EasyMail SMTP Object, as used in Postcast Server

    CriticalCVSS 9.3WeaponizedEPSS 56%

    gate comm software · postcast server proAug 30, 2007

  • CVE-2007-2931
    54Plan

    Heap-based buffer overflow in Microsoft MSN Messenger 6.2, 7.0, and 7.5, and Live Messenger 8.0 allows user-assisted remote attackers to exe

    CriticalCVSS 9.3Proof of conceptEPSS 55%

    microsoft · msn messengerAug 31, 2007

  • CVE-2007-2954
    47Plan

    Multiple stack-based buffer overflows in the Spooler service (nwspool.dll) in Novell Client 4.91 SP2 through SP4 for Windows allow remote at

    CriticalCVSS 10.0No exploitEPSS 23%

    novell · clientAug 31, 2007

  • CVE-2007-4515
    47Plan

    Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1

    CriticalCVSS 9.3WeaponizedEPSS 33%

    yahoo · messengerAug 31, 2007

  • CVE-2007-4636
    51Plan

    Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the root

    HighCVSS 7.5Proof of conceptEPSS 71%

    phpbg · phpbgAug 31, 2007

  • CVE-2007-4642
    45Plan

    Multiple buffer overflows in Doomsday (aka deng) 1.9.0-beta5.1 and earlier allow remote attackers to execute arbitrary code via a long chat

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    doomsday · doomsdayAug 31, 2007

  • CVE-2007-4646
    45Plan

    Buffer overflow in the pop3 service in Hexamail Server 3.0.0.001 Lite allows remote attackers to cause a denial of service (daemon crash) an

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    hexamail · hexamail serverAug 31, 2007