Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2007

64 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-5144
    22Monitor

    Buffer overflow in the GDI engine in Windows Live Messenger, as used for Windows MSN Live 8.1, allows user-assisted remote attackers to caus

    MediumCVSS 4.3No exploitEPSS 16%

    microsoft · windows live messengerOct 1, 2007

  • CVE-2007-5145
    21Monitor

    Multiple buffer overflows in system DLL files in Microsoft Windows XP, as used by Microsoft Windows Explorer (explorer.exe) 6.00.2900.2180,

    MediumCVSS 4.3No exploitEPSS 12%

    microsoft · windows xpOct 1, 2007

  • CVE-2007-5158
    22Monitor

    The focus handling for the onkeydown event in Microsoft Internet Explorer 6.0 allows remote attackers to change field focus and copy keystro

    MediumCVSS 4.3Proof of conceptEPSS 15%

    microsoft · internet explorerOct 1, 2007

  • CVE-2007-5003
    60This week

    Multiple stack-based buffer overflows in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 al

    CriticalCVSS 10.0WeaponizedEPSS 67%

    ca · protection suitesOct 1, 2007

  • CVE-2007-5006
    46Plan

    Multiple command handlers in CA (Computer Associates) BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.5 do not verify

    CriticalCVSS 10.0No exploitEPSS 21%

    ca · protection suitesOct 1, 2007

  • CVE-2007-5082
    59Plan

    Multiple stack-based buffer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote at

    CriticalCVSS 10.0WeaponizedEPSS 63%

    broadcom · brightstor hierarchical storage managerOct 1, 2007

  • CVE-2007-5083
    46Plan

    Multiple integer overflows in Computer Associates (CA) BrightStor Hierarchical Storage Manager (HSM) before r11.6 allow remote attackers to

    CriticalCVSS 10.0No exploitEPSS 18%

    broadcom · brightstor hierarchical storage managerOct 1, 2007

  • CVE-2007-5184
    34Monitor

    Format string vulnerability in the SMBDirList function in dirlist.c in SmbFTPD 0.96 allows remote attackers to execute arbitrary code via fo

    HighCVSS 7.5Proof of conceptEPSS 12%

    smbftpd · smbftpdOct 3, 2007

  • CVE-2007-5185
    40Plan

    Multiple PHP remote file inclusion vulnerabilities in phpWCMS XT 0.0.7 BETA and earlier allow remote attackers to execute arbitrary PHP code

    MediumCVSS 6.8Proof of conceptEPSS 42%

    phpwcms-xt · phpwcms-xtOct 3, 2007

  • CVE-2007-5186
    41Plan

    PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attack

    MediumCVSS 6.8Proof of conceptEPSS 46%

    segue cms · segue cmsOct 3, 2007

  • CVE-2007-5217
    40Plan

    Stack-based buffer overflow in the ADM4 ActiveX control in adm4.dll in Altnet Download Manager 4.0.0.6, as used in (1) Kazaa 3.2.7 and (2) G

    MediumCVSS 6.8WeaponizedEPSS 29%

    altnet · altnet download managerOct 4, 2007

  • CVE-2007-5219
    30Monitor

    Directory traversal vulnerability in the CLAVSetting.CLSetting.1 ActiveX control in CLAVSetting.DLL 1.00.1829 in the CLAVSetting module in C

    MediumCVSS 6.4Proof of conceptEPSS 15%

    cyberlink · powerdvdOct 4, 2007

  • CVE-2007-4990
    33Monitor

    The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) Quer

    HighCVSS 7.5No exploitEPSS 10%

    x.org · x font serverOct 5, 2007

  • CVE-2007-5234
    43Plan

    PHP remote file inclusion vulnerability in upload/common/footer.php in Ossigeno CMS 2.2 alpha3 allows remote attackers to execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 42%

    ossigeno · ossigenoOct 5, 2007

  • CVE-2007-5243
    49Plan

    Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote a

    CriticalCVSS 9.3WeaponizedEPSS 40%

    borland software · interbaseOct 6, 2007

  • CVE-2007-5244
    48Plan

    Stack-based buffer overflow in Borland InterBase LI 8.0.0.53 through 8.1.0.253 on Linux, and possibly unspecified versions on Solaris, allow

    CriticalCVSS 9.3WeaponizedEPSS 37%

    borland software · interbaseOct 6, 2007

  • CVE-2007-5257
    45Plan

    Stack-based buffer overflow in the EDraw.OfficeViewer ActiveX control in officeviewer.ocx in EDraw Office Viewer Component 5.3.220.1 and ear

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    edraw · office viewer componentOct 6, 2007

  • CVE-2007-4924
    23Monitor

    The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to caus

    MediumCVSS 5.0Proof of conceptEPSS 10%

    ekiga · ekigaOct 8, 2007

  • CVE-2007-5271
    36Monitor

    Multiple PHP remote file inclusion vulnerabilities in Trionic Cite CMS 1.2 rev9 and earlier allow remote attackers to execute arbitrary PHP

    MediumCVSS 6.8Proof of conceptEPSS 28%

    trionic · cite cmsOct 8, 2007

  • CVE-2007-5301
    30Monitor

    Buffer overflow in the vorbis_stream_info function in input/vorbis/vorbis_engine.c (aka the vorbis input plugin) in AlsaPlayer before 0.99.8

    MediumCVSS 6.8Proof of conceptEPSS 10%

    alsaplayer · alsaplayerOct 9, 2007

  • CVE-2007-5315
    39Monitor

    PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when register_globals is enabled, allows remote attackers to execu

    MediumCVSS 6.8Proof of conceptEPSS 38%

    softpedia · livealbumOct 9, 2007

  • CVE-2007-2217
    49Plan

    Kodak Image Viewer in Microsoft Windows 2000 SP4, and in some cases XP SP2 and Server 2003 SP1 and SP2, allows remote attackers to execute a

    CriticalCVSS 9.3Proof of conceptEPSS 41%

    microsoft · windows 2000Oct 9, 2007

  • CVE-2007-2228
    44Plan

    rpcrt4.dll (aka the RPC runtime library) in Microsoft Windows XP SP2, XP Professional x64 Edition, Server 2003 SP1 and SP2, Server 2003 x64

    HighCVSS 7.8No exploitEPSS 43%

    microsoft · windows 2000Oct 9, 2007

  • CVE-2007-3892
    38Monitor

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to spoof the URL address bar and other "trust UI" components via unspecif

    HighCVSS 7.5No exploitEPSS 25%

    microsoft · internet explorerOct 9, 2007

  • CVE-2007-3893
    34Monitor

    Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via unspecified ve

    MediumCVSS 6.8No exploitEPSS 24%

    microsoft · internet explorerOct 9, 2007

  • CVE-2007-3897
    53Plan

    Heap-based buffer overflow in Microsoft Outlook Express 6 and earlier, and Windows Mail for Vista, allows remote Network News Transfer Proto

    CriticalCVSS 9.3No exploitEPSS 54%

    microsoft · outlook expressOct 9, 2007

  • CVE-2007-3899
    46Plan

    Unspecified vulnerability in Microsoft Word 2000 SP3, Word 2002 SP3, and Office 2004 for Mac allows user-assisted remote attackers to execut

    CriticalCVSS 9.3No exploitEPSS 29%

    microsoft · officeOct 9, 2007

  • CVE-2007-4466
    40Plan

    Multiple stack-based buffer overflows in Electronic Arts (EA) SnoopyCtrl ActiveX control (NPSnpy.dll) allow remote attackers to execute arbi

    MediumCVSS 6.8WeaponizedEPSS 30%

    electronic arts · snoopyctrlOct 9, 2007

  • CVE-2007-5322
    36Monitor

    Insecure method vulnerability in the FPOLE.OCX 6.0.8450.0 ActiveX control in Microsoft Visual FoxPro 6.0 allows remote attackers to execute

    HighCVSS 7.5Proof of conceptEPSS 18%

    microsoft · visual foxproOct 9, 2007

  • CVE-2007-3896
    53Plan

    The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows rem

    CriticalCVSS 9.3Proof of conceptEPSS 53%

    microsoft · windows 2003 serverOct 10, 2007

  • CVE-2007-5362
    38Monitor

    Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia Lite (com_mosmedia) 4.5.1 component for Mambo and J

    MediumCVSS 6.8Proof of conceptEPSS 36%

    mambo · mamboOct 10, 2007

  • CVE-2007-5363
    36Monitor

    PHP remote file inclusion vulnerability in admin.panoramic.php in the Panoramic Picture Viewer (com_panoramic) mambot (plugin) 1.0 for Jooml

    MediumCVSS 6.8Proof of conceptEPSS 31%

    joomla · joomlaOct 10, 2007

  • CVE-2007-5169
    40Plan

    Stack-based buffer overflow in MAIPM6.dll in Adobe PageMaker 7.0.1 and 7.0.2 on Windows allows user-assisted remote attackers to execute arb

    CriticalCVSS 9.3No exploitEPSS 10%

    adobe · pagemakerOct 11, 2007

  • CVE-2007-5365
    52Plan

    Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementati

    HighCVSS 7.2Proof of conceptEPSS 80%

    openbsd · openbsdOct 11, 2007

  • CVE-2007-5381
    41Plan

    Stack-based buffer overflow in the Line Printer Daemon (LPD) in Cisco IOS before 12.2(18)SXF11, 12.4(16a), and 12.4(2)T6 allow remote attack

    CriticalCVSS 9.3Proof of conceptEPSS 14%

    cisco · iosOct 11, 2007

  • CVE-2007-5387
    36Monitor

    PHP remote file inclusion vulnerability in active/components/xmlrpc/client.php in Pindorama 0.1 allows remote attackers to execute arbitrary

    MediumCVSS 6.8Proof of conceptEPSS 28%

    pindorama · pindoramaOct 12, 2007

  • CVE-2007-5388
    39Monitor

    Multiple PHP remote file inclusion vulnerabilities in WebDesktop 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the (

    MediumCVSS 6.8Proof of conceptEPSS 38%

    webdesktop · webdesktopOct 12, 2007

  • CVE-2007-5407
    39Monitor

    Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! allow remote attackers

    MediumCVSS 6.8Proof of conceptEPSS 40%

    joomlaequipment · jcontentsubscriptionOct 12, 2007

  • CVE-2007-5412
    38Monitor

    Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass (com_mp3_allopass) 1.0 component for Joomla! allow remote at

    MediumCVSS 6.8Proof of conceptEPSS 37%

    quoc-huy · mp3 allopassOct 12, 2007

  • CVE-2007-5423
    53Plan

    tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which

    HighCVSS 7.5WeaponizedEPSS 76%

    tiki · tikiwiki cms\/groupwareOct 12, 2007

  • CVE-2007-5208
    50Plan

    hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute

    HighCVSS 7.6WeaponizedEPSS 67%

    hp · linux imaging and printing projectOct 12, 2007

  • CVE-2007-5325
    44Plan

    Multiple buffer overflows in (1) the Message Engine and (2) AScore.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise

    CriticalCVSS 10.0No exploitEPSS 11%

    broadcom · brightstor arcserve backupOct 12, 2007

  • CVE-2007-5326
    44Plan

    Multiple buffer overflows in (1) RPC and (2) rpcx.dll in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, all

    CriticalCVSS 10.0No exploitEPSS 11%

    ca · brightstor arcserve backupOct 12, 2007

  • CVE-2007-5327
    45Plan

    Stack-based buffer overflow in the RPC interface for the Message Engine (mediasvr.exe) in CA BrightStor ARCServe BackUp v9.01 through R11.5,

    CriticalCVSS 10.0No exploitEPSS 16%

    broadcom · brightstor arcserve backupOct 12, 2007

  • CVE-2007-5330
    44Plan

    The cadbd RPC service in CA BrightStor ARCServe BackUp v9.01 through R11.5, and Enterprise Backup r10.5, allows remote attackers to (1) exec

    CriticalCVSS 10.0No exploitEPSS 13%

    broadcom · brightstor arcserve backupOct 12, 2007

  • CVE-2007-4995
    40Plan

    Off-by-one error in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8f allows remote attackers to execute arbitrary code via unspecified

    CriticalCVSS 9.3No exploitEPSS 10%

    openssl · opensslOct 12, 2007

  • CVE-2007-5451
    36Monitor

    PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla! allows remote attac

    MediumCVSS 6.8Proof of conceptEPSS 31%

    joomla · joomlaOct 14, 2007

  • CVE-2007-5456
    36Monitor

    Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download a

    HighCVSS 7.5No exploitEPSS 19%

    microsoft · internet explorerOct 14, 2007

  • CVE-2007-5457
    38Monitor

    Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (com_jfu or com_joomla_flash_uploader) 2.5.1 com

    MediumCVSS 6.8Proof of conceptEPSS 37%

    joomla · joomlaOct 14, 2007

  • CVE-2007-5461
    26Monitor

    Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, un

    LowCVSS 3.5Proof of conceptEPSS 39%

    apache · tomcatOct 15, 2007

  • CVE-2007-5466
    46Plan

    Multiple buffer overflows in eXtremail 2.1.1 and earlier allow remote attackers to (1) have an unknown impact by sending multiple long strin

    CriticalCVSS 10.0Proof of conceptEPSS 19%

    extremail · extremailOct 15, 2007

  • CVE-2007-5467
    44Plan

    Integer overflow in eXtremail 2.1.1 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary code, v

    CriticalCVSS 10.0Proof of conceptEPSS 13%

    extremail · extremailOct 15, 2007

  • CVE-2007-5511
    40Plan

    SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attacke

    MediumCVSS 6.5WeaponizedEPSS 31%

    oracle · database serverOct 17, 2007

  • CVE-2007-5574
    35Monitor

    PHP remote file inclusion vulnerability in djpage.php in PHPDJ 0.5 allows remote attackers to execute arbitrary PHP code via a URL in the pa

    MediumCVSS 6.8Proof of conceptEPSS 27%

    phpdj · phpdjOct 18, 2007

  • CVE-2007-5592
    36Monitor

    Multiple PHP remote file inclusion vulnerabilities in awzMB 4.2 beta 1 and earlier allow remote attackers to execute arbitrary PHP code via

    MediumCVSS 6.8Proof of conceptEPSS 28%

    awzmb · awzmbOct 19, 2007

  • CVE-2007-5601
    50Plan

    Stack-based buffer overflow in the Database Component in MPAMedia.dll in RealNetworks RealPlayer 10.5 and 11 beta, and earlier versions incl

    CriticalCVSS 9.3WeaponizedEPSS 42%

    realnetworks · realplayerOct 20, 2007

  • CVE-2007-5628
    35Monitor

    PHP remote file inclusion vulnerability in src/scripture.php in The Online Web Library Site (TOWels) 0.1 allows remote attackers to execute

    MediumCVSS 6.8Proof of conceptEPSS 27%

    towels · towelsOct 23, 2007

  • CVE-2007-5631
    39Monitor

    Multiple PHP remote file inclusion vulnerabilities in PeopleAggregator 1.2pre6, when register_globals is enabled, allow remote attackers to

    MediumCVSS 6.8Proof of conceptEPSS 39%

    peopleaggregator · peopleaggregatorOct 23, 2007

  • CVE-2007-5641
    39Monitor

    Multiple PHP remote file inclusion vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to execute arbitrary

    MediumCVSS 6.8Proof of conceptEPSS 40%

    phppm · php project managementOct 23, 2007

  • CVE-2007-5654
    32Monitor

    LiteSpeed Web Server before 3.2.4 allows remote attackers to trigger use of an arbitrary MIME type for a file via a "%00." sequence followed

    MediumCVSS 5.0Proof of conceptEPSS 41%

    litespeed technologies · litespeed web serverOct 23, 2007

  • CVE-2007-5709
    40Plan

    Stack-based buffer overflow in Sony SonicStage CONNECT Player (CP) 4.3 allows remote attackers to execute arbitrary code via a long file nam

    CriticalCVSS 9.3Proof of conceptEPSS 10%

    sony · sonicstage connect playerOct 30, 2007

  • CVE-2007-5722
    34Monitor

    Stack-based buffer overflow in a certain ActiveX control in GLChat.ocx 2.5.1.32 in GlobalLink 2.7.0.8, as used in Ourgame GLWorld and possib

    HighCVSS 7.5Proof of conceptEPSS 11%

    ourgame.com · globallinkOct 30, 2007

  • CVE-2007-5728
    21Monitor

    Cross-site scripting (XSS) vulnerability in phpPgAdmin 3.5 to 4.1.1, and possibly 4.1.2, allows remote attackers to inject arbitrary web scr

    MediumCVSS 4.3Proof of conceptEPSS 14%

    phppgadmin · phppgadminOct 30, 2007

  • CVE-2007-5740
    34Monitor

    The format string protection mechanism in IMAPD for Perdition Mail Retrieval Proxy 1.17 and earlier allows remote attackers to execute arbit

    HighCVSS 7.5Proof of conceptEPSS 12%

    vergenet · perdition mail retrieval proxyOct 31, 2007