Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2007

26 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-5775
    48Plan

    Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via unspecified vectors, aka EEYEB-20071024.

    CriticalCVSS 9.8Proof of conceptEPSS 29%

    bitdefender · antivirusNov 1, 2007

  • CVE-2007-5779
    51Plan

    Buffer overflow in the GomManager (GomWeb Control) ActiveX control in GomWeb3.dll 1.0.0.12 in Gretech Online Movie Player (GOM Player) 2.1.6

    HighCVSS 7.5WeaponizedEPSS 71%

    gom player · gom playerNov 1, 2007

  • CVE-2007-5781
    39Monitor

    PHP remote file inclusion vulnerability in inc/sige_init.php in Sige 0.1 allows remote attackers to execute arbitrary PHP code via a URL in

    MediumCVSS 6.8Proof of conceptEPSS 38%

    sige · sigeNov 1, 2007

  • CVE-2007-5660
    48Plan

    Unspecified vulnerability in the Update Service ActiveX control in isusweb.dll before 6.0.100.65101 in MacroVision FLEXnet Connect and Insta

    CriticalCVSS 9.3WeaponizedEPSS 36%

    macrovision · flexnet connectNov 2, 2007

  • CVE-2007-5800
    38Monitor

    Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to

    MediumCVSS 6.8Proof of conceptEPSS 36%

    wordpress · wordpressNov 2, 2007

  • CVE-2007-5603
    48Plan

    Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, al

    CriticalCVSS 9.3WeaponizedEPSS 37%

    sonicwall · ssl vpnNov 5, 2007

  • CVE-2007-5841
    36Monitor

    PHP remote file inclusion vulnerability in admin/index.php in nuBoard 0.5 allows remote attackers to execute arbitrary PHP code via a URL in

    MediumCVSS 6.8Proof of conceptEPSS 31%

    nuboard · nuboardNov 6, 2007

  • CVE-2007-5842
    41Plan

    Multiple PHP remote file inclusion vulnerabilities in Vortex Portal 1.0.42 allow remote attackers to execute arbitrary PHP code via a URL in

    MediumCVSS 6.8Proof of conceptEPSS 46%

    vortex portal · vortex portalNov 6, 2007

  • CVE-2007-5843
    38Monitor

    PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute arbitrary PHP code vi

    MediumCVSS 6.8Proof of conceptEPSS 37%

    scwiki · scwikiNov 6, 2007

  • CVE-2007-5846
    40Plan

    The SNMP agent (snmp_agent.c) in net-snmp before 5.4.1 allows remote attackers to cause a denial of service (CPU and memory consumption) via

    HighCVSS 7.8No exploitEPSS 28%

    net-snmp · net-snmpNov 6, 2007

  • CVE-2007-3751
    45Plan

    Unspecified vulnerability in QuickTime for Java in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via untruste

    CriticalCVSS 9.3No exploitEPSS 25%

    apple · quicktimeNov 7, 2007

  • CVE-2007-4675
    47Plan

    Heap-based buffer overflow in the QuickTime VR extension 7.2.0.240 in QuickTime.qts in Apple QuickTime before 7.3 allows remote attackers to

    CriticalCVSS 9.3No exploitEPSS 32%

    apple · quicktimeNov 7, 2007

  • CVE-2007-4676
    51Plan

    Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via malformed elements when parsi

    CriticalCVSS 9.3No exploitEPSS 46%

    apple · quicktimeNov 7, 2007

  • CVE-2007-4677
    51Plan

    Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via an invalid color table size w

    CriticalCVSS 9.3No exploitEPSS 46%

    apple · quicktimeNov 7, 2007

  • CVE-2007-5892
    45Plan

    Stack-based buffer overflow in the pdg2.dll ActiveX control in SSReader 4.0 and earlier allow remote attackers to execute arbitrary code via

    CriticalCVSS 10.0No exploitEPSS 17%

    ssreader · ultra star readerNov 7, 2007

  • CVE-2007-5909
    43Plan

    Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by Activ

    CriticalCVSS 9.3No exploitEPSS 20%

    autonomy · keyview export sdkNov 9, 2007

  • CVE-2007-5925
    19Monitor

    The convert_search_mode_to_innobase function in ha_innodb.cc in the InnoDB engine in MySQL 5.1.23-BK and earlier allows remote authenticated

    MediumCVSS 4.0Proof of conceptEPSS 11%

    mysql · mysqlNov 9, 2007

  • CVE-2007-3898
    41Plan

    The DNS server in Microsoft Windows 2000 Server SP4, and Server 2003 SP1 and SP2, uses predictable transaction IDs when querying other DNS s

    MediumCVSS 6.4Proof of conceptEPSS 52%

    microsoft · windows 2000Nov 13, 2007

  • CVE-2007-5755
    41Plan

    Multiple stack-based buffer overflows in the AOL AmpX ActiveX control in AmpX.dll 2.6.1.11 in AOL Radio allow remote attackers to execute ar

    CriticalCVSS 9.3WeaponizedEPSS 12%

    aol · radioNov 13, 2007

  • CVE-2007-5941
    50Plan

    Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a denial of service and p

    CriticalCVSS 10.0Proof of conceptEPSS 32%

    adobe · shockwave playerNov 13, 2007

  • CVE-2007-5905
    31Monitor

    Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a

    MediumCVSS 6.8No exploitEPSS 13%

    adobe · coldfusionNov 15, 2007

  • CVE-2007-5398
    40Plan

    Stack-based buffer overflow in the reply_netbios_packet function in nmbd/nmbd_packets.c in nmbd in Samba 3.0.0 through 3.0.26a, when operati

    CriticalCVSS 9.3No exploitEPSS 11%

    samba · sambaNov 16, 2007

  • CVE-2007-6026
    45Plan

    Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Microsoft Office 2003

    CriticalCVSS 9.3Proof of conceptEPSS 28%

    microsoft · jetNov 19, 2007

  • CVE-2007-6038
    35Monitor

    PHP remote file inclusion vulnerability in xajax_functions.php in the JUser (com_juser) 1.0.14 component for Joomla! allows remote attackers

    MediumCVSS 6.8Proof of conceptEPSS 27%

    joomlaequipment · juserNov 20, 2007

  • CVE-2007-6165
    50Plan

    Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment contai

    CriticalCVSS 9.3WeaponizedEPSS 44%

    apple · mac os xNov 28, 2007

  • CVE-2007-6166
    50Plan

    Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote

    CriticalCVSS 9.3WeaponizedEPSS 41%

    apple · quicktimeNov 28, 2007