# CVEs published 2007-12-20

75 CVEs were published on December 20, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6334](https://cve.now/CVE-2007-6334.md): Ingres 2.5 and 2.6 on Windows, as used in multiple CA products and possibly other products, assigns the privileges and identity of users… (no CVSS)
- [CVE-2007-6341](https://cve.now/CVE-2007-6341.md): Net/DNS/RR/A.pm in Net::DNS 0.60 build 654, as used in packages such as SpamAssassin and OTRS, allows remote attackers to cause a denial… (no CVSS)
- [CVE-2007-6349](https://cve.now/CVE-2007-6349.md): P4Webs.exe in Perforce P4Web 2006.2 and earlier, when running on Windows, allows remote attackers to cause a denial of service (CPU… (no CVSS)
- [CVE-2007-6505](https://cve.now/CVE-2007-6505.md): Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even… (no CVSS)
- [CVE-2007-6506](https://cve.now/CVE-2007-6506.md): The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including… (no CVSS)
- [CVE-2007-6507](https://cve.now/CVE-2007-6507.md): SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions… (no CVSS)
- [CVE-2007-6285](https://cve.now/CVE-2007-6285.md): The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not… (no CVSS)
- [CVE-2003-1538](https://cve.now/CVE-2003-1538.md): susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters… (no CVSS)
- [CVE-2007-6472](https://cve.now/CVE-2007-6472.md): Multiple SQL injection vulnerabilities in phpMyRealty (PMR) 1.0.9 allow (1) remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2007-6473](https://cve.now/CVE-2007-6473.md): Heap-based buffer overflow in Texas Imperial Software WFTPD Pro Explorer 1.0 allows remote FTP servers to execute arbitrary code via a… (no CVSS)
- [CVE-2007-6474](https://cve.now/CVE-2007-6474.md): Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2007-6475](https://cve.now/CVE-2007-6475.md): Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2007-6476](https://cve.now/CVE-2007-6476.md): GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php, which calls the… (no CVSS)
- [CVE-2007-6477](https://cve.now/CVE-2007-6477.md): Cross-site scripting (XSS) vulnerability in the on-line help feature in Citrix Web Interface 2.0 and earlier, and NFuse, allows remote… (no CVSS)
- [CVE-2007-6478](https://cve.now/CVE-2007-6478.md): Stack-based buffer overflow in Rosoft Media Player 4.1.7, 4.1.8, and possibly earlier versions allows remote attackers to execute… (no CVSS)
- [CVE-2007-6479](https://cve.now/CVE-2007-6479.md): Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile" page) in Dokeos… (no CVSS)
- [CVE-2007-6480](https://cve.now/CVE-2007-6480.md): The Oracle database component in Sun Management Center (Sun MC) 3.6.1, 3.6, and 3.5 Update 1 has a default account, which allows remote… (no CVSS)
- [CVE-2007-6481](https://cve.now/CVE-2007-6481.md): Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote… (no CVSS)
- [CVE-2007-6482](https://cve.now/CVE-2007-6482.md): Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote… (no CVSS)
- [CVE-2007-6483](https://cve.now/CVE-2007-6483.md): Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel… (no CVSS)
- [CVE-2007-6484](https://cve.now/CVE-2007-6484.md): SQL injection vulnerability in index.php in phpRPG 0.8 allows remote attackers to execute arbitrary SQL commands via the password parameter. (no CVSS)
- [CVE-2007-6485](https://cve.now/CVE-2007-6485.md): Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code… (no CVSS)
- [CVE-2007-6486](https://cve.now/CVE-2007-6486.md): Multiple cross-site scripting (XSS) vulnerabilities in shout.php (aka the shoutbox) in LineShout 1.0 allow remote attackers to inject… (no CVSS)
- [CVE-2007-6487](https://cve.now/CVE-2007-6487.md): Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to… (no CVSS)
- [CVE-2007-6488](https://cve.now/CVE-2007-6488.md): Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via… (no CVSS)
- [CVE-2007-6489](https://cve.now/CVE-2007-6489.md): Multiple cross-site scripting (XSS) vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2007-6490](https://cve.now/CVE-2007-6490.md): Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain… (no CVSS)
- [CVE-2007-6491](https://cve.now/CVE-2007-6491.md): Multiple SQL injection vulnerabilities in Kvaliitti WebDoc 3.0 CMS allow remote attackers to execute arbitrary SQL commands via (1) the… (no CVSS)
- [CVE-2007-6492](https://cve.now/CVE-2007-6492.md): The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x, and possibly IMWebControl.dll, in iMesh 7.1.0.x and earlier allows remote… (no CVSS)
- [CVE-2007-6493](https://cve.now/CVE-2007-6493.md): The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x, and possibly IMWebControl.dll, in iMesh 7.1.0.x and earlier allows remote… (no CVSS)
- [CVE-2007-6494](https://cve.now/CVE-2007-6494.md): Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp… (no CVSS)
- [CVE-2007-6495](https://cve.now/CVE-2007-6495.md): inc\_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permissions of… (no CVSS)
- [CVE-2007-6496](https://cve.now/CVE-2007-6496.md): Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp… (no CVSS)
- [CVE-2007-6497](https://cve.now/CVE-2007-6497.md): Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a request to… (no CVSS)
- [CVE-2007-6498](https://cve.now/CVE-2007-6498.md): Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute… (no CVSS)
- [CVE-2007-6499](https://cve.now/CVE-2007-6499.md): Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninstall the FrontPage… (no CVSS)
- [CVE-2007-6500](https://cve.now/CVE-2007-6500.md): Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to delete "gateway… (no CVSS)
- [CVE-2007-6501](https://cve.now/CVE-2007-6501.md): Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay… (no CVSS)
- [CVE-2007-6502](https://cve.now/CVE-2007-6502.md): Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and… (no CVSS)
- [CVE-2007-6503](https://cve.now/CVE-2007-6503.md): Multiple unspecified vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to (1) import an… (no CVSS)
- [CVE-2007-6504](https://cve.now/CVE-2007-6504.md): Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change… (no CVSS)
- [CVE-2007-5584](https://cve.now/CVE-2007-5584.md): Unspecified vulnerability in Cisco Firewall Services Module (FWSM) 3.2(3) allows remote attackers to cause a denial of service (device… (no CVSS)
- [CVE-2007-6351](https://cve.now/CVE-2007-6351.md): libexif 0.6.16 and earlier allows context-dependent attackers to cause a denial of service (infinite recursion) via an image file with… (no CVSS)
- [CVE-2007-6352](https://cve.now/CVE-2007-6352.md): Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF… (no CVSS)
- [CVE-2007-6430](https://cve.now/CVE-2007-6430.md): Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8… (no CVSS)
- [CVE-2007-6242](https://cve.now/CVE-2007-6242.md): Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown… (no CVSS)
- [CVE-2007-6243](https://cve.now/CVE-2007-6243.md): Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and… (no CVSS)
- [CVE-2007-6244](https://cve.now/CVE-2007-6244.md): Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers… (no CVSS)
- [CVE-2007-6245](https://cve.now/CVE-2007-6245.md): Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for… (no CVSS)
- [CVE-2007-6246](https://cve.now/CVE-2007-6246.md): Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for… (no CVSS)
- [CVE-2007-6335](https://cve.now/CVE-2007-6335.md): Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file… (no CVSS)
- [CVE-2007-6336](https://cve.now/CVE-2007-6336.md): Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file. (no CVSS)
- [CVE-2007-6353](https://cve.now/CVE-2007-6353.md): Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that… (no CVSS)
- [CVE-2007-5966](https://cve.now/CVE-2007-5966.md): Integer overflow in the hrtimer\_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute… (no CVSS)
- [CVE-2007-6281](https://cve.now/CVE-2007-6281.md): Heap-based buffer overflow in Open File Manager service (ofmnt.exe) in St. (no CVSS)
- [CVE-2007-6452](https://cve.now/CVE-2007-6452.md): Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit (GWT) before 1.4.61 has unknown impact and attack… (no CVSS)
- [CVE-2007-6453](https://cve.now/CVE-2007-6453.md): Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows… (no CVSS)
- [CVE-2007-6454](https://cve.now/CVE-2007-6454.md): Heap-based buffer overflow in the handshakeHTTP function in servhs.cpp in PeerCast 0.1217 and earlier, and SVN 344 and earlier, allows… (no CVSS)
- [CVE-2007-6455](https://cve.now/CVE-2007-6455.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2007-6456](https://cve.now/CVE-2007-6456.md): Unspecified vulnerability in OpenOffice.org code in Planamesa NeoOffice 2.2.2 before Patch 4 has unknown impact and attack vectors related… (no CVSS)
- [CVE-2007-6457](https://cve.now/CVE-2007-6457.md): Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service (crash) via a… (no CVSS)
- [CVE-2007-6458](https://cve.now/CVE-2007-6458.md): SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a… (no CVSS)
- [CVE-2007-6459](https://cve.now/CVE-2007-6459.md): Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the… (no CVSS)
- [CVE-2007-6460](https://cve.now/CVE-2007-6460.md): Multiple cross-site scripting (XSS) vulnerabilities in Anon Proxy Server before 0.101 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2007-6461](https://cve.now/CVE-2007-6461.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject… (no CVSS)
- [CVE-2007-6462](https://cve.now/CVE-2007-6462.md): SQL injection vulnerability in fullnews.php in PHP Real Estate Classifieds allows remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2007-6463](https://cve.now/CVE-2007-6463.md): Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in PHP Real Estate Classifieds allow remote attackers to inject… (no CVSS)
- [CVE-2007-6464](https://cve.now/CVE-2007-6464.md): Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in… (no CVSS)
- [CVE-2007-6465](https://cve.now/CVE-2007-6465.md): Multiple cross-site scripting (XSS) vulnerabilities in ganglia-web in Ganglia before 3.0.6 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2007-6466](https://cve.now/CVE-2007-6466.md): Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1)… (no CVSS)
- [CVE-2007-6467](https://cve.now/CVE-2007-6467.md): SQL injection vulnerability in index.php in MKPortal 1.1 RC1 allows remote attackers to execute arbitrary SQL commands via the ida… (no CVSS)
- [CVE-2007-6468](https://cve.now/CVE-2007-6468.md): Buffer overflow in the HuffDecode function in hw\_utils/hwrcon/huffman.c and hexenworld/Client/huffman.c in Hammer of Thyrion 1.4.2 allows… (no CVSS)
- [CVE-2007-6469](https://cve.now/CVE-2007-6469.md): SQL injection vulnerability in index.php in phpRPG 0.8, when magic\_qutoes\_gpc is disabled, allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2007-6470](https://cve.now/CVE-2007-6470.md): phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session… (no CVSS)
- [CVE-2007-6471](https://cve.now/CVE-2007-6471.md): Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2007-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.