# CVEs published 2007-01-04

31 CVEs were published on January 4, 2007: 1 critical, 0 high. Days are UTC.

- [CVE-2006-6859](https://cve.now/CVE-2006-6859.md): SQL injection vulnerability in coupon\_detail.asp in Website Designs For Less Click N' Print Coupons 2005.01 and earlier allows remote attack (no CVSS)
- [CVE-2006-6860](https://cve.now/CVE-2006-6860.md): Buffer overflow in the sendToMythTV function in MythControlServer.c in MythControl 1.0 and earlier allows remote attackers to execute arbitr (no CVSS)
- [CVE-2006-6861](https://cve.now/CVE-2006-6861.md): Multiple SQL injection vulnerabilities in Outfront Spooky Login 2.7 allow remote attackers to execute arbitrary SQL commands via (1) the Use (no CVSS)
- [CVE-2006-6862](https://cve.now/CVE-2006-6862.md): Multiple cross-site scripting (XSS) vulnerabilities in Outfront Spooky Login 2.7 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2006-6863](https://cve.now/CVE-2006-6863.md): PHP remote file inclusion vulnerability in the Enigma2 plugin (Enigma2.php) in Enigma WordPress Bridge allows remote attackers to execute ar (CVSS 9.8)
- [CVE-2006-6864](https://cve.now/CVE-2006-6864.md): PHP remote file inclusion vulnerability in E2\_header.inc.php in Enigma2 Coppermine Bridge 1.0 allows remote attackers to execute arbitrary P (no CVSS)
- [CVE-2006-6865](https://cve.now/CVE-2006-6865.md): Directory traversal vulnerability in SAFileUpSamples/util/viewsrc.asp in SoftArtisans FileUp (SAFileUp) 5.0.14 allows remote attackers to re (no CVSS)
- [CVE-2006-6866](https://cve.now/CVE-2006-6866.md): STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to ob (no CVSS)
- [CVE-2006-6867](https://cve.now/CVE-2006-6867.md): Multiple PHP remote file inclusion vulnerabilities in Vladimir Menshakov buratinable templator (aka bubla) 0.9.1 allow remote attackers to e (no CVSS)
- [CVE-2006-6868](https://cve.now/CVE-2006-6868.md): Multiple cross-site scripting (XSS) vulnerabilities in Zen Cart Web Shopping Cart before 1.3.7 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-6869](https://cve.now/CVE-2006-6869.md): Directory traversal vulnerability in includes/search/search\_mdforum.php in MAXdev MDForum 2.0.1 and earlier, when magic\_quotes\_gpc is disabl (no CVSS)
- [CVE-2007-0052](https://cve.now/CVE-2007-0052.md): SQL injection vulnerability in haberdetay.asp in Vizayn Haber allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2007-0053](https://cve.now/CVE-2007-0053.md): SQL injection vulnerability in detail.asp in ASP SiteWare autoDealer 2.0 and earlier allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-0054](https://cve.now/CVE-2007-0054.md): Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-0055](https://cve.now/CVE-2007-0055.md): Directory traversal vulnerability in formbankcgi.exe/AbfrageForm in Formbankserver 1.9 allows remote attackers to read arbitrary files via d (no CVSS)
- [CVE-2007-0056](https://cve.now/CVE-2007-0056.md): Multiple cross-site scripting (XSS) vulnerabilities in AShop Deluxe 4.5 and AShop Administration Panel allow remote attackers to inject arbi (no CVSS)
- [CVE-2007-0057](https://cve.now/CVE-2007-0057.md): Cisco Clean Access (CCA) 3.6.x through 3.6.4.2 and 4.0.x through 4.0.3.2 does not properly configure or allow modification of a shared secre (no CVSS)
- [CVE-2007-0058](https://cve.now/CVE-2007-0058.md): Cisco Clean Access (CCA) 3.5.x through 3.5.9 and 3.6.x through 3.6.1.1 on the Clean Access Manager (CAM) allows remote attackers to bypass a (no CVSS)
- [CVE-2007-0051](https://cve.now/CVE-2007-0051.md): Format string vulnerability in Apple iPhoto 6.0.5 (316), and other versions before 6.0.6, allows remote user-assisted attackers to execute a (no CVSS)
- [CVE-2006-5870](https://cve.now/CVE-2006-5870.md): Multiple integer overflows in OpenOffice.org (OOo) 2.0.4 and earlier, and possibly other versions before 2.1.0; and StarOffice 6 through 8; (no CVSS)
- [CVE-2006-6858](https://cve.now/CVE-2006-6858.md): Miredo 0.9.8 through 1.0.5 does not properly authenticate a Teredo bubble during UDP hole punching with HMAC-MD5-64 hashing, which allows re (no CVSS)
- [CVE-2007-0049](https://cve.now/CVE-2007-0049.md): Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified (no CVSS)
- [CVE-2007-0050](https://cve.now/CVE-2007-0050.md): PHP remote file inclusion vulnerability in index.php in OpenPinboard 2.0 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2006-5749](https://cve.now/CVE-2006-5749.md): The isdn\_ppp\_ccp\_reset\_alloc\_state function in drivers/isdn/isdn\_ppp.c in the Linux 2.4 kernel before 2.4.34-rc4 does not call the init\_time (no CVSS)
- [CVE-2006-6851](https://cve.now/CVE-2006-6851.md): Multiple cross-site scripting (XSS) vulnerabilities in contact\_us.php in ac4p Mobilelib gold 2 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2006-6852](https://cve.now/CVE-2006-6852.md): Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspec (no CVSS)
- [CVE-2006-6853](https://cve.now/CVE-2006-6853.md): Buffer overflow in Durian Web Application Server 3.02 freeware on Windows allows remote attackers to execute arbitrary code via a long strin (no CVSS)
- [CVE-2006-6854](https://cve.now/CVE-2006-6854.md): The qcamvc\_video\_init function in qcamvc.c in De Marchi Daniele QuickCam VC Linux device driver (aka quickcam-vc) 1.0.9 and earlier does not (no CVSS)
- [CVE-2006-6855](https://cve.now/CVE-2006-6855.md): AIDeX Mini-WebServer 1.1 early release 3 allows remote attackers to cause a denial of service (daemon crash) via a flood of HTTP GET request (no CVSS)
- [CVE-2006-6856](https://cve.now/CVE-2006-6856.md): Direct static code injection vulnerability in WebText CMS 0.4.5.2 and earlier allows remote attackers to inject arbitrary PHP code into a sc (no CVSS)
- [CVE-2006-6857](https://cve.now/CVE-2006-6857.md): Cross-site scripting (XSS) vulnerability in modules/credits/credits.php in Docebo LMS allows remote attackers to inject arbitrary web script (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.