# CVEs published 2007-01-05

52 CVEs were published on January 5, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-6888](https://cve.now/CVE-2006-6888.md): P-News 1.16 and 1.17 store sensitive information under the web root with insufficient access control, which allows remote attackers to obtai (no CVSS)
- [CVE-2006-6889](https://cve.now/CVE-2006-6889.md): FreeStyle Wiki (fswiki) 3.6.2 and earlier stores sensitive information under the web root with insufficient access control, which allows rem (no CVSS)
- [CVE-2006-6890](https://cve.now/CVE-2006-6890.md): Voodoo chat 1.0RC1b stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl (no CVSS)
- [CVE-2006-6891](https://cve.now/CVE-2006-6891.md): Vz (Adp) Forum 2.0.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obta (no CVSS)
- [CVE-2006-6892](https://cve.now/CVE-2006-6892.md): Cross-site scripting (XSS) vulnerability in the GetLocation function in online.php in Jonathon J. (no CVSS)
- [CVE-2007-0086](https://cve.now/CVE-2007-0086.md): The Apache HTTP Server, when accessed through a TCP connection with a large window size, allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2007-0087](https://cve.now/CVE-2007-0087.md): Microsoft Internet Information Services (IIS), when accessed through a TCP connection with a large window size, allows remote attackers to c (no CVSS)
- [CVE-2007-0088](https://cve.now/CVE-2007-0088.md): Multiple directory traversal vulnerabilities in openmedia allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-0089](https://cve.now/CVE-2007-0089.md): jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database (no CVSS)
- [CVE-2007-0090](https://cve.now/CVE-2007-0090.md): WineGlass stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a data (no CVSS)
- [CVE-2007-0091](https://cve.now/CVE-2007-0091.md): newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a da (no CVSS)
- [CVE-2007-0092](https://cve.now/CVE-2007-0092.md): SQL injection vulnerability in productdetail.asp in E-SMARTCART 1.0 allows remote attackers to execute arbitrary SQL commands via the produc (no CVSS)
- [CVE-2007-0093](https://cve.now/CVE-2007-0093.md): SQL injection vulnerability in page.php in Simple Web Content Management System allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2007-0094](https://cve.now/CVE-2007-0094.md): Sven Moderow GuestBook 0.3a stores sensitive information under the web root with insufficient access control, which allows remote attackers (no CVSS)
- [CVE-2007-0095](https://cve.now/CVE-2007-0095.md): phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue\_orange/layout.inc.php, w (no CVSS)
- [CVE-2007-0096](https://cve.now/CVE-2007-0096.md): CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to downloa (no CVSS)
- [CVE-2007-0097](https://cve.now/CVE-2007-0097.md): Multiple stack-based buffer overflows in the (1) LoadTree and (2) ReadHeader functions in PAISO.DLL 1.7.3.0 (1.7.3 beta) in ConeXware PowerA (no CVSS)
- [CVE-2007-0098](https://cve.now/CVE-2007-0098.md): Directory traversal vulnerability in language.php in VerliAdmin 0.3 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers (no CVSS)
- [CVE-2006-6881](https://cve.now/CVE-2006-6881.md): Buffer overflow in the Get\_Wep function in cofvnet.c for ATMEL Linux PCI PCMCIA USB Drivers drivers 3.4.1.1 corruption allows attackers to e (no CVSS)
- [CVE-2006-6882](https://cve.now/CVE-2006-6882.md): Cross-site scripting (XSS) vulnerability in golden book allows remote attackers to inject arbitrary web script or HTML via unspecified vecto (no CVSS)
- [CVE-2006-6883](https://cve.now/CVE-2006-6883.md): PHP remote file inclusion vulnerability in php4you.php in PHPIrc\_bot 0.2 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2006-6884](https://cve.now/CVE-2006-6884.md): Buffer overflow in the WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software "FileView" ActiveX control) for WinZip 10.0 Build 6667 a (no CVSS)
- [CVE-2006-6885](https://cve.now/CVE-2006-6885.md): An ActiveX control in SwDir.dll in Macromedia Shockwave 10 allows remote attackers to cause a denial of service (Internet Explorer 7 crash) (no CVSS)
- [CVE-2006-6886](https://cve.now/CVE-2006-6886.md): phpwcms 1.2.5-DEV allows remote attackers to obtain sensitive information via a direct request for (1) files.public-userroot.inc.php or (2) (no CVSS)
- [CVE-2006-6887](https://cve.now/CVE-2006-6887.md): Unrestricted file upload vulnerability in logahead UNU 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified (no CVSS)
- [CVE-2007-0075](https://cve.now/CVE-2007-0075.md): AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database (no CVSS)
- [CVE-2007-0076](https://cve.now/CVE-2007-0076.md): Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a data (no CVSS)
- [CVE-2007-0077](https://cve.now/CVE-2007-0077.md): lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database (no CVSS)
- [CVE-2007-0078](https://cve.now/CVE-2007-0078.md): BattleBlog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a dat (no CVSS)
- [CVE-2007-0079](https://cve.now/CVE-2007-0079.md): rblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database (no CVSS)
- [CVE-2007-0080](https://cve.now/CVE-2007-0080.md): Buffer overflow in the SMB\_Connect\_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the (no CVSS)
- [CVE-2007-0081](https://cve.now/CVE-2007-0081.md): Sunbelt Kerio Personal Firewall (SKPF) 4.3.268 and 4.3.246, and possibly other versions allows local users to provide a Trojan horse iphlpap (no CVSS)
- [CVE-2007-0082](https://cve.now/CVE-2007-0082.md): users\_adm/start1.php in IMGallery 2.5 and earlier does not properly handle files with multiple extensions, which allows remote authenticated (no CVSS)
- [CVE-2007-0083](https://cve.now/CVE-2007-0083.md): Cross-site scripting (XSS) vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a (no CVSS)
- [CVE-2007-0084](https://cve.now/CVE-2007-0084.md): Buffer overflow in the Windows NT Message Compiler (MC) 1.00.5239 on Microsoft Windows XP allows local users to gain privileges via a long M (no CVSS)
- [CVE-2007-0085](https://cve.now/CVE-2007-0085.md): Unspecified vulnerability in sys/dev/pci/vga\_pci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled (no CVSS)
- [CVE-2003-1316](https://cve.now/CVE-2003-1316.md): mod.php in eNdonesia 8.2 allows remote attackers to obtain sensitive information via a ' (quote) value in the lng parameter, which reveals t (no CVSS)
- [CVE-2003-1317](https://cve.now/CVE-2003-1317.md): Cross-site scripting (XSS) vulnerability in mod.php in eNdonesia 8.2 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2004-2670](https://cve.now/CVE-2004-2670.md): Multiple cross-site scripting (XSS) vulnerabilities in mod.php in eNdonesia 8.3 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2004-2671](https://cve.now/CVE-2004-2671.md): mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with inva (no CVSS)
- [CVE-2006-6871](https://cve.now/CVE-2006-6871.md): Multiple cross-site scripting (XSS) vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via (1) t (no CVSS)
- [CVE-2006-6872](https://cve.now/CVE-2006-6872.md): Directory traversal vulnerability in mod.php in eNdonesia 8.4 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2006-6873](https://cve.now/CVE-2006-6873.md): Multiple SQL injection vulnerabilities in mod.php in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via (1) the did (no CVSS)
- [CVE-2006-6874](https://cve.now/CVE-2006-6874.md): Multiple cross-site scripting (XSS) vulnerabilities in friend.php in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-6875](https://cve.now/CVE-2006-6875.md): Buffer overflow in the validateospheader function in the Open Settlement Protocol (OSP) module in OpenSER 1.1.0 and earlier allows remote at (no CVSS)
- [CVE-2006-6876](https://cve.now/CVE-2006-6876.md): Buffer overflow in the fetchsms function in the SMS handling module (libsms\_getsms.c) in OpenSER 1.2.0 and earlier allows remote attackers t (no CVSS)
- [CVE-2006-6877](https://cve.now/CVE-2006-6877.md): Directory traversal vulnerability in index.php in Matteo Lucarelli 3editor CMS 0.42 and earlier, when register\_globals is enabled, allows re (no CVSS)
- [CVE-2006-6878](https://cve.now/CVE-2006-6878.md): admin/uploads.php in PHP-Update 2.7 and earlier allows remote attackers to gain privileges by setting the rights\[7\] parameter to 1 during a (no CVSS)
- [CVE-2006-6879](https://cve.now/CVE-2006-6879.md): Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated users to upload arbitr (no CVSS)
- [CVE-2006-6880](https://cve.now/CVE-2006-6880.md): Multiple SQL injection vulnerabilities in code/guestadd.php in PHP-Update 2.7 and earlier allow remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2006-6870](https://cve.now/CVE-2006-6870.md): The consume\_labels function in avahi-core/dns.c in Avahi before 0.6.16 allows remote attackers to cause a denial of service (infinite loop) (no CVSS)
- [CVE-2007-0059](https://cve.now/CVE-2007-0059.md): Cross-zone scripting vulnerability in Apple Quicktime 3 to 7.1.3 allows remote user-assisted attackers to execute arbitrary code and list fi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.