# CVEs published 2007-01-09

82 CVEs were published on January 9, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-1305](https://cve.now/CVE-2006-1305.md): Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers to cause a denial of service (memory exhaustion and interrupted (no CVSS)
- [CVE-2006-6101](https://cve.now/CVE-2006-6101.md): Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, all (no CVSS)
- [CVE-2006-6102](https://cve.now/CVE-2006-6102.md): Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allow (no CVSS)
- [CVE-2006-6103](https://cve.now/CVE-2006-6103.md): Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows (no CVSS)
- [CVE-2007-0024](https://cve.now/CVE-2007-0024.md): Integer overflow in the Vector Markup Language (VML) implementation (vgx.dll) in Microsoft Internet Explorer 5.01, 6, and 7 on Windows 2000 (no CVSS)
- [CVE-2007-0028](https://cve.now/CVE-2007-0028.md): Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which a (no CVSS)
- [CVE-2007-0029](https://cve.now/CVE-2007-0029.md): Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code (no CVSS)
- [CVE-2007-0030](https://cve.now/CVE-2007-0030.md): Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attackers to execute arbitrary code (no CVSS)
- [CVE-2007-0031](https://cve.now/CVE-2007-0031.md): Heap-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows user-assisted remote attack (no CVSS)
- [CVE-2007-0033](https://cve.now/CVE-2007-0033.md): Microsoft Outlook 2002 and 2003 allows user-assisted remote attackers to execute arbitrary code via a malformed VEVENT record in an .iCal me (no CVSS)
- [CVE-2007-0034](https://cve.now/CVE-2007-0034.md): Buffer overflow in the Advanced Search (Finder.exe) feature of Microsoft Outlook 2000, 2002, and 2003 allows user-assisted remote attackers (no CVSS)
- [CVE-2006-5574](https://cve.now/CVE-2006-5574.md): Unspecified vulnerability in the Brazilian Portuguese Grammar Checker in Microsoft Office 2003 and the Multilingual Interface for Office 200 (no CVSS)
- [CVE-2007-0027](https://cve.now/CVE-2007-0027.md): Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2, 2004 for Mac, and v.X for Mac allows remote attackers to execute arbitrary code via malformed (no CVSS)
- [CVE-2004-2673](https://cve.now/CVE-2004-2673.md): Multiple buffer overflows in ArGoSoft FTP Server before 1.4.1.6 allow remote authenticated users to cause a denial of service and possibly e (no CVSS)
- [CVE-2004-2674](https://cve.now/CVE-2004-2674.md): Directory traversal vulnerability in ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to determine the existence of arbi (no CVSS)
- [CVE-2004-2675](https://cve.now/CVE-2004-2675.md): ArGoSoft FTP Server before 1.4.1.6 allows remote authenticated users to cause a denial of service (crash) via a SITE PASS command with a lon (no CVSS)
- [CVE-2007-0157](https://cve.now/CVE-2007-0157.md): Array index error in the uri\_lookup function in the URI parser for neon 0.26.0 to 0.26.2, possibly only on 64-bit platforms, allows remote m (no CVSS)
- [CVE-2004-2672](https://cve.now/CVE-2004-2672.md): Unspecified vulnerability in ArGoSoft FTP server before 1.4.2.2 allows attackers to upload .lnk files via unknown vectors. (no CVSS)
- [CVE-2006-6911](https://cve.now/CVE-2006-6911.md): SQL injection vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2006-6912](https://cve.now/CVE-2006-6912.md): SQL injection vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors, (no CVSS)
- [CVE-2006-6913](https://cve.now/CVE-2006-6913.md): Unspecified vulnerability in phpMyFAQ 1.6.7 and earlier allows remote attackers to upload arbitrary PHP scripts via unspecified vectors. (no CVSS)
- [CVE-2007-0140](https://cve.now/CVE-2007-0140.md): SQL injection vulnerability in down.asp in Kolayindir Download (Yenionline) allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2007-0141](https://cve.now/CVE-2007-0141.md): Cross-site scripting (XSS) vulnerability in yald.php in Yet Another Link Directory 1.0 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2007-0142](https://cve.now/CVE-2007-0142.md): SQL injection vulnerability in orange.asp in ShopStoreNow E-commerce Shopping Cart allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-0143](https://cve.now/CVE-2007-0143.md): Multiple PHP remote file inclusion vulnerabilities in NUNE News Script 2.0pre2 allow remote attackers to execute arbitrary PHP code via a UR (no CVSS)
- [CVE-2007-0144](https://cve.now/CVE-2007-0144.md): Cross-site scripting (XSS) vulnerability in search.asp in Digitizing Quote And Ordering System 1.0 allows remote authenticated attackers to (no CVSS)
- [CVE-2007-0145](https://cve.now/CVE-2007-0145.md): PHP remote file inclusion vulnerability in bn\_smrep1.php in BinGoPHP News (BP News) 3.01 allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2007-0146](https://cve.now/CVE-2007-0146.md): Multiple cross-site scripting (XSS) vulnerabilities in Fix and Chips CMS 1.0 allow remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2007-0147](https://cve.now/CVE-2007-0147.md): Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers (no CVSS)
- [CVE-2007-0148](https://cve.now/CVE-2007-0148.md): Format string vulnerability in OmniGroup OmniWeb 5.5.1 allows remote attackers to cause a denial of service (application crash) or execute a (no CVSS)
- [CVE-2007-0149](https://cve.now/CVE-2007-0149.md): EMembersPro 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS)
- [CVE-2007-0150](https://cve.now/CVE-2007-0150.md): Multiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a UR (no CVSS)
- [CVE-2007-0151](https://cve.now/CVE-2007-0151.md): MitiSoft stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a datab (no CVSS)
- [CVE-2007-0152](https://cve.now/CVE-2007-0152.md): OhhASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databas (no CVSS)
- [CVE-2007-0153](https://cve.now/CVE-2007-0153.md): AJLogin 3.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a da (no CVSS)
- [CVE-2007-0154](https://cve.now/CVE-2007-0154.md): Webulas stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databa (no CVSS)
- [CVE-2007-0155](https://cve.now/CVE-2007-0155.md): HarikaOnline 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS)
- [CVE-2007-0156](https://cve.now/CVE-2007-0156.md): M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request t (no CVSS)
- [CVE-2006-6909](https://cve.now/CVE-2006-6909.md): Stack-based buffer overflow in http.c in Karl Dahlke Edbrowse (aka Command line editor browser) 3.1.3 allows remote attackers to execute arb (no CVSS)
- [CVE-2006-6910](https://cve.now/CVE-2006-6910.md): formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH\_INFO begins with Abfrage, allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2007-0128](https://cve.now/CVE-2007-0128.md): SQL injection vulnerability in info\_book.asp in Digirez 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the bo (no CVSS)
- [CVE-2007-0129](https://cve.now/CVE-2007-0129.md): SQL injection vulnerability in main.asp in LocazoList 2.01a beta5 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-0130](https://cve.now/CVE-2007-0130.md): SQL injection vulnerability in user.php in iGeneric iG Calendar 1.0 allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2007-0131](https://cve.now/CVE-2007-0131.md): JAMWiki before 0.5.0 does not properly check permissions during moves of "read-only or admin-only topics," which allows remote attackers to (no CVSS)
- [CVE-2007-0132](https://cve.now/CVE-2007-0132.md): SQL injection vulnerability in compare\_product.php in iGeneric iG Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-0133](https://cve.now/CVE-2007-0133.md): Multiple SQL injection vulnerabilities in display\_review.php in iGeneric iG Shop 1.4 and earlier allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-0134](https://cve.now/CVE-2007-0134.md): Multiple eval injection vulnerabilities in iGeneric iG Shop 1.0 allow remote attackers to execute arbitrary code via the action parameter, w (no CVSS)
- [CVE-2007-0135](https://cve.now/CVE-2007-0135.md): PHP remote file inclusion vulnerability in inc/init.inc.php in Aratix 0.2.2 beta 11 and earlier, when register\_globals is enabled, allows re (no CVSS)
- [CVE-2007-0136](https://cve.now/CVE-2007-0136.md): Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2007-0137](https://cve.now/CVE-2007-0137.md): Cross-site scripting (XSS) vulnerability in SimpleBoxes/SerendipityNZ Serene Bach 2.05R and earlier, and 2.08D and earlier in the 2.08 serie (no CVSS)
- [CVE-2007-0138](https://cve.now/CVE-2007-0138.md): formbankcgi.exe in Fersch Formbankserver 1.9, when the PATH\_INFO begins with (1) AbfrageForm or (2) EingabeForm, allows remote attackers to (no CVSS)
- [CVE-2007-0139](https://cve.now/CVE-2007-0139.md): Unspecified vulnerability in the DECnet-Plus 7.3-2 feature in DECnet/OSI 7.3-2 for OpenVMS ALPHA, and the DECnet-Plus 7.3 feature in DECnet/ (no CVSS)
- [CVE-2007-0115](https://cve.now/CVE-2007-0115.md): Static code injection vulnerability in Coppermine Photo Gallery 1.4.10 and earlier allows remote authenticated administrators to execute arb (no CVSS)
- [CVE-2007-0116](https://cve.now/CVE-2007-0116.md): Digger Solutions Intranet Open Source (IOS) stores sensitive information under the web root with insufficient access control, which allows r (no CVSS)
- [CVE-2007-0117](https://cve.now/CVE-2007-0117.md): DiskManagementTool in the DiskManagement.framework 92.29 on Mac OS X 10.4.8 does not properly validate Bill of Materials (BOM) files, which (no CVSS)
- [CVE-2007-0118](https://cve.now/CVE-2007-0118.md): Multiple absolute path traversal vulnerabilities in EditTag 1.2 allow remote attackers to read arbitrary files via an absolute pathname in t (no CVSS)
- [CVE-2007-0119](https://cve.now/CVE-2007-0119.md): Multiple cross-site scripting (XSS) vulnerabilities in EditTag 1.2 allow remote attackers to inject arbitrary web script or HTML via the pla (no CVSS)
- [CVE-2007-0120](https://cve.now/CVE-2007-0120.md): Acunetix Web Vulnerability Scanner (WVS) 4.0 Build 20060717 and earlier allows remote attackers to cause a denial of service (application cr (no CVSS)
- [CVE-2007-0121](https://cve.now/CVE-2007-0121.md): Cross-site scripting (XSS) vulnerability in search.asp in RI Blog 1.3 allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-0122](https://cve.now/CVE-2007-0122.md): Multiple SQL injection vulnerabilities in Coppermine Photo Gallery 1.4.10 and earlier allow remote authenticated administrators to execute a (no CVSS)
- [CVE-2007-0123](https://cve.now/CVE-2007-0123.md): Unrestricted file upload vulnerability in Uber Uploader 4.2 allows remote attackers to upload and execute arbitrary PHP scripts by naming th (no CVSS)
- [CVE-2007-0124](https://cve.now/CVE-2007-0124.md): Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a de (no CVSS)
- [CVE-2007-0125](https://cve.now/CVE-2007-0125.md): Kaspersky Labs Antivirus Engine 6.0 for Windows and 5.5-10 for Linux before 20070102 enter an infinite loop upon encountering an invalid Num (no CVSS)
- [CVE-2007-0126](https://cve.now/CVE-2007-0126.md): Heap-based buffer overflow in Opera 9.02 allows remote attackers to execute arbitrary code via a JPEG file with an invalid number of index b (no CVSS)
- [CVE-2007-0127](https://cve.now/CVE-2007-0127.md): The Javascript SVG support in Opera before 9.10 does not properly validate object types in a createSVGTransformFromMatrix request, which all (no CVSS)
- [CVE-2006-5755](https://cve.now/CVE-2006-5755.md): Linux kernel before 2.6.18, when running on x86\_64 systems, does not properly save or restore EFLAGS during a context switch, which allows l (no CVSS)
- [CVE-2006-5867](https://cve.now/CVE-2006-5867.md): fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances (no CVSS)
- [CVE-2006-5974](https://cve.now/CVE-2006-5974.md): fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial (no CVSS)
- [CVE-2006-6336](https://cve.now/CVE-2006-6336.md): Heap-based buffer overflow in the Mail Management Server (MAILMA.exe) in Eudora WorldMail 3.1.x allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-0102](https://cve.now/CVE-2007-0102.md): The Adobe PDF specification 1.3, as implemented by Apple Mac OS X Preview, allows remote attackers to have an unknown impact, possibly inclu (no CVSS)
- [CVE-2007-0103](https://cve.now/CVE-2007-0103.md): The Adobe PDF specification 1.3, as implemented by Adobe Acrobat before 8.0.0, allows remote attackers to have an unknown impact, possibly i (no CVSS)
- [CVE-2007-0104](https://cve.now/CVE-2007-0104.md): The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other (no CVSS)
- [CVE-2007-0105](https://cve.now/CVE-2007-0105.md): Stack-based buffer overflow in the CSAdmin service in Cisco Secure Access Control Server (ACS) for Windows before 4.1 and ACS Solution Engin (no CVSS)
- [CVE-2007-0106](https://cve.now/CVE-2007-0106.md): Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-0107](https://cve.now/CVE-2007-0107.md): WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote (no CVSS)
- [CVE-2007-0108](https://cve.now/CVE-2007-0108.md): nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/2003 does not delete user profiles during a Terminal Service or Citrix session, whi (no CVSS)
- [CVE-2007-0109](https://cve.now/CVE-2007-0109.md): wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obta (no CVSS)
- [CVE-2007-0110](https://cve.now/CVE-2007-0110.md): Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers (no CVSS)
- [CVE-2007-0111](https://cve.now/CVE-2007-0111.md): Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and 6.01, as used in mobile devices running Windows Mobile 5.0, 2003, and 2003SE, al (no CVSS)
- [CVE-2007-0112](https://cve.now/CVE-2007-0112.md): SQL injection vulnerability in cats.asp in createauction allows remote attackers to execute arbitrary SQL commands via the catid parameter. (no CVSS)
- [CVE-2007-0113](https://cve.now/CVE-2007-0113.md): Buffer overflow in Packeteer PacketShaper PacketWise 8.x allows remote authenticated users to cause a denial of service (reset or reboot) vi (no CVSS)
- [CVE-2007-0114](https://cve.now/CVE-2007-0114.md): Sun Java System Content Delivery Server 5.0 and 5.0 PU1 allows remote attackers to obtain sensitive information regarding "content details" (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.