# CVEs published 2007-01-11

44 CVEs were published on January 11, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-6918](https://cve.now/CVE-2006-6918.md): Unspecified vulnerability in the Admin login for Georgian discussion board (GeoBB) before 1.0 has unknown impact and attack vectors. (no CVSS)
- [CVE-2006-6919](https://cve.now/CVE-2006-6919.md): Firefox Sage extension 1.3.8 and earlier allows remote attackers to execute arbitrary Javascript in the local context via an RSS feed with a (no CVSS)
- [CVE-2006-6920](https://cve.now/CVE-2006-6920.md): Cross-site scripting (XSS) vulnerability in Nucleus before 3.24 allows remote attackers to inject arbitrary web script or HTML via unknown v (no CVSS)
- [CVE-2007-0168](https://cve.now/CVE-2007-0168.md): The Tape Engine service in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Busi (no CVSS)
- [CVE-2007-0169](https://cve.now/CVE-2007-0169.md): Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Bu (no CVSS)
- [CVE-2007-0205](https://cve.now/CVE-2007-0205.md): Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitra (no CVSS)
- [CVE-2006-6917](https://cve.now/CVE-2006-6917.md): Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup R11.5 Server before SP2 allows remote attackers to execute (no CVSS)
- [CVE-2007-0166](https://cve.now/CVE-2007-0166.md): The jail rc.d script in FreeBSD 5.3 up to 6.2 does not verify pathnames when writing to /var/log/console.log during a jail start-up, or when (no CVSS)
- [CVE-2007-0196](https://cve.now/CVE-2007-0196.md): SQL injection vulnerability in admin\_check\_user.asp in Motionborg Web Real Estate 2.1 and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2007-0197](https://cve.now/CVE-2007-0197.md): Finder 10.4.6 on Apple Mac OS X 10.4.8 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary cod (no CVSS)
- [CVE-2007-0198](https://cve.now/CVE-2007-0198.md): The JTapi Gateway process in Cisco Unified Contact Center Enterprise, Unified Contact Center Hosted, IP Contact Center Enterprise, and Cisco (no CVSS)
- [CVE-2007-0199](https://cve.now/CVE-2007-0199.md): The Data-link Switching (DLSw) feature in Cisco IOS 11.0 through 12.4 allows remote attackers to cause a denial of service (device reload) v (no CVSS)
- [CVE-2007-0200](https://cve.now/CVE-2007-0200.md): PHP remote file inclusion vulnerability in template.php in Geoffrey Golliher Axiom Photo/News Gallery (axiompng) 0.8.6 allows remote attacke (no CVSS)
- [CVE-2007-0201](https://cve.now/CVE-2007-0201.md): Buffer overflow in the cmd\_usr function in ftp-gw in TIS Internet Firewall Toolkit (FWTK) allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2007-0202](https://cve.now/CVE-2007-0202.md): SQL injection vulnerability in index.php in @lex Guestbook 4.0.2 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to (no CVSS)
- [CVE-2007-0203](https://cve.now/CVE-2007-0203.md): Multiple unspecified vulnerabilities in phpMyAdmin before 2.9.2-rc1 have unknown impact and attack vectors. (no CVSS)
- [CVE-2007-0204](https://cve.now/CVE-2007-0204.md): Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.9.2-rc1 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2006-6916](https://cve.now/CVE-2006-6916.md): Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to (no CVSS)
- [CVE-2007-0181](https://cve.now/CVE-2007-0181.md): PHP remote file inclusion vulnerability in include/common\_function.php in magic photo storage website allows remote attackers to execute arb (no CVSS)
- [CVE-2007-0182](https://cve.now/CVE-2007-0182.md): Multiple PHP remote file inclusion vulnerabilities in magic photo storage website allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-0183](https://cve.now/CVE-2007-0183.md): Cross-site scripting (XSS) vulnerability in /search in iPlanet Web Server 4.x allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-0184](https://cve.now/CVE-2007-0184.md): Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that (no CVSS, org.directwebremoting:dwr)
- [CVE-2007-0185](https://cve.now/CVE-2007-0185.md): Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unk (no CVSS, org.directwebremoting:dwr)
- [CVE-2007-0186](https://cve.now/CVE-2007-0186.md): Multiple cross-site scripting (XSS) vulnerabilities in F5 FirePass SSL VPN allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-0187](https://cve.now/CVE-2007-0187.md): F5 FirePass 5.4 through 5.5.2 and 6.0 allows remote attackers to access restricted URLs via (1) a trailing null byte, (2) multiple leading s (no CVSS)
- [CVE-2007-0188](https://cve.now/CVE-2007-0188.md): F5 FirePass 5.4 through 5.5.1 does not properly enforce host access restrictions when a client uses a single integer (dword) representation (no CVSS)
- [CVE-2007-0189](https://cve.now/CVE-2007-0189.md): PHP remote file inclusion vulnerability in index.php in GeoBB Georgian Bulletin Board allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-0190](https://cve.now/CVE-2007-0190.md): PHP remote file inclusion vulnerability in edit\_address.php in edit-x ecommerce allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-0191](https://cve.now/CVE-2007-0191.md): Cross-site scripting (XSS) vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two cer (no CVSS)
- [CVE-2007-0192](https://cve.now/CVE-2007-0192.md): Cross-site request forgery (CSRF) vulnerability in the save\_main operation in the ad\_perms section in admin.php in MKPortal allows remote at (no CVSS)
- [CVE-2007-0193](https://cve.now/CVE-2007-0193.md): FON La Fonera routers do not properly limit DNS service access by unauthenticated clients, which allows remote attackers to tunnel traffic v (no CVSS)
- [CVE-2007-0194](https://cve.now/CVE-2007-0194.md): admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MK\_PATH=1 query string, (no CVSS)
- [CVE-2007-0195](https://cve.now/CVE-2007-0195.md): my.activation.php3 in F5 FirePass 5.4 through 5.5.1 and 6.0 displays different error messages for failed login attempts with a valid usernam (no CVSS)
- [CVE-2007-0170](https://cve.now/CVE-2007-0170.md): PHP remote file inclusion vulnerability in index.php in AllMyVisitors 0.4.0 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-0171](https://cve.now/CVE-2007-0171.md): PHP remote file inclusion vulnerability in index.php in AllMyLinks 0.5.0 and earlier allows remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-0172](https://cve.now/CVE-2007-0172.md): Multiple PHP remote file inclusion vulnerabilities in AllMyGuests 0.3.0 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2007-0173](https://cve.now/CVE-2007-0173.md): Directory traversal vulnerability in index.php in L2J Statistik Script 0.09 and earlier, when register\_globals is enabled and magic\_quotes i (no CVSS)
- [CVE-2007-0174](https://cve.now/CVE-2007-0174.md): Multiple stack-based multiple buffer overflows in the BRWOSSRE2UC.dll ActiveX Control in Sina UC2006 and earlier allow remote attackers to e (no CVSS)
- [CVE-2007-0175](https://cve.now/CVE-2007-0175.md): Cross-site scripting (XSS) vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-0176](https://cve.now/CVE-2007-0176.md): Cross-site scripting (XSS) vulnerability in search/advanced\_search.php in GForge 4.5.11 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2007-0177](https://cve.now/CVE-2007-0177.md): Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1. (no CVSS)
- [CVE-2007-0178](https://cve.now/CVE-2007-0178.md): PHP remote file inclusion vulnerability in info.php in Easy Banner Pro 2.8 allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2007-0179](https://cve.now/CVE-2007-0179.md): SQL injection vulnerability in comment.php in PHPKIT 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the subid parame (no CVSS)
- [CVE-2007-0180](https://cve.now/CVE-2007-0180.md): Stack-based buffer overflow in EF Commander 5.75 allows user-assisted attackers to execute arbitrary code via a crafted ISO file containing (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.