# CVEs published 2007-01-18

38 CVEs were published on January 18, 2007: 0 critical, 1 high. Days are UTC.

- [CVE-2006-6489](https://cve.now/CVE-2006-6489.md): The SISCO OSI stack, as used in SISCO MMS-EASE, ICCP Toolkit for MMS-EASE, AX-S4 MMS and AX-S4 ICCP, and possibly other control system appli (no CVSS)
- [CVE-2007-0329](https://cve.now/CVE-2007-0329.md): download.php in Joonas Viljanen JV2 Folder Gallery allows remote attackers to read sensitive files via a relative pathname in the file param (no CVSS)
- [CVE-2007-0330](https://cve.now/CVE-2007-0330.md): Buffer overflow in wsbho2k0.dll, as used by wsftpurl.exe, in Ipswitch WS\_FTP 2007 Professional allows remote attackers to cause a denial of (no CVSS)
- [CVE-2007-0331](https://cve.now/CVE-2007-0331.md): Cross-site scripting (XSS) vulnerability in liens.php3 in liens\_dynamiques 2.1 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-0332](https://cve.now/CVE-2007-0332.md): (1) admin/adminlien.php3 and (2) admin/modif.php3 in liens\_dynamiques 2.1 do not require authentication, which allows remote attackers to pe (no CVSS)
- [CVE-2007-0333](https://cve.now/CVE-2007-0333.md): Agnitum Outpost Firewall PRO 4.0 allows local users to bypass access restrictions and insert Trojan horse drivers into the product's install (no CVSS)
- [CVE-2007-0334](https://cve.now/CVE-2007-0334.md): Unspecified vulnerability in the SIP module in InGate Firewall and SIParator before 4.5.1 allows remote attackers to conduct replay attacks (no CVSS)
- [CVE-2007-0335](https://cve.now/CVE-2007-0335.md): Multiple directory traversal vulnerabilities in Jax Petition Book 1.0.3.06 allow remote attackers to include and execute arbitrary local fil (no CVSS)
- [CVE-2007-0336](https://cve.now/CVE-2007-0336.md): Undercover.app/Contents/Resources/uc in Rixstep Undercover allows local users to overwrite arbitrary files, probably related to a race condi (no CVSS)
- [CVE-2007-0337](https://cve.now/CVE-2007-0337.md): Directory traversal vulnerability in sesskglogadmin.php in KGB 1.9 and earlier allows remote attackers to include and execute arbitrary loca (no CVSS)
- [CVE-2007-0338](https://cve.now/CVE-2007-0338.md): Heap-based buffer overflow in Dream FTP Server allows remote attackers to execute arbitrary code via a USER command with a large number of f (no CVSS)
- [CVE-2007-0339](https://cve.now/CVE-2007-0339.md): SQL injection vulnerability in index.php (aka the login form) in Scriptme SMe FileMailer 1.21 allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2007-0340](https://cve.now/CVE-2007-0340.md): SQL injection vulnerability in inc/header.inc.php in ThWboard 3.0b2.84-php5 and earlier allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2007-0341](https://cve.now/CVE-2007-0341.md): Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.8.1 and earlier, when Microsoft Internet Explorer 6 is used, allows remote attacker (no CVSS)
- [CVE-2007-0342](https://cve.now/CVE-2007-0342.md): WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD e (CVSS 7.5)
- [CVE-2007-0343](https://cve.now/CVE-2007-0343.md): OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka (no CVSS)
- [CVE-2007-0344](https://cve.now/CVE-2007-0344.md): Multiple format string vulnerabilities in (1) \_invitedToRoom: and (2) \_invitedToDirectChat: in Colloquy 2.1 and earlier allow remote attacke (no CVSS)
- [CVE-2007-0345](https://cve.now/CVE-2007-0345.md): The (1) Activity Monitor.app/Contents/Resources/pmTool, (2) Keychain Access.app/Contents/Resources/kcproxy, and (3) ODBC Administrator.app/C (no CVSS)
- [CVE-2007-0346](https://cve.now/CVE-2007-0346.md): SQL injection vulnerability in index.php in SmE FileMailer 1.21 allows remote attackers to execute arbitrary SQL commands via the us paramet (no CVSS)
- [CVE-2007-0300](https://cve.now/CVE-2007-0300.md): PHP remote file inclusion vulnerability in i-accueil.php in TLM CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2007-0301](https://cve.now/CVE-2007-0301.md): PHP remote file inclusion vulnerability in \_admin/admin\_menu.php in FdWeB Espace Membre 2.1 and earlier allows remote attackers to execute a (no CVSS)
- [CVE-2007-0302](https://cve.now/CVE-2007-0302.md): Multiple cross-site scripting (XSS) vulnerabilities in InstantASP 4.1.0 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-0303](https://cve.now/CVE-2007-0303.md): Multiple unspecified vulnerabilities in Zina 1.0rc1 and earlier have unknown impact and attack vectors related to "Potential security bugs." (no CVSS)
- [CVE-2007-0304](https://cve.now/CVE-2007-0304.md): SQL injection vulnerability in duyuru.asp in MiNT Haber Sistemi 2.7 allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2007-0305](https://cve.now/CVE-2007-0305.md): SQL injection vulnerability in etkinlikbak.asp in Okul Web Otomasyon Sistemi 4.0.1 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-0306](https://cve.now/CVE-2007-0306.md): SQL injection vulnerability in visu\_user.asp in Digiappz DigiAffiliate 1.4 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2007-0307](https://cve.now/CVE-2007-0307.md): PHP remote file inclusion vulnerability in include/common.php in Poplar Gedcom Viewer 2.0 and earlier allows remote attackers to execute arb (no CVSS)
- [CVE-2007-0308](https://cve.now/CVE-2007-0308.md): Cross-site scripting (XSS) vulnerability in Plain Black WebGUI before 7.3.4 (beta) allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-0309](https://cve.now/CVE-2007-0309.md): SQL injection vulnerability in blocks/block-Old\_Articles.php in Francisco Burzi PHP-Nuke 7.9 and earlier, when register\_globals is enabled a (no CVSS)
- [CVE-2007-0310](https://cve.now/CVE-2007-0310.md): BMC Remedy Action Request System 5.01.02 Patch 1267 generates different error messages for failed login attempts with a valid username than (no CVSS)
- [CVE-2007-0311](https://cve.now/CVE-2007-0311.md): Texas Imperial Software WFTPD and WFTPD Pro Server 3.25 and earlier allow remote attackers to cause a denial of service (application crash) (no CVSS)
- [CVE-2007-0312](https://cve.now/CVE-2007-0312.md): wcSimple Poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain pass (no CVSS)
- [CVE-2007-0313](https://cve.now/CVE-2007-0313.md): Unspecified vulnerability in GONICUS System Administration (GOsa) before 2.5.8 allows remote authenticated users to modify certain settings, (no CVSS)
- [CVE-2007-0314](https://cve.now/CVE-2007-0314.md): Multiple PHP remote file inclusion vulnerabilities in Article System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2007-0315](https://cve.now/CVE-2007-0315.md): Multiple buffer overflows in FileZilla before 2.2.30a allow remote attackers to execute arbitrary code or cause a denial of service (applica (no CVSS)
- [CVE-2007-0316](https://cve.now/CVE-2007-0316.md): Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.010 and earlier, when magic\_quotes\_gpc is disabled, allow rem (no CVSS)
- [CVE-2007-0317](https://cve.now/CVE-2007-0317.md): Format string vulnerability in the LogMessage function in FileZilla before 3.0.0-beta5 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2007-0318](https://cve.now/CVE-2007-0318.md): The do\_hfs\_truncate function in Mac OS X 10.4.8 allows context-dependent attackers to cause a denial of service (kernel panic) via a crafted (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.