# CVEs published 2007-01-19

57 CVEs were published on January 19, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2006-6945](https://cve.now/CVE-2006-6945.md): SQL injection vulnerability in Virtuemart 1.0.7 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, probably (no CVSS)
- [CVE-2007-0368](https://cve.now/CVE-2007-0368.md): Stack-based buffer overflow in mbse-bbs 0.70 and earlier allows local users to execute arbitrary code via a long string in the MBSE\_ROOT env (no CVSS)
- [CVE-2007-0369](https://cve.now/CVE-2007-0369.md): SQL injection vulnerability in phpBP RC3 (2.204) and earlier allows remote attackers to execute arbitrary SQL commands via the comment forum (no CVSS)
- [CVE-2007-0370](https://cve.now/CVE-2007-0370.md): Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inject arbitrary PHP co (no CVSS)
- [CVE-2007-0371](https://cve.now/CVE-2007-0371.md): A certain ActiveX control in the Common Controls Replacement Project (CCRP) CCRP BrowseDialog Server (ccrpbds6.dll) allows remote attackers (no CVSS)
- [CVE-2007-0372](https://cve.now/CVE-2007-0372.md): Multiple SQL injection vulnerabilities in Francisco Burzi PHP-Nuke 7.9 allow remote attackers to execute arbitrary SQL commands via (1) the (no CVSS)
- [CVE-2007-0373](https://cve.now/CVE-2007-0373.md): Multiple SQL injection vulnerabilities in Joomla! 1.5.0 Beta allow remote attackers to execute arbitrary SQL commands via (1) the searchword (no CVSS)
- [CVE-2007-0374](https://cve.now/CVE-2007-0374.md): SQL injection vulnerability in (1) Joomla! 1.0.11 and 1.5 Beta, and (2) Mambo 4.6.1, allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-0375](https://cve.now/CVE-2007-0375.md): Joomla! 1.5.0 Beta allows remote attackers to obtain sensitive information via a direct request for (1) plugins/user/example.php; (2) gmail. (no CVSS)
- [CVE-2007-0376](https://cve.now/CVE-2007-0376.md): Cross-site scripting (XSS) vulnerability in Virtuemart 1.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified (no CVSS)
- [CVE-2007-0377](https://cve.now/CVE-2007-0377.md): Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in (no CVSS)
- [CVE-2007-0378](https://cve.now/CVE-2007-0378.md): Multiple SQL injection vulnerabilities in DocMan 1.3 RC2 allow attackers to execute arbitrary SQL commands via unspecified vectors. (no CVSS)
- [CVE-2007-0379](https://cve.now/CVE-2007-0379.md): Cross-site scripting (XSS) vulnerability in DocMan 1.3 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified ve (no CVSS)
- [CVE-2007-0380](https://cve.now/CVE-2007-0380.md): DocMan 1.3 RC2 allows remote attackers to obtain sensitive information (the full path) via unspecified vectors. (no CVSS)
- [CVE-2007-0381](https://cve.now/CVE-2007-0381.md): Multiple SQL injection vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters (no CVSS)
- [CVE-2007-0382](https://cve.now/CVE-2007-0382.md): Multiple SQL injection vulnerabilities in letterman.class.php in the Letterman 1.2.3 (com\_letterman) component for Joomla! before 1.0.12 all (no CVSS)
- [CVE-2007-0383](https://cve.now/CVE-2007-0383.md): WDaemon 9.5.4 allows remote attackers to access the /WorldClient.dll URI on TCP port 3000, which has unknown impact. (no CVSS)
- [CVE-2007-0384](https://cve.now/CVE-2007-0384.md): Cross-site scripting (XSS) vulnerability in preview in the reviews section in PostNuke 0.764 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-0385](https://cve.now/CVE-2007-0385.md): The faq section in PostNuke 0.764 allows remote attackers to obtain sensitive information (the full path) via "unvalidated output" in FAQ/in (no CVSS)
- [CVE-2007-0386](https://cve.now/CVE-2007-0386.md): Unspecified vulnerability in the rating section in PostNuke 0.764 has unknown impact and attack vectors, related to "an interesting bug." (no CVSS)
- [CVE-2007-0387](https://cve.now/CVE-2007-0387.md): SQL injection vulnerability in models/category.php in the Weblinks component for Joomla! SVN 20070118 (com\_weblinks) allows remote attackers (no CVSS)
- [CVE-2007-0388](https://cve.now/CVE-2007-0388.md): SQL injection vulnerability in search.php in Woltlab Burning Board (wBB) 1.0.2 and earlier, and 2.3.6 and earlier in the 2.x series, allows (no CVSS)
- [CVE-2007-0389](https://cve.now/CVE-2007-0389.md): Directory traversal vulnerability in ArsDigita Community System (ACS) 3.4.10 and earlier, and ArsDigita Community Education Solution (ACES) (no CVSS)
- [CVE-2007-0390](https://cve.now/CVE-2007-0390.md): Cross-site scripting (XSS) vulnerability in index.php in sabros.us 1.7 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2007-0391](https://cve.now/CVE-2007-0391.md): Format string vulnerability in the log creation functionality of BitDefender Client Professional Plus 8.02 allows attackers to execute arbit (no CVSS)
- [CVE-2007-0392](https://cve.now/CVE-2007-0392.md): IBM AIX 5.3 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges by (no CVSS)
- [CVE-2007-0393](https://cve.now/CVE-2007-0393.md): Sun Solaris 9 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges b (no CVSS)
- [CVE-2007-0394](https://cve.now/CVE-2007-0394.md): HP HP-UX B11.11 does not properly verify the status of file descriptors before setuid execution, which allows local users to gain privileges (no CVSS)
- [CVE-2007-0395](https://cve.now/CVE-2007-0395.md): PHP remote file inclusion vulnerability in libraries/grab\_globals.lib.php in ComVironment 4.0 allows remote attackers to execute arbitrary P (no CVSS)
- [CVE-2007-0396](https://cve.now/CVE-2007-0396.md): Unspecified vulnerability in HP-UX B.11.23, when running IPFilter in combination with PHNE\_34474, allows remote attackers to cause a denial (no CVSS)
- [CVE-2007-0019](https://cve.now/CVE-2007-0019.md): Multiple heap-based buffer overflows in rumpusd in Rumpus 5.1 and earlier (1) allow remote authenticated users to execute arbitrary code via (no CVSS)
- [CVE-2007-0366](https://cve.now/CVE-2007-0366.md): Untrusted search path vulnerability in Rumpus 5.1 and earlier allows local users to gain privileges via a modified PATH that points to a mal (no CVSS)
- [CVE-2007-0367](https://cve.now/CVE-2007-0367.md): Rumpus 5.1 and earlier has weak permissions for certain files and directories under /usr/local/Rumpus, including the configuration file, whi (no CVSS)
- [CVE-2007-0364](https://cve.now/CVE-2007-0364.md): Multiple cross-site scripting (XSS) vulnerabilities in nicecoder.com INDEXU 5.3 and earlier allow remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2007-0365](https://cve.now/CVE-2007-0365.md): Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.009 and earlier allow remote attackers to inject (no CVSS)
- [CVE-2006-6942](https://cve.now/CVE-2006-6942.md): Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web scri (no CVSS)
- [CVE-2006-6943](https://cve.now/CVE-2006-6943.md): PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check\_lang.php and (b) t (no CVSS)
- [CVE-2006-6944](https://cve.now/CVE-2006-6944.md): phpMyAdmin before 2.9.1.1 allows remote attackers to bypass Allow/Deny access rules that use IP addresses via false headers. (no CVSS)
- [CVE-2003-1318](https://cve.now/CVE-2003-1318.md): Twilight Webserver 1.3.3.0 allows remote attackers to cause a denial of service (application crash) via a GET request for a long URI, a diff (no CVSS)
- [CVE-2006-5963](https://cve.now/CVE-2006-5963.md): Directory traversal vulnerability in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows user-assisted remote attackers to extract files (no CVSS)
- [CVE-2006-5964](https://cve.now/CVE-2006-5964.md): choShilA.bpl in PentaZip 8.5.1.190 and PentaSuite-PRO 8.5.1.221 allows local users, and user-assisted remote attackers to cause a denial of (no CVSS)
- [CVE-2007-0350](https://cve.now/CVE-2007-0350.md): Multiple SQL injection vulnerabilities in (a) index.php and (b) dl.php in SmE FileMailer 1.21 and earlier allow remote attackers to execute (no CVSS)
- [CVE-2007-0351](https://cve.now/CVE-2007-0351.md): Microsoft Windows XP and Windows Server 2003 do not properly handle user logoff, which might allow local users to gain the privileges of a p (no CVSS)
- [CVE-2007-0352](https://cve.now/CVE-2007-0352.md): Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a craft (no CVSS)
- [CVE-2007-0353](https://cve.now/CVE-2007-0353.md): Cross-site scripting (XSS) vulnerability in (1) index.php and (2) login.php in myBloggie 2.1.5 allows remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-0354](https://cve.now/CVE-2007-0354.md): SQL injection vulnerability in email.php in MGB OpenSource Guestbook 0.5.4.5 and earlier allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2007-0355](https://cve.now/CVE-2007-0355.md): Buffer overflow in the Apple Minimal SLP v2 Service Agent (slpd) in Mac OS X 10.4.11 and earlier, including 10.4.8, allows local users, and (no CVSS)
- [CVE-2007-0356](https://cve.now/CVE-2007-0356.md): The Common Controls Replacement Project (CCRP) FolderTreeview (FTV) ActiveX control (ccrpftv6.ocx) allows remote attackers to cause a denial (no CVSS)
- [CVE-2007-0357](https://cve.now/CVE-2007-0357.md): Directory traversal vulnerability in the AVM IGD CTRL Service in Fritz!DSL 02.02.29 allows remote attackers to read arbitrary files via ..%5 (no CVSS)
- [CVE-2007-0358](https://cve.now/CVE-2007-0358.md): Unspecified vulnerability in the FTP server implementation in HP Jetdirect firmware x.20.nn through x.24.nn allows remote attackers to cause (no CVSS)
- [CVE-2007-0359](https://cve.now/CVE-2007-0359.md): PHP remote file inclusion vulnerability in frontpage.php in Uberghey CMS 0.3.1 allows remote attackers to execute arbitrary PHP code via a U (no CVSS)
- [CVE-2007-0360](https://cve.now/CVE-2007-0360.md): PHP remote file inclusion vulnerability in lang/index.php in Oreon 1.2.3 RC4 and earlier allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2007-0361](https://cve.now/CVE-2007-0361.md): PHP remote file inclusion vulnerability in mep/frame.php in PHPMyphorum 1.5a allows remote attackers to execute arbitrary PHP code via a URL (no CVSS)
- [CVE-2007-0362](https://cve.now/CVE-2007-0362.md): Cross-site scripting (XSS) vulnerability in the RSS feed component in FreshReader before 1.0.07010600 allows remote attackers to inject arbi (no CVSS)
- [CVE-2007-0363](https://cve.now/CVE-2007-0363.md): Cross-site scripting (XSS) vulnerability in admin-search.php in (1) Openads for PostgreSQL (aka phpPgAds) before 2.0.10 and (2) Openads (aka (no CVSS)
- [CVE-2006-6941](https://cve.now/CVE-2006-6941.md): index.php in FreeWebshop 2.2.2 and earlier allows remote attackers to obtain sensitive information via an invalid action parameter in an inf (no CVSS)
- [CVE-2007-0349](https://cve.now/CVE-2007-0349.md): Directory traversal vulnerability in upgrade.php in nicecoder.com INDEXU 5.x allows remote attackers to include arbitrary local files via a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.