# CVEs published 2007-01-29

36 CVEs were published on January 29, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-0557](https://cve.now/CVE-2007-0557.md): rMake before 1.0.4 drops root privileges in a way that retains the original supplemental groups, which might allow attackers to gain privile (no CVSS)
- [CVE-2007-0347](https://cve.now/CVE-2007-0347.md): The is\_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authentic (no CVSS)
- [CVE-2006-6965](https://cve.now/CVE-2006-6965.md): CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-0538](https://cve.now/CVE-2007-0538.md): Telligent Community Server 2.1 and earlier allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingba (no CVSS)
- [CVE-2007-0539](https://cve.now/CVE-2007-0539.md): The wp\_remote\_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) (no CVSS)
- [CVE-2007-0540](https://cve.now/CVE-2007-0540.md): WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source UR (no CVSS)
- [CVE-2007-0541](https://cve.now/CVE-2007-0541.md): WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback s (no CVSS)
- [CVE-2007-0542](https://cve.now/CVE-2007-0542.md): Cross-site scripting (XSS) vulnerability in show.php in 212cafe Guestbook 4.00 beta allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-0543](https://cve.now/CVE-2007-0543.md): ZixForum 1.14 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2007-0544](https://cve.now/CVE-2007-0544.md): Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary (no CVSS)
- [CVE-2007-0545](https://cve.now/CVE-2007-0545.md): Maxtricity Tagger 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow (no CVSS)
- [CVE-2007-0546](https://cve.now/CVE-2007-0546.md): Toxiclab Shoutbox 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl (no CVSS)
- [CVE-2007-0547](https://cve.now/CVE-2007-0547.md): Cross-site scripting (XSS) vulnerability in CGI-RESCUE WebFORM 4.3 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-0548](https://cve.now/CVE-2007-0548.md): KarjaSoft Sami HTTP Server 2.0.1 allows remote attackers to cause a denial of service (daemon hang) via a large number of requests for nonex (no CVSS)
- [CVE-2007-0549](https://cve.now/CVE-2007-0549.md): Cross-site scripting (XSS) vulnerability in list3.php in 212cafeBoard 6.30 Beta allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2007-0550](https://cve.now/CVE-2007-0550.md): Cross-site scripting (XSS) vulnerability in search.php in 212cafeBoard 0.08 Beta allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-0551](https://cve.now/CVE-2007-0551.md): Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2007-0552](https://cve.now/CVE-2007-0552.md): Cross-site scripting (XSS) vulnerability in install/default/error404.html in Oh no! Not another CMS (Onnac) 0.0.8.4 and earlier allows remot (no CVSS)
- [CVE-2007-0553](https://cve.now/CVE-2007-0553.md): Multiple cross-site scripting (XSS) vulnerabilities in index.inc.php in PHProxy before 0.5 beta 2 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-0554](https://cve.now/CVE-2007-0554.md): SQL injection vulnerability in print.asp in Guo Xu Guos Posting System (GPS) 1.2 allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2004-2676](https://cve.now/CVE-2004-2676.md): The Spy Sweeper Enterprise Client (SpySweeperTray.exe) in WebRoot Spy Sweeper before 2.0 does not drop privileges when using the help functi (no CVSS)
- [CVE-2005-4825](https://cve.now/CVE-2005-4825.md): Cisco Clean Access 3.5.5 and earlier on the Secure Smart Manager allows remote attackers to bypass authentication and cause a denial of serv (no CVSS)
- [CVE-2006-6953](https://cve.now/CVE-2006-6953.md): The virtual keyboard implementation in GlobeTrotter Mobility Manager changes the color of a key as it is pressed, which allows local users t (no CVSS)
- [CVE-2006-6954](https://cve.now/CVE-2006-6954.md): Flock beta 1 0.7 allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nes (no CVSS)
- [CVE-2006-6955](https://cve.now/CVE-2006-6955.md): Opera allows remote attackers to cause a denial of service (application crash) via a web page that contains a large number of nested marquee (no CVSS)
- [CVE-2006-6956](https://cve.now/CVE-2006-6956.md): Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via a web page that contains a large number of nest (no CVSS)
- [CVE-2006-6957](https://cve.now/CVE-2006-6957.md): PHP remote file inclusion vulnerability in addons/mod\_media/body.php in Docebo 3.0.3 and earlier, when register\_globals is enabled, allows r (no CVSS)
- [CVE-2006-6958](https://cve.now/CVE-2006-6958.md): Multiple PHP remote file inclusion vulnerabilities in phpBlueDragon 2.9.1 allow remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2006-6959](https://cve.now/CVE-2006-6959.md): WebRoot Spy Sweeper 4.5.9 and earlier allows local users to bypass the "Startup-Shield" security restrictions by modifying certain registry (no CVSS)
- [CVE-2006-6960](https://cve.now/CVE-2006-6960.md): The Compression Sweep feature in WebRoot Spy Sweeper 4.5.9 and earlier does not handle non-ZIP archives, which allows remote attackers to by (no CVSS)
- [CVE-2006-6961](https://cve.now/CVE-2006-6961.md): WebRoot Spy Sweeper 4.5.9 and earlier does not detect malware based on file contents, which allows remote attackers to bypass malware detect (no CVSS)
- [CVE-2006-6962](https://cve.now/CVE-2006-6962.md): PHP remote file inclusion vulnerability in rsgallery2.html.php in the RS Gallery2 component (com\_rsgallery2) 1.11.2 for Joomla! allows attac (no CVSS)
- [CVE-2006-6963](https://cve.now/CVE-2006-6963.md): Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 3.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2006-6964](https://cve.now/CVE-2006-6964.md): MailEnable Professional before 1.78 provides a cleartext user password when an administrator edits the user's settings, which allows remote (no CVSS)
- [CVE-2007-0463](https://cve.now/CVE-2007-0463.md): Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (applicat (no CVSS)
- [CVE-2007-0537](https://cve.now/CVE-2007-0537.md): The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.