# CVEs published 2007-11-15

75 CVEs were published on November 15, 2007: 0 critical, 1 high. Days are UTC.

- [CVE-2004-2754](https://cve.now/CVE-2004-2754.md): SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute (no CVSS)
- [CVE-2004-2755](https://cve.now/CVE-2004-2755.md): Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject ar (no CVSS)
- [CVE-2007-6010](https://cve.now/CVE-2007-6010.md): Unspecified vulnerability in pioneers (formerly gnocatan) 0.11.3 allows remote attackers to cause a denial of service (daemon crash) via uns (no CVSS)
- [CVE-2007-4344](https://cve.now/CVE-2007-4344.md): Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 a (no CVSS)
- [CVE-2007-5990](https://cve.now/CVE-2007-5990.md): Cross-site scripting (XSS) vulnerability in ExoPHPdesk allows remote attackers to inject arbitrary web script or HTML via unspecified vector (no CVSS)
- [CVE-2007-5991](https://cve.now/CVE-2007-5991.md): SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a (no CVSS)
- [CVE-2007-5992](https://cve.now/CVE-2007-5992.md): SQL injection vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers to execute (no CVSS)
- [CVE-2007-5993](https://cve.now/CVE-2007-5993.md): Cross-site scripting (XSS) vulnerability in Visionary Technology in Library Solutions (VTLS) vtls.web.gateway before 48.1.1 allows remote at (no CVSS)
- [CVE-2007-5994](https://cve.now/CVE-2007-5994.md): PHP remote file inclusion vulnerability in check\_noimage.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 (no CVSS)
- [CVE-2007-5995](https://cve.now/CVE-2007-5995.md): PHP remote file inclusion vulnerability in examples/patExampleGen/bbcodeSource.php in patBBcode 1.0 allows remote attackers to execute arbit (no CVSS)
- [CVE-2007-5996](https://cve.now/CVE-2007-5996.md): SQL injection vulnerability in searchresult.php in Softbiz Link Directory Script allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2007-5997](https://cve.now/CVE-2007-5997.md): SQL injection vulnerability in campaign\_stats.php in Softbiz Banner Exchange Network Script 1.0 allows remote authenticated users to execute (no CVSS)
- [CVE-2007-5998](https://cve.now/CVE-2007-5998.md): SQL injection vulnerability in ads.php in Softbiz Ad Management plus Script 1 allows remote authenticated users to execute arbitrary SQL com (no CVSS)
- [CVE-2007-5999](https://cve.now/CVE-2007-5999.md): SQL injection vulnerability in product\_desc.php in Softbiz Auctions Script allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-6000](https://cve.now/CVE-2007-6000.md): KDE Konqueror 3.5.6 and earlier allows remote attackers to cause a denial of service (crash) via large HTTP cookie parameters. (no CVSS)
- [CVE-2007-6001](https://cve.now/CVE-2007-6001.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Bandersnatch 0.4 allow remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2007-6002](https://cve.now/CVE-2007-6002.md): Cross-site scripting (XSS) vulnerability in Fenriru (1) Sleipnir 2.5.17 R2 and earlier and (2) Grani 3.0 and earlier allows remote attackers (no CVSS)
- [CVE-2007-6003](https://cve.now/CVE-2007-6003.md): Cross-site scripting (XSS) vulnerability in cgi/b/ic/connect in the Thomson SpeedTouch 716 with firmware 5.4.0.14 allows remote attackers to (no CVSS)
- [CVE-2007-6004](https://cve.now/CVE-2007-6004.md): Multiple SQL injection vulnerabilities in index.php in Toko Instan 7.6 allow remote attackers to execute arbitrary SQL commands via (1) the (no CVSS)
- [CVE-2007-6005](https://cve.now/CVE-2007-6005.md): Unspecified vulnerability in the GpcContainer.GpcContainer.1 ActiveX control in WebEx allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2007-6006](https://cve.now/CVE-2007-6006.md): TestLink before 1.7.1 does not enforce an unspecified authorization mechanism, which has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-6007](https://cve.now/CVE-2007-6007.md): Integer overflow in the ID\_PSP.apl plug-in for ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 (no CVSS)
- [CVE-2007-6008](https://cve.now/CVE-2007-6008.md): Heap-based buffer overflow in emlsr.dll before 2.0.0.4 in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK allows remote at (no CVSS)
- [CVE-2007-6009](https://cve.now/CVE-2007-6009.md): Multiple buffer overflows in ACD products allow user-assisted remote attackers to execute arbitrary code via a long section string in a (1) (no CVSS)
- [CVE-2007-4702](https://cve.now/CVE-2007-4702.md): The Application Firewall in Apple Mac OS X 10.5, when "Block all incoming connections" is enabled, does not prevent root processes or mDNSRe (no CVSS)
- [CVE-2007-4703](https://cve.now/CVE-2007-4703.md): The Application Firewall in Apple Mac OS X 10.5 does not prevent a root process from accepting incoming connections, even when "Block incomi (no CVSS)
- [CVE-2007-4704](https://cve.now/CVE-2007-4704.md): The Application Firewall in Apple Mac OS X 10.5 does not apply changed settings to processes that are started by launchd until the processes (no CVSS)
- [CVE-2007-5501](https://cve.now/CVE-2007-5501.md): The tcp\_sacktag\_write\_queue function in net/ipv4/tcp\_input.c in Linux kernel 2.6.21 through 2.6.23.7, and 2.6.24-rc through 2.6.24-rc2, allo (no CVSS)
- [CVE-2007-5905](https://cve.now/CVE-2007-5905.md): Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a (no CVSS)
- [CVE-2006-7230](https://cve.now/CVE-2006-7230.md): Perl-Compatible Regular Expression (PCRE) library before 7.0 does not properly calculate the amount of memory needed for a compiled regular (no CVSS)
- [CVE-2007-4699](https://cve.now/CVE-2007-4699.md): The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow ot (no CVSS)
- [CVE-2007-4700](https://cve.now/CVE-2007-4700.md): Unspecified vulnerability in WebKit on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to use Safari as an indirect proxy and se (no CVSS)
- [CVE-2007-4701](https://cve.now/CVE-2007-4701.md): WebKit on Apple Mac OS X 10.4 through 10.4.10 does not create temporary files securely when Safari is previewing a PDF file, which allows lo (no CVSS)
- [CVE-2007-3749](https://cve.now/CVE-2007-3749.md): The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setu (no CVSS)
- [CVE-2007-4267](https://cve.now/CVE-2007-4267.md): Stack-based buffer overflow in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code (no CVSS)
- [CVE-2007-4268](https://cve.now/CVE-2007-4268.md): Integer signedness error in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via (no CVSS)
- [CVE-2007-4269](https://cve.now/CVE-2007-4269.md): Integer overflow in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a craft (no CVSS)
- [CVE-2007-4678](https://cve.now/CVE-2007-4678.md): AppleRAID in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows attackers to cause a denial of service (crash) via a crafted striped disk (no CVSS)
- [CVE-2007-4679](https://cve.now/CVE-2007-4679.md): CFFTP in CFNetwork for Apple Mac OS X 10.4 through 10.4.10 allows remote FTP servers to force clients to connect to other hosts via crafted (no CVSS)
- [CVE-2007-4680](https://cve.now/CVE-2007-4680.md): CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates, which allows remote attackers to spoof (no CVSS)
- [CVE-2007-4681](https://cve.now/CVE-2007-4681.md): Buffer overflow in CoreFoundation in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 allows local users to cause a denial of service (applica (no CVSS)
- [CVE-2007-4682](https://cve.now/CVE-2007-4682.md): CoreText in Apple Mac OS X 10.4 through 10.4.10 allows attackers to cause a denial of service (application crash) and possibly execute arbit (no CVSS)
- [CVE-2007-4683](https://cve.now/CVE-2007-4683.md): Directory traversal vulnerability in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to bypass the chroot mechanism via (no CVSS)
- [CVE-2007-4684](https://cve.now/CVE-2007-4684.md): Integer overflow in the kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to execute arbitrary code via a large num\_sels argu (no CVSS)
- [CVE-2007-4685](https://cve.now/CVE-2007-4685.md): The kernel in Apple Mac OS X 10.4 through 10.4.10 allows local users to gain privileges by executing setuid or setgid programs in which the (no CVSS)
- [CVE-2007-4686](https://cve.now/CVE-2007-4686.md): Integer signedness error in the ttioctl function in bsd/kern/tty.c in the xnu kernel in Apple Mac OS X 10.4 through 10.4.10 allows local use (no CVSS)
- [CVE-2007-4687](https://cve.now/CVE-2007-4687.md): The remote\_cmds component in Apple Mac OS X 10.4 through 10.4.10 contains a symbolic link from the tftpboot private directory to the root di (no CVSS)
- [CVE-2007-4688](https://cve.now/CVE-2007-4688.md): The Networking component in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain all addresses for a host, including link-l (no CVSS)
- [CVE-2007-4689](https://cve.now/CVE-2007-4689.md): Double free vulnerability in the Networking component in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2007-4690](https://cve.now/CVE-2007-4690.md): Double free vulnerability in the NFS component in Apple Mac OS X 10.4 through 10.4.10 allows remote authenticated users to execute arbitrary (no CVSS)
- [CVE-2007-4691](https://cve.now/CVE-2007-4691.md): The NSURL component in Apple Mac OS X 10.4 through 10.4.10 performs case-sensitive comparisons that allow attackers to bypass intended restr (no CVSS)
- [CVE-2007-4693](https://cve.now/CVE-2007-4693.md): The SecurityAgent component in Mac OS X 10.4 through 10.4.10 allows attackers with physical access to bypass the authentication dialog of th (no CVSS)
- [CVE-2007-4694](https://cve.now/CVE-2007-4694.md): Safari in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to access local content via file:// URLs. (no CVSS)
- [CVE-2007-4695](https://cve.now/CVE-2007-4695.md): Unspecified "input validation" vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to modify form field (no CVSS)
- [CVE-2007-4696](https://cve.now/CVE-2007-4696.md): Race condition in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to obtain information for forms from other sites vi (no CVSS)
- [CVE-2007-4697](https://cve.now/CVE-2007-4697.md): Unspecified vulnerability in WebCore in Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (applicatio (no CVSS)
- [CVE-2006-7229](https://cve.now/CVE-2006-7229.md): The skge driver 1.5 in Linux kernel 2.6.15 on Ubuntu does not properly use the spin\_lock and spin\_unlock functions, which allows remote atta (CVSS 7.5)
- [CVE-2007-4692](https://cve.now/CVE-2007-4692.md): The tabbed browsing feature in Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attacker (no CVSS)
- [CVE-2007-4698](https://cve.now/CVE-2007-4698.md): Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripti (no CVSS)
- [CVE-2007-5973](https://cve.now/CVE-2007-5973.md): SQL injection vulnerability in articles.php in JPortal 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the t (no CVSS)
- [CVE-2007-5974](https://cve.now/CVE-2007-5974.md): SQL injection vulnerability in mailer.php in JPortal 2 allows remote attackers to execute arbitrary SQL commands via the to parameter. (no CVSS)
- [CVE-2007-5975](https://cve.now/CVE-2007-5975.md): SQL injection vulnerability in index.php in TBSource, as used in (1) TBDev and (2) TorrentStrike 0.4, allows remote authenticated users to e (no CVSS)
- [CVE-2007-5976](https://cve.now/CVE-2007-5976.md): SQL injection vulnerability in db\_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABASE privileges (no CVSS)
- [CVE-2007-5977](https://cve.now/CVE-2007-5977.md): Cross-site scripting (XSS) vulnerability in db\_create.php in phpMyAdmin before 2.11.2.1 allows remote authenticated users with CREATE DATABA (no CVSS)
- [CVE-2007-5978](https://cve.now/CVE-2007-5978.md): SQL injection vulnerability in brokenlink.php in the mylinks module for XOOPS allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-5979](https://cve.now/CVE-2007-5979.md): Cross-site scripting (XSS) vulnerability in download\_plugin.php3 in F5 Firepass 4100 SSL VPN 5.4 through 5.5.2 and 6.0 through 6.0.1 allows (no CVSS)
- [CVE-2007-5980](https://cve.now/CVE-2007-5980.md): Cross-site scripting (XSS) vulnerability in home/rss.php in eggblog before 3.1.1 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2007-5981](https://cve.now/CVE-2007-5981.md): Lantronix SCS3200 does not properly handle public-key requests, which allows remote attackers to cause a denial of service (unresponsive dev (no CVSS)
- [CVE-2007-5982](https://cve.now/CVE-2007-5982.md): Multiple cross-site scripting (XSS) vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject ar (no CVSS)
- [CVE-2007-5983](https://cve.now/CVE-2007-5983.md): Cross-site scripting (XSS) vulnerability in index.php in Justin Hagstrom AutoIndex PHP Script before 2.2.3 allows remote attackers to inject (no CVSS)
- [CVE-2007-5984](https://cve.now/CVE-2007-5984.md): classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service (CPU and memory co (no CVSS)
- [CVE-2007-5985](https://cve.now/CVE-2007-5985.md): Multiple cross-site scripting (XSS) vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2007-5986](https://cve.now/CVE-2007-5986.md): SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2007-5987](https://cve.now/CVE-2007-5987.md): details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms (no CVSS)
- [CVE-2007-5988](https://cve.now/CVE-2007-5988.md): blocks/shoutbox\_block.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbit (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.