# CVEs published 2007-11-20

45 CVEs were published on November 20, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2003-0857](https://cve.now/CVE-2003-0857.md): The (1) ipq\_read and (2) ipulog\_read functions in iptables allow local users to cause a denial of service by sending spoofed messages as oth (no CVSS)
- [CVE-2007-6061](https://cve.now/CVE-2007-6061.md): Audacity 1.3.2 creates a temporary directory with a predictable name without checking for previous existence of that directory, which allows (no CVSS)
- [CVE-2007-6062](https://cve.now/CVE-2007-6062.md): irc-channel.c in ngIRCd before 0.10.3 allows remote attackers to cause a denial of service (crash) via a JOIN command without a channel argu (no CVSS)
- [CVE-2007-6044](https://cve.now/CVE-2007-6044.md): Multiple unspecified vulnerabilities in IBM WebSphere MQ 6.0 have unknown impact and remote attack vectors involving "memory corruption." NO (no CVSS)
- [CVE-2007-6045](https://cve.now/CVE-2007-6045.md): Unspecified vulnerability in (1) DB2WATCH and (2) DB2FREEZE in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-6046](https://cve.now/CVE-2007-6046.md): Unspecified vulnerability in unspecified setuid programs in IBM DB2 UDB 9.1 before Fixpak 4 allows local users to have an unknown impact. (no CVSS)
- [CVE-2007-6047](https://cve.now/CVE-2007-6047.md): Unspecified vulnerability in the DB2DART tool in IBM DB2 UDB 9.1 before Fixpak 4 allows attackers to execute arbitrary commands as the DB2 i (no CVSS)
- [CVE-2007-6048](https://cve.now/CVE-2007-6048.md): IBM DB2 UDB 9.1 before Fixpak 4 uses incorrect permissions on ACLs for DB2NODES.CFG, which has unknown impact and attack vectors. (no CVSS)
- [CVE-2007-6049](https://cve.now/CVE-2007-6049.md): Unspecified vulnerability in the SSL LOAD GSKIT action in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, involving a (no CVSS)
- [CVE-2007-6050](https://cve.now/CVE-2007-6050.md): Unspecified vulnerability in DB2LICD in IBM DB2 UDB 9.1 before Fixpak 4 has unknown impact and attack vectors, related to creation of an "in (no CVSS)
- [CVE-2007-6051](https://cve.now/CVE-2007-6051.md): IBM DB2 UDB 9.1 before Fixpak 4 assigns incorrect privileges to the (1) DB2ADMNS and (2) DB2USERS alternative groups, which has unknown impa (no CVSS)
- [CVE-2007-6052](https://cve.now/CVE-2007-6052.md): IBM DB2 UDB 9.1 before Fixpak 4 does not properly perform vector aggregation, which might allow attackers to cause a denial of service (divi (no CVSS)
- [CVE-2007-6053](https://cve.now/CVE-2007-6053.md): IBM DB2 UDB 9.1 before Fixpak 4 does not properly handle use of large numbers of file descriptors, which might allow attackers to have an un (no CVSS)
- [CVE-2007-6054](https://cve.now/CVE-2007-6054.md): Cross-site scripting (XSS) vulnerability in the login page in the management interface in the Aruba 800 Mobility Controller 2.5.4.18 and ear (no CVSS)
- [CVE-2007-6055](https://cve.now/CVE-2007-6055.md): Cross-site scripting (XSS) vulnerability in c/portal/login in Liferay Portal 4.1.0 and 4.1.1 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-6056](https://cve.now/CVE-2007-6056.md): frame.html in Aida-Web (Aida Web) allows remote attackers to bypass a protection mechanism and obtain comment and task details via modified (no CVSS)
- [CVE-2007-6057](https://cve.now/CVE-2007-6057.md): PHP remote file inclusion vulnerability in index.php in datecomm Social Networking Script (aka Myspace Clone Script) allows remote attackers (no CVSS)
- [CVE-2007-6058](https://cve.now/CVE-2007-6058.md): Multiple SQL injection vulnerabilities in index.php in ProfileCMS 1.0 and earlier allow remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2007-6059](https://cve.now/CVE-2007-6059.md): Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, a (no CVSS)
- [CVE-2007-6060](https://cve.now/CVE-2007-6060.md): AhnLab Antivirus 3 Internet Security 2008 Platinum appends data to a filename string at a location indicated by the "Filename length" field (no CVSS)
- [CVE-2007-5361](https://cve.now/CVE-2007-5361.md): The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and earlier caches an IP address during a TFTP request from an IP Touch ph (no CVSS)
- [CVE-2007-5899](https://cve.now/CVE-2007-5899.md): The output\_add\_rewrite\_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which (no CVSS)
- [CVE-2007-6039](https://cve.now/CVE-2007-6039.md): PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domai (no CVSS)
- [CVE-2007-6040](https://cve.now/CVE-2007-6040.md): The Belkin F5D7230-4 Wireless G Router allows remote attackers to cause a denial of service (degraded networking and logging) via a flood of (no CVSS)
- [CVE-2007-6041](https://cve.now/CVE-2007-6041.md): Buffer overflow in the Sequencer::queueMessage function in sequencer.cpp in the server in Rigs of Rods (RoR) before 0.33d SP1 allows remote (no CVSS)
- [CVE-2007-6042](https://cve.now/CVE-2007-6042.md): PHP remote file inclusion vulnerability in fehler.inc.php in SWSoft Confixx Professional 3.2.1 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-6043](https://cve.now/CVE-2007-6043.md): The CryptGenRandom function in Microsoft Windows 2000 generates predictable values, which makes it easier for context-dependent attackers to (no CVSS)
- [CVE-2007-5898](https://cve.now/CVE-2007-5898.md): The (1) htmlentities and (2) htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and (no CVSS)
- [CVE-2007-5900](https://cve.now/CVE-2007-5900.md): PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php\_admin\_value or php\_admin\_flag in httpd.conf by us (no CVSS)
- [CVE-2007-6035](https://cve.now/CVE-2007-6035.md): SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local\_grap (no CVSS)
- [CVE-2007-6036](https://cve.now/CVE-2007-6036.md): The parseRTSPRequestString function in LIVE555 Media Server 2007.11.01 and earlier allows remote attackers to cause a denial of service (dae (no CVSS)
- [CVE-2007-6037](https://cve.now/CVE-2007-6037.md): Cross-site scripting (XSS) vulnerability in ws/generic\_api\_call.pl in Citrix NetScaler 8.0 build 47.8 allows remote attackers to inject arbi (no CVSS)
- [CVE-2007-6038](https://cve.now/CVE-2007-6038.md): PHP remote file inclusion vulnerability in xajax\_functions.php in the JUser (com\_juser) 1.0.14 component for Joomla! allows remote attackers (no CVSS)
- [CVE-2004-2757](https://cve.now/CVE-2004-2757.md): Cross-site scripting (XSS) vulnerability in the failed login page in Novell iChain before 2.2 build 2.2.113 and 2.3 First Customer Ship (FCS (no CVSS)
- [CVE-2007-5500](https://cve.now/CVE-2007-5500.md): The wait\_task\_stopped function in the Linux kernel before 2.6.23.8 checks a TASK\_TRACED bit instead of an exit\_state value, which allows loc (no CVSS)
- [CVE-2007-6029](https://cve.now/CVE-2007-6029.md): Unspecified vulnerability in ClamAV 0.91.1 and 0.91.2 allows remote attackers to execute arbitrary code via a crafted e-mail message. (no CVSS)
- [CVE-2007-6030](https://cve.now/CVE-2007-6030.md): Unspecified vulnerability in Weird Solutions BOOTPTurbo 1.2 has unknown impact and remote attack vectors. (no CVSS)
- [CVE-2007-6031](https://cve.now/CVE-2007-6031.md): Unspecified vulnerability in VanDyke VShell 3.0.1 allows remote attackers to cause a denial of service via unspecified vectors. (no CVSS)
- [CVE-2007-6032](https://cve.now/CVE-2007-6032.md): SQL injection vulnerability in calendar/page.asp in Aleris Web Publishing Server 3.0 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2007-6033](https://cve.now/CVE-2007-6033.md): Invensys Wonderware InTouch 8.0 creates a NetDDE share with insecure permissions (Everyone/Full Control), which allows remote authenticated (no CVSS)
- [CVE-2004-2756](https://cve.now/CVE-2004-2756.md): Cross-site scripting (XSS) vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2007-6027](https://cve.now/CVE-2007-6027.md): PHP remote file inclusion vulnerability in admin.jjgallery.php in the Carousel Flash Image Gallery (com\_jjgallery) component for Joomla! all (no CVSS)
- [CVE-2007-6028](https://cve.now/CVE-2007-6028.md): Multiple stack-based buffer overflows in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne FlexGrid 7.1 Light allow remote attacker (no CVSS)
- [CVE-2002-2426](https://cve.now/CVE-2002-2426.md): Cross-site request forgery (CSRF) vulnerability in Citrix Presentation Server 4.0 and 4.5, MetaFrame Presentation Server 3.0, and Access Ess (no CVSS)
- [CVE-2007-6026](https://cve.now/CVE-2007-6026.md): Stack-based buffer overflow in Microsoft msjet40.dll 4.0.8618.0 (aka Microsoft Jet Engine), as used by Access 2003 in Microsoft Office 2003 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.