# CVEs published 2007-11-27

16 CVEs were published on November 27, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-4674](https://cve.now/CVE-2007-4674.md): An "integer arithmetic" error in Apple QuickTime 7.2 allows remote attackers to execute arbitrary code via a crafted movie file containing a (no CVSS)
- [CVE-2007-6133](https://cve.now/CVE-2007-6133.md): PHP remote file inclusion vulnerability in admin/kfm/initialise.php in DevMass Shopping Cart 1.0 and earlier allows remote attackers to exec (no CVSS)
- [CVE-2007-6134](https://cve.now/CVE-2007-6134.md): SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-6135](https://cve.now/CVE-2007-6135.md): Cross-site scripting (XSS) vulnerability in phpslideshow.php in PHPSlideShow 0.9.9.2, and possibly earlier, allows remote attackers to injec (no CVSS)
- [CVE-2007-6136](https://cve.now/CVE-2007-6136.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in M2Scripts MySpace Scripts Poll Creator allow remote attackers to inject (no CVSS)
- [CVE-2007-6137](https://cve.now/CVE-2007-6137.md): SQL injection vulnerability in news.php in Content Injector 1.52 allows remote attackers to execute arbitrary SQL commands via the cat param (no CVSS)
- [CVE-2007-6138](https://cve.now/CVE-2007-6138.md): SQL injection vulnerability in redir.asp in VU Mass Mailer allows remote attackers to execute arbitrary SQL commands via the password parame (no CVSS)
- [CVE-2007-6139](https://cve.now/CVE-2007-6139.md): PHP remote file inclusion vulnerability in index.php in Mp3 ToolBox 1.0 beta 5 allows remote attackers to execute arbitrary PHP code via a U (no CVSS)
- [CVE-2007-6140](https://cve.now/CVE-2007-6140.md): Multiple SQL injection vulnerabilities in Dora Emlak 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter t (no CVSS)
- [CVE-2007-6141](https://cve.now/CVE-2007-6141.md): Cross-site scripting (XSS) vulnerability in vBTube.php in vBTube 1.1 Beta allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-6142](https://cve.now/CVE-2007-6142.md): Multiple cross-site scripting (XSS) vulnerabilities in ph03y3nk just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to inject ar (no CVSS)
- [CVE-2007-6143](https://cve.now/CVE-2007-6143.md): SQL injection vulnerability in default.asp (aka the Login Page) in VU Case Manager allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-6144](https://cve.now/CVE-2007-6144.md): Heap-based buffer overflow in the PPlayer.XPPlayer.1 ActiveX control in pplayer.dll\_1\_work in Xunlei Thunder 5.7.4.401 allows remote attacke (no CVSS)
- [CVE-2007-6145](https://cve.now/CVE-2007-6145.md): Unspecified vulnerability in Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-01 allows remote attackers to bypass authenticatio (no CVSS)
- [CVE-2007-6146](https://cve.now/CVE-2007-6146.md): Hitachi JP1/File Transmission Server/FTP 01-00 through 08-10-02 on Windows might allow remote attackers to cause a denial of service (servic (no CVSS)
- [CVE-2007-6147](https://cve.now/CVE-2007-6147.md): Multiple PHP remote file inclusion vulnerabilities in IAPR COMMENCE 1.3 allow remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.