# CVEs published 2007-12-04

34 CVEs were published on December 4, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6224](https://cve.now/CVE-2007-6224.md): The RealNetworks RealAudioObjects.RealAudio ActiveX control in rmoc3260.dll, as shipped with RealPlayer 11, allows remote attackers to cause (no CVSS)
- [CVE-2007-6225](https://cve.now/CVE-2007-6225.md): Unspecified vulnerability in Sun Solaris 10, when 64bit mode is used on the x86 platform, allows local users in a Linux (lx) branded zone to (no CVSS)
- [CVE-2007-6226](https://cve.now/CVE-2007-6226.md): The American Power Conversion (APC) AP7932 0u 30amp Switched Rack Power Distribution Unit (PDU), with rpdu 3.5.5 and aos 3.5.6, allows remot (no CVSS)
- [CVE-2007-6227](https://cve.now/CVE-2007-6227.md): QEMU 0.9.0 allows local users of a Windows XP SP2 guest operating system to overwrite the TranslationBlock (code\_gen\_buffer) buffer, and pro (no CVSS)
- [CVE-2007-6228](https://cve.now/CVE-2007-6228.md): Stack-based buffer overflow in the Helper class in the yt.ythelper.2 ActiveX control in Yahoo! Toolbar 1.4.1 allows remote attackers to caus (no CVSS)
- [CVE-2007-6229](https://cve.now/CVE-2007-6229.md): PHP remote file inclusion vulnerability in common/classes/class\_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to execute (no CVSS)
- [CVE-2007-6230](https://cve.now/CVE-2007-6230.md): Directory traversal vulnerability in common/classes/class\_HeaderHandler.lib.php in Rayzz Script 2.0 allows remote attackers to include and e (no CVSS)
- [CVE-2007-6231](https://cve.now/CVE-2007-6231.md): Multiple PHP remote file inclusion vulnerabilities in tellmatic 1.0.7 allow remote attackers to execute arbitrary PHP code via a URL in the (no CVSS)
- [CVE-2007-6232](https://cve.now/CVE-2007-6232.md): Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-6233](https://cve.now/CVE-2007-6233.md): Directory traversal vulnerability in index.php in FTP Admin 0.1.0 allows remote authenticated users to include and execute arbitrary local f (no CVSS)
- [CVE-2007-6234](https://cve.now/CVE-2007-6234.md): index.php in FTP Admin 0.1.0 allows remote attackers to bypass authentication and obtain administrative access via a loggedin parameter with (no CVSS)
- [CVE-2007-6235](https://cve.now/CVE-2007-6235.md): A certain ActiveX control in RealNetworks RealPlayer 11 allows remote attackers to cause a denial of service (application crash) via a malfo (no CVSS)
- [CVE-2007-6236](https://cve.now/CVE-2007-6236.md): Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a certain AIFF file that t (no CVSS)
- [CVE-2007-6237](https://cve.now/CVE-2007-6237.md): cp.php in DeluxeBB 1.09 does not verify that the membercookie parameter corresponds to the authenticated member during a profile update, whi (no CVSS)
- [CVE-2007-6238](https://cve.now/CVE-2007-6238.md): Unspecified vulnerability in Apple QuickTime 7.2 on Windows XP allows remote attackers to execute arbitrary code via unknown attack vectors, (no CVSS)
- [CVE-2007-6239](https://cve.now/CVE-2007-6239.md): The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2007-6218](https://cve.now/CVE-2007-6218.md): Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2007-6219](https://cve.now/CVE-2007-6219.md): Cross-site scripting (XSS) vulnerability in IBM Tivoli Netcool Security Manager 1.3.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-6220](https://cve.now/CVE-2007-6220.md): typespeed before 0.6.4 allows remote attackers to cause a denial of service (application crash) via unspecified network behavior that trigge (no CVSS)
- [CVE-2007-6221](https://cve.now/CVE-2007-6221.md): TuMusika Evolution 1.7R5 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the ph (no CVSS)
- [CVE-2007-6222](https://cve.now/CVE-2007-6222.md): The CheckCustomerAccess function in functions.php in CRM-CTT Interleave before 4.2.0 (formerly CRM-CTT) does not properly verify user privil (no CVSS)
- [CVE-2007-6223](https://cve.now/CVE-2007-6223.md): SQL injection vulnerability in garage.php in phpBB Garage 1.2.0 Beta3 allows remote attackers to execute arbitrary SQL commands via the make (no CVSS)
- [CVE-2007-6212](https://cve.now/CVE-2007-6212.md): Directory traversal vulnerability in region.php in KML share 1.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6213](https://cve.now/CVE-2007-6213.md): Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6214](https://cve.now/CVE-2007-6214.md): Directory traversal vulnerability in include/file\_download.php in LearnLoop 2.0 beta7 allows remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2007-6215](https://cve.now/CVE-2007-6215.md): Multiple directory traversal vulnerabilities in play.php in Web-MeetMe 3.0.3 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6216](https://cve.now/CVE-2007-6216.md): Race condition in the Fibre Channel protocol (fcp) driver and Devices filesystem (devfs) in Sun Solaris 10 allows local users to cause a den (no CVSS)
- [CVE-2007-6217](https://cve.now/CVE-2007-6217.md): Multiple SQL injection vulnerabilities in login.asp in Irola My-Time (aka Timesheet) 3.5 allow remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2007-6210](https://cve.now/CVE-2007-6210.md): zabbix\_agentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges. (no CVSS)
- [CVE-2007-6211](https://cve.now/CVE-2007-6211.md): Send ICMP Nasty Garbage (sing) on Debian GNU/Linux allows local users to append to arbitrary files and gain privileges via the -L (output lo (no CVSS)
- [CVE-2007-6206](https://cve.now/CVE-2007-6206.md): The do\_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID (no CVSS)
- [CVE-2007-6207](https://cve.now/CVE-2007-6207.md): Xen 3.x, possibly before 3.1.2, when running on IA64 systems, does not check the RID value for mov\_to\_rr, which allows a VTi domain to read (no CVSS)
- [CVE-2007-6208](https://cve.now/CVE-2007-6208.md): sylprint.pl in claws mail tools (claws-mail-tools) allows local users to overwrite arbitrary files via a symlink attack on the sylprint.\[USE (no CVSS)
- [CVE-2007-6209](https://cve.now/CVE-2007-6209.md): Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.