# CVEs published 2007-12-15

38 CVEs were published on December 15, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6381](https://cve.now/CVE-2007-6381.md): SQL injection vulnerability in the indexed\_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote auth (no CVSS)
- [CVE-2007-6382](https://cve.now/CVE-2007-6382.md): The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the Swi (no CVSS, net.sf.robocode:robocode.core)
- [CVE-2007-6383](https://cve.now/CVE-2007-6383.md): The DAV component in Chandler Server (Cosmo) before 0.10.1 does not check resource creation permissions, which allows remote authenticated u (no CVSS)
- [CVE-2007-6384](https://cve.now/CVE-2007-6384.md): Unspecified vulnerability in the Image Converter functionality in BEA WebLogic Mobility Server 3.3, 3.5, and 3.6 through 3.6 SP1 allows remo (no CVSS)
- [CVE-2007-6385](https://cve.now/CVE-2007-6385.md): The proxy server in Kerio WinRoute Firewall before 6.4.1 does not properly enforce authentication for HTTPS pages, which has unknown impact (no CVSS)
- [CVE-2007-6386](https://cve.now/CVE-2007-6386.md): Stack-based buffer overflow in PccScan.dll before build 1451 in Trend Micro AntiVirus plus AntiSpyware 2008, Internet Security 2008, and Int (no CVSS)
- [CVE-2007-6387](https://cve.now/CVE-2007-6387.md): Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics Ans (no CVSS)
- [CVE-2007-4706](https://cve.now/CVE-2007-4706.md): Heap-based buffer overflow in Apple QuickTime before 7.3.1 allows remote attackers to execute arbitrary code via a crafted QTL file. (no CVSS)
- [CVE-2007-4707](https://cve.now/CVE-2007-4707.md): Multiple unspecified vulnerabilities in the Flash media handler in Apple QuickTime before 7.3.1 allow remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-5580](https://cve.now/CVE-2007-5580.md): Buffer overflow in a certain driver in Cisco Security Agent 4.5.1 before 4.5.1.672, 5.0 before 5.0.0.225, 5.1 before 5.1.0.106, and 5.2 befo (no CVSS)
- [CVE-2007-5582](https://cve.now/CVE-2007-5582.md): Cross-site scripting (XSS) vulnerability in the login page in Cisco CiscoWorks Server (CS), possibly 2.6 and earlier, when using CiscoWorks (no CVSS)
- [CVE-2007-6151](https://cve.now/CVE-2007-6151.md): The isdn\_ioctl function in isdn\_common.c in Linux kernel 2.6.23 allows local users to cause a denial of service via a crafted ioctl struct i (no CVSS)
- [CVE-2007-6195](https://cve.now/CVE-2007-6195.md): Buffer overflow in the sw\_rpc\_agent\_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX (no CVSS)
- [CVE-2007-6249](https://cve.now/CVE-2007-6249.md): etc-update in Portage before 2.1.3.11 on Gentoo Linux relies on the umask to set permissions for the merge file, often resulting in permissi (no CVSS)
- [CVE-2007-6338](https://cve.now/CVE-2007-6338.md): SQL injection vulnerability in userlogin.jsp in Trivantis CourseMill Enterprise Learning Management System 4.1 SP4 allows remote attackers t (no CVSS)
- [CVE-2007-6357](https://cve.now/CVE-2007-6357.md): Stack-based buffer overflow in Microsoft Office Access allows remote, user-assisted attackers to execute arbitrary code via a crafted Micros (no CVSS)
- [CVE-2007-6358](https://cve.now/CVE-2007-6358.md): pdftops.pl before 1.20 in alternate pdftops filter allows local users to overwrite arbitrary files via a symlink attack on the pdfin.\[PID\].t (no CVSS)
- [CVE-2007-6359](https://cve.now/CVE-2007-6359.md): The cs\_validate\_page function in bsd/kern/ubc\_subr.c in the xnu kernel 1228.0 and earlier in Apple Mac OS X 10.5.1 allows local users to cau (no CVSS)
- [CVE-2007-6360](https://cve.now/CVE-2007-6360.md): Unspecified vulnerability in the Sun eXtended System Control Facility (XSCF) Control Package (XCP) firmware before 1050 on SPARC Enterprise (no CVSS)
- [CVE-2007-6361](https://cve.now/CVE-2007-6361.md): Gekko 0.8.2 and earlier stores sensitive information under the web root with possibly insufficient access control, which might allow remote (no CVSS)
- [CVE-2007-6362](https://cve.now/CVE-2007-6362.md): SQL injection vulnerability in index.php in the RSGallery (com\_rsgallery) 2.0 beta 5 and earlier component for Mambo and Joomla! allows remo (no CVSS)
- [CVE-2007-6363](https://cve.now/CVE-2007-6363.md): IBM Tivoli Netcool Security Manager 1.3.0 before Interim Fix 1, when using Active Directory (AD) LDAP authentication, allows remote attacker (no CVSS)
- [CVE-2007-6364](https://cve.now/CVE-2007-6364.md): Cross-site scripting (XSS) vulnerability in modificarPerfil.php in JLMForo System allows remote authenticated users to inject arbitrary web (no CVSS)
- [CVE-2007-6365](https://cve.now/CVE-2007-6365.md): Cross-site scripting (XSS) vulnerability in modules/ecal/display.php in the Event Calendar in bcoos 1.0.10 allows remote attackers to inject (no CVSS)
- [CVE-2007-6366](https://cve.now/CVE-2007-6366.md): Multiple SQL injection vulnerabilities in SineCMS 2.3.4 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the id (no CVSS)
- [CVE-2007-6367](https://cve.now/CVE-2007-6367.md): Multiple cross-site scripting (XSS) vulnerabilities in the guestbook in SineCMS 2.3.4 and earlier allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2007-6368](https://cve.now/CVE-2007-6368.md): Directory traversal vulnerability in index.php in ezContents 1.4.5 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6369](https://cve.now/CVE-2007-6369.md): Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to (no CVSS)
- [CVE-2007-6371](https://cve.now/CVE-2007-6371.md): Nokia N95 cell phone with RM-159 12.0.013 firmware allows remote attackers to cause a denial of service (device inoperability) via a SIP INV (no CVSS)
- [CVE-2007-6372](https://cve.now/CVE-2007-6372.md): Unspecified vulnerability in Juniper JUNOS 7.3 through 8.4 allows remote attackers to cause a denial of service (crash) via malformed BGP pa (no CVSS)
- [CVE-2007-6373](https://cve.now/CVE-2007-6373.md): Multiple SQL injection vulnerabilities in GestDown 1.00 Beta allow remote attackers to execute arbitrary SQL commands via the (1) categorie (no CVSS)
- [CVE-2007-6374](https://cve.now/CVE-2007-6374.md): Multiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-6375](https://cve.now/CVE-2007-6375.md): Multiple SQL injection vulnerabilities in Bitweaver 2.0.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s (no CVSS)
- [CVE-2007-6376](https://cve.now/CVE-2007-6376.md): Directory traversal vulnerability in autohtml.php in Francisco Burzi PHP-Nuke 8.0 allows remote attackers to include and execute arbitrary l (no CVSS)
- [CVE-2007-6377](https://cve.now/CVE-2007-6377.md): Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2007-6378](https://cve.now/CVE-2007-6378.md): Directory traversal vulnerability in upload.dll in BadBlue 2.72b and earlier allows remote attackers to create or overwrite arbitrary files (no CVSS)
- [CVE-2007-6379](https://cve.now/CVE-2007-6379.md): BadBlue 2.72b and earlier allows remote attackers to obtain sensitive information via an invalid browse parameter, which reveals the install (no CVSS)
- [CVE-2007-6380](https://cve.now/CVE-2007-6380.md): Multiple SQL injection vulnerabilities in e-Xoops (exoops) 1.08, and 1.05 Rev 1 through 3, allow remote attackers to execute arbitrary SQL c (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.