# CVEs published 2007-12-17 28 CVEs were published on December 17, 2007: 0 critical, 0 high. Days are UTC. - [CVE-2007-6413](https://cve.now/CVE-2007-6413.md): Sun Solaris 10 with the 120011-04 and 120012-04 patches, and later 120011-\* and 120012-\* patches, allows remote attackers to bypass certain (no CVSS) - [CVE-2007-6414](https://cve.now/CVE-2007-6414.md): admin/administrator.php in Adult Script 1.6 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers (no CVSS) - [CVE-2007-6416](https://cve.now/CVE-2007-6416.md): The copy\_to\_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users (no CVSS) - [CVE-2007-4473](https://cve.now/CVE-2007-4473.md): Gesytec Easylon OPC Server before 2.3.44 does not properly validate server handles, which allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2007-6389](https://cve.now/CVE-2007-6389.md): The notify feature in GNOME screensaver (gnome-screensaver) 2.20.0 might allow local users to read the clipboard contents and X selection da (no CVSS) - [CVE-2007-6390](https://cve.now/CVE-2007-6390.md): Cross-site request forgery (CSRF) vulnerability in the mycalendar plugin before 0.13 for Serendipity allows remote attackers to perform acti (no CVSS) - [CVE-2007-6391](https://cve.now/CVE-2007-6391.md): SQL injection vulnerability in patch/comments.php in SH-News 3.0 allows remote attackers to execute arbitrary SQL commands via the id parame (no CVSS) - [CVE-2007-6392](https://cve.now/CVE-2007-6392.md): SQL injection vulnerability in DWdirectory 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the search paramete (no CVSS) - [CVE-2007-6393](https://cve.now/CVE-2007-6393.md): SQL injection vulnerability in albums.php in Ace Image Hosting Script allows remote authenticated users to execute arbitrary SQL commands vi (no CVSS) - [CVE-2007-6394](https://cve.now/CVE-2007-6394.md): SQL injection vulnerability in index.php in Content Injector 1.53 allows remote attackers to execute arbitrary SQL commands via the id param (no CVSS) - [CVE-2007-6395](https://cve.now/CVE-2007-6395.md): Flat PHP Board 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attacke (no CVSS) - [CVE-2007-6396](https://cve.now/CVE-2007-6396.md): Direct static code injection vulnerability in index.php in Flat PHP Board 1.2 and earlier allows remote attackers to inject arbitrary PHP co (no CVSS) - [CVE-2007-6397](https://cve.now/CVE-2007-6397.md): Multiple directory traversal vulnerabilities in index.php in Flat PHP Board 1.2 and earlier allow remote attackers to (1) create arbitrary f (no CVSS) - [CVE-2007-6398](https://cve.now/CVE-2007-6398.md): Flat PHP Board 1.2 and earlier allows remote attackers to bypass authentication and obtain limited access to an arbitrary user account via t (no CVSS) - [CVE-2007-6399](https://cve.now/CVE-2007-6399.md): index.php in Flat PHP Board 1.2 and earlier allows remote authenticated users to obtain the password for the current user account by reading (no CVSS) - [CVE-2007-6400](https://cve.now/CVE-2007-6400.md): Directory traversal vulnerability in download\_file.php in PolDoc CMS (aka PDDMS) 0.96 allows remote attackers to read arbitrary files via a (no CVSS) - [CVE-2007-6401](https://cve.now/CVE-2007-6401.md): Stack-based buffer overflow in mplayer2.exe in Microsoft Windows Media Player (WMP) 6.4, when used with the 3ivx 4.5.1 or 5.0.1 codec, allow (no CVSS) - [CVE-2007-6402](https://cve.now/CVE-2007-6402.md): Stack-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9, when used with the 3ivx 4.5.1 or 5.0.1 codec, allows remote (no CVSS) - [CVE-2007-6403](https://cve.now/CVE-2007-6403.md): Stack-based buffer overflow in Nullsoft Winamp 5.32 allows user-assisted remote attackers to execute arbitrary code via crafted unicode in a (no CVSS) - [CVE-2007-6404](https://cve.now/CVE-2007-6404.md): Directory traversal vulnerability in Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to read arbitra (no CVSS) - [CVE-2007-6405](https://cve.now/CVE-2007-6405.md): Sergey Lyubka Simple HTTPD (shttpd) 1.38 and earlier on Windows allows remote attackers to download arbitrary CGI programs or scripts via a (no CVSS) - [CVE-2007-6406](https://cve.now/CVE-2007-6406.md): Multiple cross-site scripting (XSS) vulnerabilities in CA (formerly Computer Associates) eTrust Threat Management Console allow remote attac (no CVSS) - [CVE-2007-6407](https://cve.now/CVE-2007-6407.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Provisioning Manager Express allow remote attackers to inject arbitrary we (no CVSS) - [CVE-2007-6408](https://cve.now/CVE-2007-6408.md): IBM Tivoli Provisioning Manager Express provides unspecified information in error messages when (1) attempted duplication of a username occu (no CVSS) - [CVE-2007-6409](https://cve.now/CVE-2007-6409.md): The gg protocol handler in Gadu-Gadu, when this product is installed but not running, does not properly handle the skin attribute, which all (no CVSS) - [CVE-2007-6410](https://cve.now/CVE-2007-6410.md): Gadu-Gadu does not properly perform protocol handling, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks an (no CVSS) - [CVE-2007-6411](https://cve.now/CVE-2007-6411.md): Multiple buffer overflows in the HandleEmotsConfig function in the GG Client in Gadu-Gadu 7.7 Build 3669 allow user-assisted remote attacker (no CVSS) - [CVE-2007-6412](https://cve.now/CVE-2007-6412.md): Direct static code injection vulnerability in wiki/index.php in Bitweaver 2.0.0 and earlier, when comments are enabled, allows remote attack (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2007-12-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.