# CVEs published 2007-12-20

75 CVEs were published on December 20, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6334](https://cve.now/CVE-2007-6334.md): Ingres 2.5 and 2.6 on Windows, as used in multiple CA products and possibly other products, assigns the privileges and identity of users to (no CVSS)
- [CVE-2007-6341](https://cve.now/CVE-2007-6341.md): Net/DNS/RR/A.pm in Net::DNS 0.60 build 654, as used in packages such as SpamAssassin and OTRS, allows remote attackers to cause a denial of (no CVSS)
- [CVE-2007-6349](https://cve.now/CVE-2007-6349.md): P4Webs.exe in Perforce P4Web 2006.2 and earlier, when running on Windows, allows remote attackers to cause a denial of service (CPU consumpt (no CVSS)
- [CVE-2007-6505](https://cve.now/CVE-2007-6505.md): Solaris 9, with Solaris Auditing enabled and certain patches for sshd installed, can generate audit records with an audit-ID of 0 even when (no CVSS)
- [CVE-2007-6506](https://cve.now/CVE-2007-6506.md): The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4 (no CVSS)
- [CVE-2007-6507](https://cve.now/CVE-2007-6507.md): SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions from (no CVSS)
- [CVE-2007-6285](https://cve.now/CVE-2007-6285.md): The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not spec (no CVSS)
- [CVE-2003-1538](https://cve.now/CVE-2003-1538.md): susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, whi (no CVSS)
- [CVE-2007-6472](https://cve.now/CVE-2007-6472.md): Multiple SQL injection vulnerabilities in phpMyRealty (PMR) 1.0.9 allow (1) remote attackers to execute arbitrary SQL commands via the type (no CVSS)
- [CVE-2007-6473](https://cve.now/CVE-2007-6473.md): Heap-based buffer overflow in Texas Imperial Software WFTPD Pro Explorer 1.0 allows remote FTP servers to execute arbitrary code via a long (no CVSS)
- [CVE-2007-6474](https://cve.now/CVE-2007-6474.md): Multiple cross-site scripting (XSS) vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-6475](https://cve.now/CVE-2007-6475.md): Multiple directory traversal vulnerabilities in GF-3XPLORER 2.4 allow remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2007-6476](https://cve.now/CVE-2007-6476.md): GF-3XPLORER 2.4 allows remote attackers to obtain configuration information via a direct request to explorer/phpinfo.php, which calls the ph (no CVSS)
- [CVE-2007-6477](https://cve.now/CVE-2007-6477.md): Cross-site scripting (XSS) vulnerability in the on-line help feature in Citrix Web Interface 2.0 and earlier, and NFuse, allows remote attac (no CVSS)
- [CVE-2007-6478](https://cve.now/CVE-2007-6478.md): Stack-based buffer overflow in Rosoft Media Player 4.1.7, 4.1.8, and possibly earlier versions allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2007-6479](https://cve.now/CVE-2007-6479.md): Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile" page) in Dokeos 1.8 (no CVSS)
- [CVE-2007-6480](https://cve.now/CVE-2007-6480.md): The Oracle database component in Sun Management Center (Sun MC) 3.6.1, 3.6, and 3.5 Update 1 has a default account, which allows remote atta (no CVSS)
- [CVE-2007-6481](https://cve.now/CVE-2007-6481.md): Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attacke (no CVSS)
- [CVE-2007-6482](https://cve.now/CVE-2007-6482.md): Unspecified vulnerability in the Device Manager daemon (utdevmgrd) in Sun Ray Server Software 2.0, 3.0, 3.1, and 3.1.1 allows remote attacke (no CVSS)
- [CVE-2007-6483](https://cve.now/CVE-2007-6483.md): Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys (no CVSS)
- [CVE-2007-6484](https://cve.now/CVE-2007-6484.md): SQL injection vulnerability in index.php in phpRPG 0.8 allows remote attackers to execute arbitrary SQL commands via the password parameter. (no CVSS)
- [CVE-2007-6485](https://cve.now/CVE-2007-6485.md): Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2007-6486](https://cve.now/CVE-2007-6486.md): Multiple cross-site scripting (XSS) vulnerabilities in shout.php (aka the shoutbox) in LineShout 1.0 allow remote attackers to inject arbitr (no CVSS)
- [CVE-2007-6487](https://cve.now/CVE-2007-6487.md): Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to cr (no CVSS)
- [CVE-2007-6488](https://cve.now/CVE-2007-6488.md): Multiple PHP remote file inclusion vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2007-6489](https://cve.now/CVE-2007-6489.md): Multiple cross-site scripting (XSS) vulnerabilities in Falcon Series One CMS 1.4.3 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2007-6490](https://cve.now/CVE-2007-6490.md): Cross-site request forgery (CSRF) vulnerability in Falcon Series One CMS 1.4.3 allows remote attackers to change a password via a certain ch (no CVSS)
- [CVE-2007-6491](https://cve.now/CVE-2007-6491.md): Multiple SQL injection vulnerabilities in Kvaliitti WebDoc 3.0 CMS allow remote attackers to execute arbitrary SQL commands via (1) the cat\_ (no CVSS)
- [CVE-2007-6492](https://cve.now/CVE-2007-6492.md): The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x, and possibly IMWebControl.dll, in iMesh 7.1.0.x and earlier allows remote att (no CVSS)
- [CVE-2007-6493](https://cve.now/CVE-2007-6493.md): The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x, and possibly IMWebControl.dll, in iMesh 7.1.0.x and earlier allows remote att (no CVSS)
- [CVE-2007-6494](https://cve.now/CVE-2007-6494.md): Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp with (no CVSS)
- [CVE-2007-6495](https://cve.now/CVE-2007-6495.md): inc\_newuser.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change the permissions of directories (no CVSS)
- [CVE-2007-6496](https://cve.now/CVE-2007-6496.md): Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to register arbitrary users via a request to hosting/addsubsite.asp w (no CVSS)
- [CVE-2007-6497](https://cve.now/CVE-2007-6497.md): Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a request to Hosting/Addres (no CVSS)
- [CVE-2007-6498](https://cve.now/CVE-2007-6498.md): Multiple SQL injection vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to execute arbitra (no CVSS)
- [CVE-2007-6499](https://cve.now/CVE-2007-6499.md): Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to uninstall the FrontPage ext (no CVSS)
- [CVE-2007-6500](https://cve.now/CVE-2007-6500.md): Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to delete "gateway information (no CVSS)
- [CVE-2007-6501](https://cve.now/CVE-2007-6501.md): Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay type (no CVSS)
- [CVE-2007-6502](https://cve.now/CVE-2007-6502.md): Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to obtain sensitive information via (1) the AdminName and A (no CVSS)
- [CVE-2007-6503](https://cve.now/CVE-2007-6503.md): Multiple unspecified vulnerabilities in Hosting Controller 6.1 Hot fix 3.3 and earlier allow remote authenticated users to (1) import an arb (no CVSS)
- [CVE-2007-6504](https://cve.now/CVE-2007-6504.md): Unspecified vulnerability in IIS/iibind.asp in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to change th (no CVSS)
- [CVE-2007-5584](https://cve.now/CVE-2007-5584.md): Unspecified vulnerability in Cisco Firewall Services Module (FWSM) 3.2(3) allows remote attackers to cause a denial of service (device reloa (no CVSS)
- [CVE-2007-6351](https://cve.now/CVE-2007-6351.md): libexif 0.6.16 and earlier allows context-dependent attackers to cause a denial of service (infinite recursion) via an image file with craft (no CVSS)
- [CVE-2007-6352](https://cve.now/CVE-2007-6352.md): Integer overflow in libexif 0.6.16 and earlier allows context-dependent attackers to execute arbitrary code via an image with crafted EXIF t (no CVSS)
- [CVE-2007-6430](https://cve.now/CVE-2007-6430.md): Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, wh (no CVSS)
- [CVE-2007-6242](https://cve.now/CVE-2007-6242.md): Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vect (no CVSS)
- [CVE-2007-6243](https://cve.now/CVE-2007-6243.md): Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 does not sufficiently restrict the interpretation and usag (no CVSS)
- [CVE-2007-6244](https://cve.now/CVE-2007-6244.md): Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers t (no CVSS)
- [CVE-2007-6245](https://cve.now/CVE-2007-6245.md): Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client (no CVSS)
- [CVE-2007-6246](https://cve.now/CVE-2007-6246.md): Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memo (no CVSS)
- [CVE-2007-6335](https://cve.now/CVE-2007-6335.md): Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, whic (no CVSS)
- [CVE-2007-6336](https://cve.now/CVE-2007-6336.md): Off-by-one error in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MS-ZIP compressed CAB file. (no CVSS)
- [CVE-2007-6353](https://cve.now/CVE-2007-6353.md): Integer overflow in exif.cpp in exiv2 library allows context-dependent attackers to execute arbitrary code via a crafted EXIF file that trig (no CVSS)
- [CVE-2007-5966](https://cve.now/CVE-2007-5966.md): Integer overflow in the hrtimer\_start function in kernel/hrtimer.c in the Linux kernel before 2.6.23.10 allows local users to execute arbitr (no CVSS)
- [CVE-2007-6281](https://cve.now/CVE-2007-6281.md): Heap-based buffer overflow in Open File Manager service (ofmnt.exe) in St. (no CVSS)
- [CVE-2007-6452](https://cve.now/CVE-2007-6452.md): Unspecified vulnerability in the benchmark reporting system in Google Web Toolkit (GWT) before 1.4.61 has unknown impact and attack vectors, (no CVSS)
- [CVE-2007-6453](https://cve.now/CVE-2007-6453.md): Directory traversal vulnerability in raidenhttpd-admin/workspace.php in RaidenHTTPD 2.0.19, when the WebAdmin function is enabled, allows re (no CVSS)
- [CVE-2007-6454](https://cve.now/CVE-2007-6454.md): Heap-based buffer overflow in the handshakeHTTP function in servhs.cpp in PeerCast 0.1217 and earlier, and SVN 344 and earlier, allows remot (no CVSS)
- [CVE-2007-6455](https://cve.now/CVE-2007-6455.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Mambo 4.6.2 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-6456](https://cve.now/CVE-2007-6456.md): Unspecified vulnerability in OpenOffice.org code in Planamesa NeoOffice 2.2.2 before Patch 4 has unknown impact and attack vectors related t (no CVSS)
- [CVE-2007-6457](https://cve.now/CVE-2007-6457.md): Stack-based buffer overflow in the webmail feature in SurgeMail 38k4 allows remote attackers to cause a denial of service (crash) via a long (no CVSS)
- [CVE-2007-6458](https://cve.now/CVE-2007-6458.md): SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-e (no CVSS)
- [CVE-2007-6459](https://cve.now/CVE-2007-6459.md): Anon Proxy Server 0.100, and probably 0.101, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the host (no CVSS)
- [CVE-2007-6460](https://cve.now/CVE-2007-6460.md): Multiple cross-site scripting (XSS) vulnerabilities in Anon Proxy Server before 0.101 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2007-6461](https://cve.now/CVE-2007-6461.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2007-6462](https://cve.now/CVE-2007-6462.md): SQL injection vulnerability in fullnews.php in PHP Real Estate Classifieds allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2007-6463](https://cve.now/CVE-2007-6463.md): Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in PHP Real Estate Classifieds allow remote attackers to inject arbit (no CVSS)
- [CVE-2007-6464](https://cve.now/CVE-2007-6464.md): Multiple PHP remote file inclusion vulnerabilities in Form tools 1.5.0b allow remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2007-6465](https://cve.now/CVE-2007-6465.md): Multiple cross-site scripting (XSS) vulnerabilities in ganglia-web in Ganglia before 3.0.6 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2007-6466](https://cve.now/CVE-2007-6466.md): Multiple SQL injection vulnerabilities in index.php in FreeWebshop 2.2.1 allow remote attackers to execute arbitrary SQL commands via (1) th (no CVSS)
- [CVE-2007-6467](https://cve.now/CVE-2007-6467.md): SQL injection vulnerability in index.php in MKPortal 1.1 RC1 allows remote attackers to execute arbitrary SQL commands via the ida parameter (no CVSS)
- [CVE-2007-6468](https://cve.now/CVE-2007-6468.md): Buffer overflow in the HuffDecode function in hw\_utils/hwrcon/huffman.c and hexenworld/Client/huffman.c in Hammer of Thyrion 1.4.2 allows re (no CVSS)
- [CVE-2007-6469](https://cve.now/CVE-2007-6469.md): SQL injection vulnerability in index.php in phpRPG 0.8, when magic\_qutoes\_gpc is disabled, allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-6470](https://cve.now/CVE-2007-6470.md): phpRPG 0.8 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read session I (no CVSS)
- [CVE-2007-6471](https://cve.now/CVE-2007-6471.md): Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.