# CVEs published 2007-12-28

51 CVEs were published on December 28, 2007: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6565](https://cve.now/CVE-2007-6565.md): Multiple SQL injection vulnerabilities in Blakord Portal 1.3.A Beta and earlier allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-6566](https://cve.now/CVE-2007-6566.md): SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2007-6567](https://cve.now/CVE-2007-6567.md): Directory traversal vulnerability in index.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to include and exe (no CVSS)
- [CVE-2007-6568](https://cve.now/CVE-2007-6568.md): PHP remote file inclusion vulnerability in config.inc.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to exec (no CVSS)
- [CVE-2007-6569](https://cve.now/CVE-2007-6569.md): Cross-site scripting (XSS) vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows rem (no CVSS)
- [CVE-2007-6570](https://cve.now/CVE-2007-6570.md): Cross-site scripting (XSS) vulnerability in the View URL Database functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 and 3.x (no CVSS)
- [CVE-2007-6571](https://cve.now/CVE-2007-6571.md): Cross-site scripting (XSS) vulnerability in Sun Java System Web Proxy Server 3.6 before SP11 on Windows allows remote attackers to inject ar (no CVSS)
- [CVE-2007-6572](https://cve.now/CVE-2007-6572.md): Cross-site scripting (XSS) vulnerability in Sun Java System Web Server 6.1 before SP8 and 7.0 before Update 1 allows remote attackers to inj (no CVSS)
- [CVE-2007-6573](https://cve.now/CVE-2007-6573.md): QK SMTP Server 3 allows remote attackers to cause a denial of service (daemon crash) via a long (1) HELO, (2) MAIL FROM, or (3) RCPT TO comm (no CVSS)
- [CVE-2007-6574](https://cve.now/CVE-2007-6574.md): Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-6575](https://cve.now/CVE-2007-6575.md): SQL injection vulnerability in default.php in MMSLamp allows remote attackers to execute arbitrary SQL commands via the idpro parameter in a (no CVSS)
- [CVE-2007-6576](https://cve.now/CVE-2007-6576.md): Multiple SQL injection vulnerabilities in Adult Script 1.6.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id (no CVSS)
- [CVE-2007-6577](https://cve.now/CVE-2007-6577.md): Multiple SQL injection vulnerabilities in index.php in zBlog 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the categ (no CVSS)
- [CVE-2007-6578](https://cve.now/CVE-2007-6578.md): SQL injection vulnerability in go.php in PHP ZLink 0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2007-6579](https://cve.now/CVE-2007-6579.md): Multiple SQL injection vulnerabilities in Ip Reg 0.3 allow remote attackers to execute arbitrary SQL commands via the vlan\_id parameter to ( (no CVSS)
- [CVE-2007-6580](https://cve.now/CVE-2007-6580.md): Multiple SQL injection vulnerabilities in Wallpaper Site 1.0.09 allow remote attackers to execute arbitrary SQL commands via (1) the catid p (no CVSS)
- [CVE-2007-6581](https://cve.now/CVE-2007-6581.md): Multiple directory traversal vulnerabilities in Social Engine 2.0 allow remote attackers to include and execute arbitrary local files via a (no CVSS)
- [CVE-2007-6582](https://cve.now/CVE-2007-6582.md): Directory traversal vulnerability in index.php in mBlog 1.2 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6583](https://cve.now/CVE-2007-6583.md): SQL injection vulnerability in admin/ops/findip/ajax/search.php in 1024 CMS 1.3.1 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-6584](https://cve.now/CVE-2007-6584.md): Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2007-6585](https://cve.now/CVE-2007-6585.md): PHP remote file inclusion vulnerability in confirmUnsubscription.php in NmnNewsletter 1.0.7 allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2007-6586](https://cve.now/CVE-2007-6586.md): SQL injection vulnerability in sezione\_news.php in nicLOR-CMS allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2007-6587](https://cve.now/CVE-2007-6587.md): SQL injection vulnerability in plog-rss.php in Plogger 1.0 Beta 3.0 allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2007-6588](https://cve.now/CVE-2007-6588.md): Cross-site scripting (XSS) vulnerability in PHCDownload 1.10 allows remote attackers to inject arbitrary web script or HTML via the username (no CVSS)
- [CVE-2007-6589](https://cve.now/CVE-2007-6589.md): The jar protocol handler in Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7 does not update the origin domain when retrieving the (no CVSS)
- [CVE-2007-6591](https://cve.now/CVE-2007-6591.md): KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards t (no CVSS)
- [CVE-2007-6592](https://cve.now/CVE-2007-6592.md): Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as (no CVSS)
- [CVE-2007-6593](https://cve.now/CVE-2007-6593.md): Multiple stack-based buffer overflows in l123sr.dll in Autonomy (formerly Verity) KeyView SDK, as used by IBM Lotus Notes 5.x through 8.x, a (no CVSS)
- [CVE-2007-6594](https://cve.now/CVE-2007-6594.md): IBM Lotus Notes 8 for Linux before 8.0.1 uses (1) unspecified weak permissions for the installation kit obtained through a Notes 8 download (no CVSS)
- [CVE-2007-6543](https://cve.now/CVE-2007-6543.md): SQL injection vulnerability in suggest-link.php in eSyndiCat Link Exchange Script allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-6544](https://cve.now/CVE-2007-6544.md): Multiple SQL injection vulnerabilities in RunCMS before 1.6.1 allow remote attackers to execute arbitrary SQL commands via the lid parameter (no CVSS)
- [CVE-2007-6545](https://cve.now/CVE-2007-6545.md): Multiple cross-site scripting (XSS) vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-6546](https://cve.now/CVE-2007-6546.md): RunCMS before 1.6.1 uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id. (no CVSS)
- [CVE-2007-6547](https://cve.now/CVE-2007-6547.md): RunCMS before 1.6.1 does not require entry of the old password during a password change, which allows context-dependent attackers to change (no CVSS)
- [CVE-2007-6548](https://cve.now/CVE-2007-6548.md): Multiple direct static code injection vulnerabilities in RunCMS before 1.6.1 allow remote authenticated administrators to inject arbitrary P (no CVSS)
- [CVE-2007-6549](https://cve.now/CVE-2007-6549.md): Unspecified vulnerability in RunCMS before 1.6.1 has unknown impact and attack vectors, related to "pagetype using." (no CVSS)
- [CVE-2007-6550](https://cve.now/CVE-2007-6550.md): form.php in PMOS Help Desk 2.4 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct e (no CVSS)
- [CVE-2007-6551](https://cve.now/CVE-2007-6551.md): SQL injection vulnerability in showMsg.php in MailMachine Pro 2.2.4, and other versions before 2.2.6, allows remote attackers to execute arb (no CVSS)
- [CVE-2007-6552](https://cve.now/CVE-2007-6552.md): Directory traversal vulnerability in index.php in AuraCMS 2.2 allows remote authenticated users to include and execute arbitrary local files (no CVSS)
- [CVE-2007-6553](https://cve.now/CVE-2007-6553.md): Multiple PHP remote file inclusion vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to execute arbitrary PHP code v (no CVSS)
- [CVE-2007-6554](https://cve.now/CVE-2007-6554.md): Multiple directory traversal vulnerabilities in TeamCal Pro 3.1.000 and earlier allow remote attackers to include and execute arbitrary loca (no CVSS)
- [CVE-2007-6555](https://cve.now/CVE-2007-6555.md): PHP remote file inclusion vulnerability in modules/mod\_pxt\_latest.php in the mosDirectory (com\_directory) 2.3.2 component for Joomla! allows (no CVSS)
- [CVE-2007-6556](https://cve.now/CVE-2007-6556.md): Multiple SQL injection vulnerabilities in websihirbazi 5.1.1 allow remote attackers to execute arbitrary SQL commands via (1) the id paramet (no CVSS)
- [CVE-2007-6557](https://cve.now/CVE-2007-6557.md): Multiple SQL injection vulnerabilities in MeGaCheatZ 1.1 allow remote attackers to execute arbitrary SQL commands via the ItemID parameter t (no CVSS)
- [CVE-2007-6558](https://cve.now/CVE-2007-6558.md): TotalPlayer 3.0 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .m3u file. (no CVSS)
- [CVE-2007-6559](https://cve.now/CVE-2007-6559.md): Multiple SQL injection vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to execute arbitrary SQL commands via (1) the from (no CVSS)
- [CVE-2007-6560](https://cve.now/CVE-2007-6560.md): Multiple cross-site scripting (XSS) vulnerabilities in Logaholic before 2.0 RC8 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-6561](https://cve.now/CVE-2007-6561.md): Multiple stack-based buffer overflows in PDFLib allow user-assisted remote attackers to execute arbitrary code via a long filename argument (no CVSS)
- [CVE-2007-6562](https://cve.now/CVE-2007-6562.md): Multiple stack-based buffer overflows in the use of FD\_SET in TCPreen before 1.4.4 allow remote attackers to cause a denial of service via m (no CVSS)
- [CVE-2007-6563](https://cve.now/CVE-2007-6563.md): Heap-based buffer overflow in WinAce 2.65 and earlier, and possibly other versions before 2.69, allows user-assisted remote attackers to exe (no CVSS)
- [CVE-2007-6564](https://cve.now/CVE-2007-6564.md): Cross-site scripting (XSS) vulnerability in admin.php in Limbo CMS 1.0.4.2 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2007-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.