# CVEs published 2008-01-04

54 CVEs were published on January 4, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6647](https://cve.now/CVE-2007-6647.md): SQL injection vulnerability in index.php in w-Agora 4.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cat (no CVSS)
- [CVE-2007-6648](https://cve.now/CVE-2007-6648.md): Directory traversal vulnerability in index.php in SanyBee Gallery 0.1.0 and 0.1.1 allows remote attackers to include and execute arbitrary l (no CVSS)
- [CVE-2007-6649](https://cve.now/CVE-2007-6649.md): PHP remote file inclusion vulnerability in includes/tumbnail.php in MatPo Bilder Galerie 1.1 allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2007-6650](https://cve.now/CVE-2007-6650.md): Unrestricted file upload vulnerability in fisheye/upload.php in Bitweaver R2 CMS allows remote attackers to upload arbitrary files by using (no CVSS)
- [CVE-2007-6651](https://cve.now/CVE-2007-6651.md): Directory traversal vulnerability in wiki/edit.php in Bitweaver R2 CMS allows remote attackers to obtain sensitive information (script sourc (no CVSS)
- [CVE-2007-6652](https://cve.now/CVE-2007-6652.md): cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit, which allows remote attackers to conduct direct sta (no CVSS)
- [CVE-2007-6653](https://cve.now/CVE-2007-6653.md): Directory traversal vulnerability in download.php in Mihalism Multi Host 2.0.7 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6654](https://cve.now/CVE-2007-6654.md): Buffer overflow in a certain ActiveX control in Macrovision InstallShield Update Service Web Agent 5.1.100.47363 allows remote attackers to (no CVSS)
- [CVE-2007-6655](https://cve.now/CVE-2007-6655.md): PHP remote file inclusion vulnerability in includes/function.php in Kontakt Formular 1.4 allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2007-6656](https://cve.now/CVE-2007-6656.md): SQL injection vulnerability in content\_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2007-6657](https://cve.now/CVE-2007-6657.md): PHP remote file inclusion vulnerability in source/includes/load\_forum.php in Mihalism Multi Forum Host 3.0.x and earlier allows remote attac (no CVSS)
- [CVE-2007-6658](https://cve.now/CVE-2007-6658.md): SQL injection vulnerability in admin.php/vars.php in CustomCMS (CCMS) 3.1 Demo allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-6659](https://cve.now/CVE-2007-6659.md): Multiple cross-site scripting (XSS) vulnerabilities in 2z project 0.9.6.1 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-6660](https://cve.now/CVE-2007-6660.md): 2z project 0.9.6.1 allows remote attackers to obtain sensitive information via (1) a request to index.php with an invalid template or (2) a (no CVSS)
- [CVE-2007-6661](https://cve.now/CVE-2007-6661.md): 2z project 0.9.6.1 allows attackers to change the password without supplying the old password. (no CVSS)
- [CVE-2007-6662](https://cve.now/CVE-2007-6662.md): Directory traversal vulnerability in file.php in CuteNews 2.6 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6663](https://cve.now/CVE-2007-6663.md): SQL injection vulnerability in (1) Puarcade.php and (2) PUarcade.html.php in Pragmatic Utopia PU Arcade (com\_puarcade) 2.0.3, 2.1.2, and 2.1 (no CVSS)
- [CVE-2007-6664](https://cve.now/CVE-2007-6664.md): SQL injection vulnerability in index.php in WebPortal CMS 0.6.0 and earlier allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2007-6665](https://cve.now/CVE-2007-6665.md): SQL injection vulnerability in admin/login.asp in Netchemia oneSCHOOL allows remote attackers to execute arbitrary SQL commands via the txtL (no CVSS)
- [CVE-2007-6666](https://cve.now/CVE-2007-6666.md): SQL injection vulnerability in rss.php in Zenphoto 1.1 through 1.1.3 allows remote attackers to execute arbitrary SQL commands via the album (no CVSS)
- [CVE-2007-6667](https://cve.now/CVE-2007-6667.md): SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id p (no CVSS)
- [CVE-2007-6598](https://cve.now/CVE-2007-6598.md): Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which (no CVSS)
- [CVE-2007-6599](https://cve.now/CVE-2007-6599.md): Race condition in fileserver in OpenAFS 1.3.50 through 1.4.5 and 1.5.0 through 1.5.27 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2007-6639](https://cve.now/CVE-2007-6639.md): SQL injection vulnerability in index.php in IPTBB 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2007-6640](https://cve.now/CVE-2007-6640.md): Creammonkey 0.9 through 1.1 and GreaseKit 1.2 through 1.3 does not properly prevent access to dangerous functions, which allows remote attac (no CVSS)
- [CVE-2007-6641](https://cve.now/CVE-2007-6641.md): Cross-site scripting (XSS) vulnerability in dir.php in milliscripts Redirection allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2007-6642](https://cve.now/CVE-2007-6642.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Joomla! before 1.5 RC4 allow remote attackers to (1) add a Super Admin, (2) up (no CVSS)
- [CVE-2007-6643](https://cve.now/CVE-2007-6643.md): Cross-site scripting (XSS) vulnerability in the com\_poll component in Joomla! before 1.5 RC4 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2007-6644](https://cve.now/CVE-2007-6644.md): Joomla! before 1.5 RC4 allows remote authenticated administrators to promote arbitrary users to the administrator group, in violation of the (no CVSS)
- [CVE-2007-6645](https://cve.now/CVE-2007-6645.md): Unspecified vulnerability in Joomla! before 1.5 RC4 allows remote authenticated users to gain privileges via unspecified vectors, aka "regis (no CVSS)
- [CVE-2007-6646](https://cve.now/CVE-2007-6646.md): Multiple cross-site scripting (XSS) vulnerabilities in LiveCart 1.0.1, and possibly other versions before 1.1.0, allow remote attackers to i (no CVSS)
- [CVE-2008-0089](https://cve.now/CVE-2008-0089.md): SQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter. (no CVSS)
- [CVE-2008-0090](https://cve.now/CVE-2008-0090.md): A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 cra (no CVSS)
- [CVE-2008-0091](https://cve.now/CVE-2008-0091.md): Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a . (no CVSS)
- [CVE-2008-0092](https://cve.now/CVE-2008-0092.md): Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote at (no CVSS)
- [CVE-2007-6620](https://cve.now/CVE-2007-6620.md): Directory traversal vulnerability in include/images.inc.php in Joovili 2.x allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2007-6621](https://cve.now/CVE-2007-6621.md): Directory traversal vulnerability in joovili.images.php in Joovili 3.0.0 through 3.0.6 allows remote attackers to read arbitrary files via a (no CVSS)
- [CVE-2007-6622](https://cve.now/CVE-2007-6622.md): SQL injection vulnerability in security.php in ZeusCMS 0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Ref (no CVSS)
- [CVE-2007-6623](https://cve.now/CVE-2007-6623.md): Absolute path traversal vulnerability in ZeusCMS 0.3 and earlier might allow remote attackers to list arbitrary directories via a full pathn (no CVSS)
- [CVE-2007-6624](https://cve.now/CVE-2007-6624.md): Directory traversal vulnerability in printview.php in PNphpBB2 1.2i and earlier allows remote attackers to include and execute arbitrary loc (no CVSS)
- [CVE-2007-6625](https://cve.now/CVE-2007-6625.md): The Platform Service Process (asampsp) in Fan-Out Driver Platform Services for Novell Identity Manager (IDM) 3.5.1 allows remote attackers t (no CVSS)
- [CVE-2007-6626](https://cve.now/CVE-2007-6626.md): Multiple buffer overflows in the RTSP\_valid\_response\_msg function in RTSP\_state\_machine.c in LScube Feng 0.1.15 and earlier allow remote att (no CVSS)
- [CVE-2007-6627](https://cve.now/CVE-2007-6627.md): Integer overflow in the RTSP\_remove\_msg function in RTSP\_lowlevel.c in LScube Feng 0.1.15 and earlier allows remote attackers to cause a den (no CVSS)
- [CVE-2007-6628](https://cve.now/CVE-2007-6628.md): LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon crash) via (1) a malformed (no CVSS)
- [CVE-2007-6629](https://cve.now/CVE-2007-6629.md): Interpretation conflict in LScube Feng 0.1.15 and earlier allows remote attackers to cause a denial of service (NULL dereference and daemon (no CVSS)
- [CVE-2007-6630](https://cve.now/CVE-2007-6630.md): The Url\_init function in utils/url.c in Netembryo 0.0.4, when used by LScube Feng, allows remote attackers to cause a denial of service (NUL (no CVSS)
- [CVE-2007-6631](https://cve.now/CVE-2007-6631.md): Multiple buffer overflows in LScube libnemesi 0.6.4-rc1 and earlier allow remote attackers to execute arbitrary code via (1) a reply that be (no CVSS)
- [CVE-2007-6632](https://cve.now/CVE-2007-6632.md): showCode.php in xml2owl 0.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter. (no CVSS)
- [CVE-2007-6633](https://cve.now/CVE-2007-6633.md): Multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2007-6634](https://cve.now/CVE-2007-6634.md): Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2007-6635](https://cve.now/CVE-2007-6635.md): FAQMasterFlexPlus, possibly 1.5 or 1.52, stores the admin password in cleartext in a database, which might allow context-dependent attackers (no CVSS)
- [CVE-2007-6636](https://cve.now/CVE-2007-6636.md): Unspecified vulnerability in the StorageFarabDb module in Bitflu before 0.42 allows user-assisted remote attackers to create or append data (no CVSS)
- [CVE-2007-6637](https://cve.now/CVE-2007-6637.md): Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2007-6638](https://cve.now/CVE-2007-6638.md): March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.