Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2007

48 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2007-6203
    41Plan

    Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "4

    MediumCVSS 4.3Proof of conceptEPSS 80%

    apache · http serverDec 3, 2007

  • CVE-2007-6236
    26Monitor

    Microsoft Windows Media Player (WMP) allows remote attackers to cause a denial of service (application crash) via a certain AIFF file that t

    MediumCVSS 5.0Proof of conceptEPSS 18%

    microsoft · windows media playerDec 4, 2007

  • CVE-2007-6239
    28Monitor

    The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial o

    MediumCVSS 5.0No exploitEPSS 26%

    squid · squid web proxy cacheDec 4, 2007

  • CVE-2007-5355
    28Monitor

    The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7, when a primary DNS suffix with three or more components

    MediumCVSS 5.8No exploitEPSS 17%

    microsoft · windows 2000Dec 5, 2007

  • CVE-2007-4575
    41Plan

    HSQLDB before 1.8.0.9, as used in OpenOffice.org (OOo) 2 before 2.3.1, allows user-assisted remote attackers to execute arbitrary Java code

    CriticalCVSS 9.3No exploitEPSS 14%

    openoffice · openofficeDec 5, 2007

  • CVE-2007-6262
    30Monitor

    A certain ActiveX control in axvlc.dll in VideoLAN VLC 0.8.6 before 0.8.6d allows remote attackers to execute arbitrary code via crafted arg

    MediumCVSS 6.8Proof of conceptEPSS 11%

    videolan · vlc media playerDec 5, 2007

  • CVE-2007-5969
    32Monitor

    MySQL Community Server 5.0.x before 5.0.51, Enterprise Server 5.0.x before 5.0.52, Server 5.1.x before 5.1.23, and Server 6.0.x before 6.0.4

    HighCVSS 7.1No exploitEPSS 14%

    mysql · mysql serverDec 10, 2007

  • CVE-2007-6312
    22Monitor

    Cross-site scripting (XSS) vulnerability in the logon page in Web Reporting Tools portal in Websense Enterprise and Web Security Suite 6.3 a

    MediumCVSS 4.3No exploitEPSS 15%

    websense · enterpiseDec 11, 2007

  • CVE-2007-0064
    48Plan

    Heap-based buffer overflow in Windows Media Format Runtime 7.1, 9, 9.5, 9.5 x64 Edition, 11, and Windows Media Services 9.1 for Microsoft Wi

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · windows 2000Dec 11, 2007

  • CVE-2007-3039
    57Plan

    Stack-based buffer overflow in the Microsoft Message Queuing (MSMQ) service in Microsoft Windows 2000 Server SP4, Windows 2000 Professional

    CriticalCVSS 9.0WeaponizedEPSS 69%

    microsoft · windows 2000Dec 11, 2007

  • CVE-2007-3895
    48Plan

    Buffer overflow in Microsoft DirectShow in Microsoft DirectX 7.0 through 10.0 allows remote attackers to execute arbitrary code via a crafte

    CriticalCVSS 9.3No exploitEPSS 36%

    microsoft · windows 2000Dec 11, 2007

  • CVE-2007-3901
    48Plan

    Stack-based buffer overflow in the DirectShow Synchronized Accessible Media Interchange (SAMI) parser in quartz.dll for Microsoft DirectX 7.

    HighCVSS 8.5WeaponizedEPSS 45%

    microsoft · windows 2000Dec 11, 2007

  • CVE-2007-3902
    48Plan

    Use-after-free vulnerability in the CRecalcProperty function in mshtml.dll in Microsoft Internet Explorer 5.01 through 7 allows remote attac

    CriticalCVSS 9.3No exploitEPSS 35%

    microsoft · ieDec 11, 2007

  • CVE-2007-3903
    36Monitor

    Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via uninitialized or deleted objects used in repeated

    MediumCVSS 6.8No exploitEPSS 31%

    microsoft · ieDec 11, 2007

  • CVE-2007-5344
    35Monitor

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via a crafted website using Javascript that cre

    MediumCVSS 6.8No exploitEPSS 27%

    microsoft · ieDec 11, 2007

  • CVE-2007-5347
    35Monitor

    Microsoft Internet Explorer 5.01 through 7 allows remote attackers to execute arbitrary code via "unexpected method calls to HTML objects,"

    MediumCVSS 6.8No exploitEPSS 28%

    microsoft · ieDec 11, 2007

  • CVE-2007-5351
    52Plan

    Unspecified vulnerability in Server Message Block Version 2 (SMBv2) signing support in Microsoft Windows Vista allows remote attackers to fo

    CriticalCVSS 10.0No exploitEPSS 41%

    microsoft · windows vistaDec 11, 2007

  • CVE-2007-5000
    31Monitor

    Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61

    MediumCVSS 4.3No exploitEPSS 46%

    apache · http serverDec 13, 2007

  • CVE-2007-6325
    30Monitor

    PHP remote file inclusion vulnerability in adminbereich/designconfig.php in Fastpublish CMS 1.9999 allows remote attackers to execute arbitr

    MediumCVSS 6.8Proof of conceptEPSS 10%

    fastpublish · fastpublish cmsDec 13, 2007

  • CVE-2007-6327
    33Monitor

    Buffer overflow in a certain ActiveX control in Online Media Technologies AVSMJPEGFILE.DLL 1.1.1.102 allows remote attackers to execute arbi

    HighCVSS 7.5Proof of conceptEPSS 11%

    avs media · avsmjpegfile.dllDec 13, 2007

  • CVE-2007-6329
    30Monitor

    Microsoft Office 2007 12.0.6015.5000 and MSO 12.0.6017.5000 do not sign the metadata of Office Open XML (OOXML) documents, which makes it ea

    MediumCVSS 6.4No exploitEPSS 15%

    microsoft · officeDec 13, 2007

  • CVE-2007-6331
    46Plan

    Absolute path traversal vulnerability in the HPInfoDLL.HPInfo.1 ActiveX control in HPInfoDLL.dll 1.0, as shipped with HP Info Center (hpinfo

    CriticalCVSS 9.3Proof of conceptEPSS 30%

    hp · info centerDec 13, 2007

  • CVE-2007-6015
    45Plan

    Stack-based buffer overflow in the send_mailslot function in nmbd in Samba 3.0.0 through 3.0.27a, when the "domain logons" option is enabled

    CriticalCVSS 9.3Proof of conceptEPSS 27%

    samba · sambaDec 13, 2007

  • CVE-2007-6204
    61This week

    Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 6.41, 7.01, and 7.51 allow remote attackers to execute ar

    CriticalCVSS 10.0WeaponizedEPSS 69%

    hp · openview network node managerDec 13, 2007

  • CVE-2007-6195
    44Plan

    Buffer overflow in the sw_rpc_agent_init function in swagentd in Software Distributor (SD), and possibly other DCE applications, in HP HP-UX

    CriticalCVSS 10.0No exploitEPSS 13%

    hp · hp-uxDec 14, 2007

  • CVE-2007-6357
    28Monitor

    Stack-based buffer overflow in Microsoft Office Access allows remote, user-assisted attackers to execute arbitrary code via a crafted Micros

    MediumCVSS 5.8No exploitEPSS 15%

    microsoft · accessDec 14, 2007

  • CVE-2007-6377
    50Plan

    Stack-based buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier allows remote attackers to execute arbitra

    HighCVSS 7.5WeaponizedEPSS 66%

    badblue · badblueDec 14, 2007

  • CVE-2007-6387
    48Plan

    Multiple stack-based buffer overflows in the awApi4.AnswerWorks.1 ActiveX control in awApi4.dll 4.0.0.42, as used by Vantage Linguistics Ans

    CriticalCVSS 9.3Proof of conceptEPSS 38%

    intuit · bookkeepingDec 14, 2007

  • CVE-2007-6401
    46Plan

    Stack-based buffer overflow in mplayer2.exe in Microsoft Windows Media Player (WMP) 6.4, when used with the 3ivx 4.5.1 or 5.0.1 codec, allow

    CriticalCVSS 9.3Proof of conceptEPSS 29%

    3ivx · mpeg-4 codecDec 17, 2007

  • CVE-2007-5849
    41Plan

    Integer underflow in the asn1_get_string function in the SNMP back end (backend/snmp.c) for CUPS 1.2 through 1.3.4 allows remote attackers t

    CriticalCVSS 9.3Proof of conceptEPSS 13%

    apple · mac os xDec 19, 2007

  • CVE-2007-5863
    44Plan

    Software Update in Apple Mac OS X 10.5.1 allows remote attackers to execute arbitrary commands via a man-in-the-middle (MITM) attack between

    CriticalCVSS 9.3WeaponizedEPSS 22%

    apple · mac os xDec 19, 2007

  • CVE-2007-6454
    45Plan

    Heap-based buffer overflow in the handshakeHTTP function in servhs.cpp in PeerCast 0.1217 and earlier, and SVN 344 and earlier, allows remot

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    peercast · peercastDec 19, 2007

  • CVE-2007-6242
    36Monitor

    Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vect

    MediumCVSS 6.8No exploitEPSS 30%

    adobe · flash playerDec 19, 2007

  • CVE-2007-6244
    21Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers t

    MediumCVSS 4.3Proof of conceptEPSS 12%

    adobe · flash playerDec 19, 2007

  • CVE-2007-6246
    21Monitor

    Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memo

    MediumCVSS 4.4No exploitEPSS 11%

    linux · linux kernelDec 19, 2007

  • CVE-2007-6335
    36Monitor

    Integer overflow in libclamav in ClamAV before 0.92 allows remote attackers to execute arbitrary code via a crafted MEW packed PE file, whic

    HighCVSS 7.5Proof of conceptEPSS 18%

    clam anti-virus · clamavDec 19, 2007

  • CVE-2007-6483
    23Monitor

    Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys

    MediumCVSS 5.0Proof of conceptEPSS 10%

    safenet · sentinel keys serverDec 20, 2007

  • CVE-2007-6485
    33Monitor

    Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code vi

    HighCVSS 7.5Proof of conceptEPSS 10%

    centreon · centreonDec 20, 2007

  • CVE-2007-6494
    44Plan

    Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp with

    CriticalCVSS 10.0Proof of conceptEPSS 11%

    hosting controller · hosting controllerDec 20, 2007

  • CVE-2007-6506
    42Plan

    The HPRulesEngine.ContentCollection.1 ActiveX Control in RulesEngine.dll for HP Software Update 4.000.005.007 and earlier, including 3.0.8.4

    CriticalCVSS 9.3Proof of conceptEPSS 16%

    hp · software updateDec 20, 2007

  • CVE-2007-6507
    51Plan

    SpntSvc.exe daemon in Trend Micro ServerProtect 5.58 for Windows, before Security Patch 4, exposes unspecified dangerous sub-functions from

    CriticalCVSS 10.0WeaponizedEPSS 36%

    trend micro · serverprotectDec 20, 2007

  • CVE-2007-4567
    35Monitor

    The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.22 does not properly validate the hop-by-hop IPv6 extended

    HighCVSS 7.8Proof of conceptEPSS 14%

    linux · linux kernelDec 20, 2007

  • CVE-2007-6509
    48Plan

    Unspecified vulnerability in Appian Enterprise Business Process Management (BPM) Suite 5.6 SP1 allows remote attackers to cause a denial of

    HighCVSS 7.8WeaponizedEPSS 55%

    appian · business process management suiteDec 21, 2007

  • CVE-2007-6514
    28Monitor

    Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unp

    MediumCVSS 4.3Proof of conceptEPSS 38%

    linux · linux kernelDec 21, 2007

  • CVE-2007-4474
    50Plan

    Multiple stack-based buffer overflows in the IBM Lotus Domino Web Access ActiveX control, as provided by inotes6.dll, inotes6w.dll, dwa7.dll

    CriticalCVSS 9.3WeaponizedEPSS 44%

    ibm · domino web accessDec 27, 2007

  • CVE-2007-6530
    48Plan

    Buffer overflow in the XUpload.ocx ActiveX control in Persits Software XUpload 2.1.0.1, and probably other versions before 3.0, as used by H

    CriticalCVSS 9.3WeaponizedEPSS 36%

    persits · xuploadDec 27, 2007

  • CVE-2007-6533
    34Monitor

    Buffer overflow in Zoom Player 6.00 beta 2 and earlier allows user-assisted remote attackers to execute arbitrary code via an HTTP link to a

    HighCVSS 7.5Proof of conceptEPSS 12%

    inmatrix · zoom playerDec 27, 2007

  • CVE-2007-6534
    30Monitor

    Multiple unspecified vulnerabilities in Microsoft Office Publisher allow user-assisted remote attackers to cause a denial of service (applic

    MediumCVSS 6.8No exploitEPSS 11%

    microsoft · publisherDec 27, 2007