CVE-2007-1364

MediumCVSS 6.4/10Last modified Jun 16, 2026

Description

DropAFew before 0.2.1 does not require authorization for certain privileged actions, which allows remote attackers to (1) view the logged calorie information of arbitrary users via the id parameter in editlogcal.php, (2) add arbitrary links via links.php, or (3) create arbitrary users via newaccount2.php.

Metrics

CVSS 2.0 6.4/10AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/24861Vendor Advisory
http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437Patch
http://www.securityfocus.com/bid/23400Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
https://www.cynops.de/advisories/CVE-2007-1363.txtVendor Advisory
http://secunia.com/advisories/24861Vendor Advisory
http://www.dropafew.com/sphpblog/comments.php?y=07&m=04&entry=entry070403-224437Patch
http://www.securityfocus.com/bid/23400Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/33561
https://www.cynops.de/advisories/CVE-2007-1363.txtVendor Advisory

Timeline

Published: Apr 11, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-136510.0Buffer overflow in kern/uipc_mbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets du CVE-2007-13662.1QEMU 0.8.2 allows local users to crash a virtual machine via the divisor operand to the aam instruction, as demonstrated by "aam 0x0," which CVE-2007-13674.3Cross-site scripting (XSS) vulnerability in the login page in Avaya Communications Manager (CM) S87XX, S8500, and S8300 products before 3.1.CVE-2007-13683.5The Project issue tracking module before 4.7.x-1.3, 4.7.x-2.* before 4.7.x-2.3, and 5 before 5.x-0.2-beta for Drupal allows remote authentic CVE-2007-13694.4ini_modifier (sgid-zendtech) in Zend Platform 2.2.3 and earlier allows local users to modify the system php.ini file by editing a copy of ph CVE-2007-13706.2Zend Platform 2.2.3 and earlier has incorrect ownership for scd.sh and certain other files, which allows local users to gain root privileges CVE-2007-13716.9Multiple buffer overflows in Conquest 8.2a and earlier (1) allow local users to gain privileges by querying a metaserver that sends a long s CVE-2007-137210.0PHP remote file inclusion vulnerability in styles/internal/header.php in the PostGuestbook 0.6.1 module for PHP-Nuke allows remote attackers CVE-2007-137310.0Stack-based buffer overflow in Mercury/32 (aka Mercury Mail Transport System) 4.01b and earlier allows remote attackers to execute arbitrary CVE-2007-13744.3Cross-site scripting (XSS) vulnerability in pop_profile.asp in Snitz Forums 2000 3.4.06 allows remote attackers to inject arbitrary web scri CVE-2007-13755.0Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a l CVE-2007-13767.5The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resour