2008 CVEs (page 19)
Page 19 of 71 — CVEs published in 2008, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2008-5646 | | 2008-12-17 | Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain wiki markup." | |
CVE-2008-5645 | | 2008-12-17 | Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traver… | |
CVE-2008-5644 | | 2008-12-17 | Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown v… | |
CVE-2008-5643 | | 2008-12-17 | SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter… | |
CVE-2008-5642 | | 2008-12-17 | Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_langu… | |
CVE-2008-5641 | | 2008-12-17 | SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) p… | |
CVE-2008-5640 | | 2008-12-17 | SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter. | |
CVE-2008-5639 | | 2008-12-17 | Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. (dot dot) in the m parameter. | |
CVE-2008-5638 | | 2008-12-17 | Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter to… | |
CVE-2008-5637 | | 2008-12-17 | SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter. | |
CVE-2008-5636 | | 2008-12-17 | SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the… | |
CVE-2008-5635 | | 2008-12-17 | SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) pass… | |
CVE-2008-5634 | | 2008-12-17 | SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) pa… | |
CVE-2008-5633 | | 2008-12-17 | SQL injection vulnerability in register.asp in ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password… | |
CVE-2008-5632 | | 2008-12-17 | SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) pa… | |
CVE-2008-5631 | | 2008-12-17 | SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka… | |
CVE-2008-5630 | | 2008-12-17 | SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL commands via the umprof_s… | |
CVE-2008-5629 | | 2008-12-17 | SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play acti… | |
CVE-2008-5628 | | 2008-12-17 | SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter. | |
CVE-2008-5627 | | 2008-12-17 | SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Emai… | |
CVE-2008-5626 | | 2008-12-17 | XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command, as demonstrated by… | |
CVE-2008-5625 | | 2008-12-17 | PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows… | |
CVE-2008-5624 | | 2008-12-17 | PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-depend… | |
CVE-2008-5558 | | 2008-12-17 | Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cau… | |
CVE-2008-5621 | | 2008-12-17 | Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized act… | |
CVE-2008-5620 | | 2008-12-17 | RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size parameters that ar… | |
CVE-2008-5619 | | 2008-12-17 | html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, an… | |
CVE-2008-5618 | | 2008-12-17 | imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthorized sender, which al… | |
CVE-2008-5617 | | 2008-12-17 | The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to bypass intended acces… | |
CVE-2008-5081 | | 2008-12-17 | The originates_from_local_legacy_unicast_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attackers to cause a denial… | |
CVE-2008-5616 | | 2008-12-17 | Stack-based buffer overflow in the demux_open_vqf function in libmpdemux/demux_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attackers to execute arbitr… | |
CVE-2008-5609 | | 2008-12-17 | SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vec… | |
CVE-2008-4237 | | 2008-12-17 | Managed Client in Apple Mac OS X before 10.5.6 sometimes misidentifies a system when installing per-host configuration settings, which allows context-dependent… | |
CVE-2008-4236 | | 2008-12-17 | Apple Type Services (ATS) in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted embedded font… | |
CVE-2008-4234 | | 2008-12-17 | Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote attackers to execute… | |
CVE-2008-4224 | | 2008-12-17 | UDF in Apple Mac OS X before 10.5.6 allows user-assisted attackers to cause a denial of service (system crash) via a malformed UDF volume in a crafted ISO file. | |
CVE-2008-4223 | | 2008-12-17 | Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via unspecified vectors. | |
CVE-2008-4222 | | 2008-12-17 | natd in network_cmds in Apple Mac OS X before 10.5.6, when Internet Sharing is enabled, allows remote attackers to cause a denial of service (infinite loop) vi… | |
CVE-2008-4221 | | 2008-12-17 | The strptime API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to cause a denial of service (memory corruption and applicatio… | |
CVE-2008-4220 | | 2008-12-17 | Integer overflow in the inet_net_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to execute arbitrary code or cause a… | |
CVE-2008-4219 | | 2008-12-17 | The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an application that is dy… | |
CVE-2008-4218 | | 2008-12-17 | Multiple integer overflows in the kernel in Apple Mac OS X before 10.5.6 on Intel platforms allow local users to gain privileges via a crafted call to (1) i386… | |
CVE-2008-4217 | | 2008-12-17 | Integer signedness error in BOM in Apple Mac OS X before 10.5.6 allows remote attackers to execute arbitrary code via the headers in a crafted CPIO archive, le… | |
CVE-2008-5608 | | 2008-12-16 | ASP AutoDealer stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file vi… | |
CVE-2008-5607 | | 2008-12-16 | SQL injection vulnerability in the JMovies (aka JM or com_jmovies) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the… | |
CVE-2008-5606 | | 2008-12-16 | Gazatem QMail Mailing List Manager 1.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl… | |
CVE-2008-5605 | | 2008-12-16 | Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp a… | |
CVE-2008-5604 | | 2008-12-16 | Directory traversal vulnerability in index.php in My Simple Forum 3.0 and 4.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execut… | |
CVE-2008-5603 | | 2008-12-16 | ASPTicker 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via… | |
CVE-2008-5602 | | 2008-12-16 | Natterchat 1.12 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file v… | |
CVE-2008-5601 | | 2008-12-16 | User Engine Lite ASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database f… | |
CVE-2008-5600 | | 2008-12-16 | Merlix Teamworx Server stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database… | |
CVE-2008-5599 | | 2008-12-16 | SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL commands via the password parameter (aka… | |
CVE-2008-5598 | | 2008-12-16 | Directory traversal vulnerability in index.php in PHPmyGallery 1.51 gold allows remote attackers to list arbitrary directories via a .. (dot dot) in the group… | |
CVE-2008-5597 | | 2008-12-16 | Cold BBS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a di… | |
CVE-2008-5596 | | 2008-12-16 | Ikon AdManager 2.1 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the… | |
CVE-2008-5595 | | 2008-12-16 | SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter. | |
CVE-2008-5594 | | 2008-12-16 | Multiple directory traversal vulnerabilities in index.php in Mini Blog 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot… | |
CVE-2008-5593 | | 2008-12-16 | Multiple directory traversal vulnerabilities in index.php in Mini CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. (dot d… | |
CVE-2008-5592 | | 2008-12-16 | Nightfall Personal Diary 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the da… | |
CVE-2008-5591 | | 2008-12-16 | Cross-site scripting (XSS) vulnerability in login.asp in Nightfall Personal Diary 1.0 allows remote attackers to inject arbitrary web script or HTML via the us… | |
CVE-2008-5590 | | 2008-12-16 | SQL injection vulnerability in customer.forumtopic.php in Kalptaru Infotech Product Sale Framework 0.1 beta allows remote attackers to execute arbitrary SQL co… | |
CVE-2008-5589 | | 2008-12-16 | SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the (1) txtusername parame… | |
CVE-2008-5588 | | 2008-12-16 | SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter. | |
CVE-2008-5587 | | 2008-12-16 | Directory traversal vulnerability in libraries/lib.inc.php in phpPgAdmin 4.2.1 and earlier, when register_globals is enabled, allows remote attackers to read a… | |
CVE-2008-5586 | | 2008-12-16 | SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is disabled, allows remote attackers to ex… | |
CVE-2008-5585 | | 2008-12-16 | Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_… | |
CVE-2008-5584 | | 2008-12-15 | Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a mess… | |
CVE-2008-5583 | | 2008-12-15 | Cross-site request forgery (CSRF) vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via… | |
CVE-2008-5582 | | 2008-12-15 | SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the em… | |
CVE-2008-5581 | | 2008-12-15 | PHP remote file inclusion vulnerability in mini-pub.php/front-end/img.php in mini-pub 0.3 allows remote attackers to execute arbitrary PHP code via a URL in th… | |
CVE-2008-5580 | | 2008-12-15 | mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileName argument. | |
CVE-2008-5579 | | 2008-12-15 | Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via a full pathname in… | |
CVE-2008-5578 | | 2008-12-15 | Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via (1) the… | |
CVE-2008-5577 | | 2008-12-15 | PHP remote file inclusion vulnerability in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to execute arbitrary PHP code via a URL in t… | |
CVE-2008-5576 | | 2008-12-15 | admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the… | |
CVE-2008-5575 | | 2008-12-15 | Session fixation vulnerability in Pro Clan Manager 0.4.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter. | |
CVE-2008-5574 | | 2008-12-15 | SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL commands via the u parameter. | |
CVE-2008-5573 | | 2008-12-15 | SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) Password and (2) usernam… | |
CVE-2008-5572 | | 2008-12-15 | Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download… | |
CVE-2008-5571 | | 2008-12-15 | SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute arbitrary SQL commands via the (1) una… | |
CVE-2008-5570 | | 2008-12-15 | Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic_quotes_gpc is disabled, allows remote attackers to include and execu… | |
CVE-2008-5569 | | 2008-12-15 | Multiple cross-site scripting (XSS) vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1)… | |
CVE-2008-5568 | | 2008-12-15 | Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a… | |
CVE-2008-5567 | | 2008-12-15 | Cross-site request forgery (CSRF) vulnerability in admin/ad_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change the admin password vi… | |
CVE-2008-5566 | | 2008-12-15 | Cross-site scripting (XSS) vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject arbitrary web script… | |
CVE-2008-5565 | | 2008-12-15 | Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the admin password via a… | |
CVE-2008-5564 | | 2008-12-15 | Unspecified vulnerability in the media server in Orb Networks Orb before 2.01.0025 allows remote attackers to cause a denial of service (daemon crash) via a ma… | |
CVE-2008-5563 | | 2008-12-15 | Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.x, 3.1.x, 3.2.x, 3.3.1.x, and 3.3.2.x allows remote attackers to cause a denial of service (device crash) via a mal… | |
CVE-2008-5562 | | 2008-12-15 | ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a d… | |
CVE-2008-5561 | | 2008-12-15 | SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) fiche_product.php and (2) prese… | |
CVE-2008-5560 | | 2008-12-15 | PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a… | |
CVE-2008-5559 | | 2008-12-15 | SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via the cid parameter. | |
CVE-2008-5430 | | 2008-12-13 | Mozilla Thunderbird 2.0.14 does not properly handle (1) multipart/mixed e-mail messages with many MIME parts and possibly (2) e-mail messages with many "Conten… | |
CVE-2008-5556 | | 2008-12-12 | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not recognize attack patterns designed to operate against web pages that are encoded with utf-7… | |
CVE-2008-5555 | | 2008-12-12 | Microsoft Internet Explorer 8.0 Beta 2 relies on the XDomainRequestAllowed HTTP header to authorize data exchange between domains, which allows remote attacker… | |
CVE-2008-5554 | | 2008-12-12 | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 does not properly handle some HTTP headers that appear after a CRLF sequence in a URI, which allows re… | |
CVE-2008-5553 | | 2008-12-12 | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 disables itself upon encountering a certain X-XSS-Protection HTTP header, which allows remote attacker… | |
CVE-2008-5552 | | 2008-12-12 | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks via a CRLF sequ… | |
CVE-2008-5551 | | 2008-12-12 | The XSS Filter in Microsoft Internet Explorer 8.0 Beta 2 allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting da… |