CVE Daily
← All years

All CVEs — 2008

Page 4/35.

Browse all CVEs by publication year. Use filters to refine.

CVSS ≥ 0.0
2008-11-29
Critical

CVE-2008-5282

Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attr…

CVSS: 10.0 CWE: CWE-119
Read more
Critical

CVE-2008-5281

Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.

CVSS: 10.0 CWE: CWE-119
Read more
Critical

CVE-2008-5279

The Local ZIM Server (zcs.exe) in Zilab Chat and Instant Messaging (ZIM) Server 2.1 and earlier allow remote attackers to execute arbitrary code via (1) heap-based buffer overflows involving multiple…

CVSS: 10.0 CWE: CWE-119
Read more
2008-11-28
Medium

CVE-2008-5278

Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web scrip…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5275

Multiple directory traversal vulnerabilities in the (a) "Unzip archive" and (b) "Upload files and archives" functionality in net2ftp 0.96 stable and 0.97 beta allow remote attackers to create, read,…

CVSS: 7.5 CWE: CWE-22
Read more
High

CVE-2008-5273

SQL injection vulnerability in viewnews.asp in Todd Woolums ASP News Management 2.2 allows remote attackers to execute arbitrary SQL commands via the newsID parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5272

Multiple directory traversal vulnerabilities in Fred Stuurman SyndeoCMS 2.6.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the template parameter to (1) starnet/edit…

CVSS: 4.0 CWE: CWE-22
Read more
Medium

CVE-2008-5271

Cross-site scripting (XSS) vulnerability in index.php in Fred Stuurman SyndeoCMS 2.6.0 allows remote attackers to inject arbitrary web script or HTML via the section parameter.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5270

SQL injection vulnerability in view.topics.php in Yuhhu Superstar 2008 allows remote attackers to execute arbitrary SQL commands via the board parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5269

SQL injection vulnerability in index.php in pSys 0.7.0 alpha allows remote attackers to execute arbitrary SQL commands via the shownews parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5268

SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL commands via the Topic_Id parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5267

SQL injection vulnerability in answer.php in Experts 1.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the question_id parameter.

CVSS: 6.8 CWE: CWE-89
Read more
Medium

CVE-2008-5266

Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 bui…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5265

Directory traversal vulnerability in index.php in TNT Forum 0.9.4, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequ…

CVSS: 6.8 CWE: CWE-22
Read more
Medium

CVE-2008-5264

Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a…

CVSS: 4.3 CWE: CWE-79
Read more
2008-11-27
Medium

CVE-2008-5257

webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager for e-business allows remote attackers to cause a denial of service (crash or hang) via HTTP requests, as demonstrated by a McAfee vulnerabil…

CVSS: 4.3 CWE: CWE-20
Read more
Medium

CVE-2008-5256

The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innotek VirtualBox before 2.0.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.vbox-$USER-ipc/lock temporary fil…

CVSS: 4.4 CWE: CWE-59
Read more
High

CVE-2008-4636

yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.

CVSS: 7.2 CWE: CWE-78
Read more
2008-11-26
High

CVE-2008-5162

The arc4random function in the kernel in FreeBSD 6.3 through 7.1 does not have a proper entropy source for a short time period immediately after boot, which makes it easier for attackers to predict t…

CVSS: 7.0 CWE: CWE-330
Read more
Medium

CVE-2008-5248

xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via "MP3 files with metadata consisting only of separators."

CVSS: 4.3 CWE: CWE-20
Read more
Critical

CVE-2008-5246

Multiple heap-based buffer overflows in xine-lib before 1.1.15 allow remote attackers to execute arbitrary code via vectors that send ID3 data to the (1) id3v22_interp_frame and (2) id3v24_interp_fra…

CVSS: 9.3 CWE: CWE-119
Read more
Critical

CVE-2008-5245

xine-lib before 1.1.15 performs V4L video frame preallocation before ascertaining the required length, which has unknown impact and attack vectors, possibly related to a buffer overflow in the open_v…

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2008-5243

The real_parse_headers function in demux_real.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input length value to "reindex into an allocated buffer," which allow…

CVSS: 4.3 CWE: CWE-20
Read more
Medium

CVE-2008-5242

demux_qt.c in xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not validate the count field before calling calloc for STSD_ATOM atom allocation, which allows remote attackers to cause a d…

CVSS: 6.8 CWE: CWE-119
Read more
Medium

CVE-2008-5240

xine-lib 1.1.12, and other 1.1.15 and earlier versions, relies on an untrusted input value to determine the memory allocation and does not check the result for (1) the MATROSKA_ID_TR_CODECPRIVATE tra…

CVSS: 4.3 CWE: CWE-119
Read more
Medium

CVE-2008-5239

xine-lib 1.1.12, and other 1.1.15 and earlier versions, does not properly handle (a) negative and (b) zero values during unspecified read function calls in input_file.c, input_net.c, input_smb.c, and…

CVSS: 4.3 CWE: CWE-119
Read more
Critical

CVE-2008-5236

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other 1.1.15 and earlier versions, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted EBML element leng…

CVSS: 9.3 CWE: CWE-119
Read more
Critical

CVE-2008-5235

Heap-based buffer overflow in the demux_real_send_chunk function in src/demuxers/demux_real.c in xine-lib before 1.1.15 allows remote attackers to execute arbitrary code via a crafted Real Media file…

CVSS: 9.3 CWE: CWE-119
Read more
Critical

CVE-2008-5234

Multiple heap-based buffer overflows in xine-lib 1.1.12, and other versions before 1.1.15, allow remote attackers to execute arbitrary code via vectors related to (1) a crafted metadata atom size pro…

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2008-5233

xine-lib 1.1.12, and other versions before 1.1.15, does not check for failure of malloc in circumstances including (1) the mymng_process_header function in demux_mng.c, (2) the open_mod_file function…

CVSS: 4.3 CWE: CWE-119
Read more
Critical

CVE-2008-5232

Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000, and Avaya Media…

CVSS: 9.3 CWE: CWE-787
Read more
Critical

CVE-2008-5231

Stack-based buffer overflow in the ExecuteRequest method in the Novell iPrint ActiveX control in ienipp.ocx in Novell iPrint Client 5.06 and earlier allows remote attackers to execute arbitrary code…

CVSS: 9.3 CWE: CWE-119
Read more
Medium

CVE-2008-2432

Insecure method vulnerability in the GetFileList method in an unspecified ActiveX control in Novell iPrint Client before 5.06 allows remote attackers to list the image files in an arbitrary directory…

CVSS: 5.0 CWE: CWE-200
Read more
Critical

CVE-2008-2431

Multiple buffer overflows in Novell iPrint Client before 5.06 allow remote attackers to execute arbitrary code by calling the Novell iPrint ActiveX control (aka ienipp.ocx) with (1) a long third argu…

CVSS: 9.3 CWE: CWE-119
Read more
High

CVE-2008-2429

Multiple SQL injection vulnerabilities in Calendarix Basic 0.8.20071118 allow remote attackers to execute arbitrary SQL commands via (1) the catsearch parameter to cal_search.php or (2) the catview p…

CVSS: 7.5 CWE: CWE-89
Read more
2008-11-25
Medium

CVE-2008-5229

Stack-based buffer overflow in Microsoft Device IO Control in iphlpapi.dll in Microsoft Windows Vista Gold and SP1 allows local users in the Network Configuration Operator group to gain privileges or…

CVSS: 6.9 CWE: CWE-119
Read more
Low

CVE-2008-5228

Cross-site scripting (XSS) vulnerability in IBM Workplace Content Management (WCM) 6.0G and 6.1 before CF8, when a Page Navigation Component shows menu entries, allows remote attackers to inject arbi…

CVSS: 2.6 CWE: CWE-79
Read more
Critical

CVE-2008-5227

Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a "file inclusion vulnerability," as exploited in the wild in November 2008.

CVSS: 10.0 CWE: CWE-94
Read more
Critical

CVE-2008-4829

Multiple buffer overflows in lib/http.c in Streamripper 1.63.5 allow remote attackers to execute arbitrary code via (1) a long "Zwitterion v" HTTP header, related to the http_parse_sc_header function…

CVSS: 9.3 CWE: CWE-119
Read more
Low

CVE-2008-4230

The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 displays SMS messages when the emergency-call screen is visible, which allows physically prox…

CVSS: 1.9 CWE: CWE-200
Read more
Low

CVE-2008-4229

Race condition in the Passcode Lock feature in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.0 through 2.1 allows physically proximate attackers to remove the lock and launch arbitra…

CVSS: 3.7 CWE: CWE-362
Read more
High

CVE-2008-5226

SQL injection vulnerability in the MambAds (com_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute arbitrary SQL commands via the ma_cat parameter in a view acti…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5225

Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) Searc…

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5224

Cross-site scripting (XSS) vulnerability in Kent Web Mart 1.61 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5223

SQL injection vulnerability in index.php in Airvae Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5222

SQL injection vulnerability in login.asp in Dvbbs 8.2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5221

The account_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge of the original password, which allows remote attackers to c…

CVSS: 7.5 CWE: CWE-287
Read more
Critical

CVE-2008-5220

Unrestricted file upload vulnerability in admin/upload_form.php in wPortfolio 0.3 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then…

CVSS: 10.0 CWE: CWE-20
Read more
High

CVE-2008-5219

The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows r…

CVSS: 7.5 CWE: CWE-287
Read more
2008-11-24
Medium

CVE-2008-5217

Directory traversal vulnerability in index.php in txtCMS 0.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files v…

CVSS: 5.1 CWE: CWE-22
Read more
High

CVE-2008-5216

SQL injection vulnerability in category_list.php in AJ Square ZeusCart 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5215

SQL injection vulnerability in service/profil.php in ClanLite 2.2006.05.20 allows remote attackers to execute arbitrary SQL commands via the link parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5214

Cross-site scripting (XSS) vulnerability in service/calendrier.php in ClanLite 2.2006.05.20 allows remote attackers to inject arbitrary web script or HTML via the annee parameter.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5213

SQL injection vulnerability in featured_article.php in AJ Article 1.0 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a search detail action.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5212

SQL injection vulnerability in classifide_ad.php in AJ Auction 6.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the item_id parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Low

CVE-2008-5211

Cross-site scripting (XSS) vulnerability in search.php in Sphider 1.3.4, when the search suggestion feature is enabled, allows remote attackers to inject arbitrary web script or HTML via the query pa…

CVSS: 2.6 CWE: CWE-79
Read more
Critical

CVE-2008-5210

Multiple PHP remote file inclusion vulnerabilities in PhpBlock A8.5 allow remote attackers to execute arbitrary PHP code via a URL in the PATH_TO_CODE parameter to (1) script/init/createallimagecache…

CVSS: 9.3 CWE: CWE-94
Read more
Medium

CVE-2008-5209

Directory traversal vulnerability in modules/download/get_file.php in Admidio 1.4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

CVSS: 5.0 CWE: CWE-22
Read more
High

CVE-2008-5208

SQL injection vulnerability in sub_votepic.php in the Datsogallery (com_datsogallery) module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.

CVSS: 7.5 CWE: CWE-89
Read more
2008-11-21
Medium

CVE-2008-5207

Multiple directory traversal vulnerabilities in Jonascms 1.2 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the taal parameter to (1) backup.php and (2) gb_…

CVSS: 6.8 CWE: CWE-22
Read more
High

CVE-2008-5206

PHP remote file inclusion vulnerability in modules/mod_mainmenu.php in MosXML 1 Alpha allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE:…

CVSS: 7.5 CWE: CWE-94
Read more
Medium

CVE-2008-5205

Cross-site scripting (XSS) vulnerability in edit.php in wellyblog allows remote attackers to inject arbitrary web script or HTML via the articleid parameter in an add action.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5204

Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal seq…

CVSS: 6.8 CWE: CWE-22
Read more
Medium

CVE-2008-5203

Cross-site scripting (XSS) vulnerability in external_vote.php in PowerAward 1.1.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the l_vote_done parameter.

CVSS: 4.3 CWE: CWE-79
Read more
Medium

CVE-2008-5202

Cross-site scripting (XSS) vulnerability in index.php in OTManager CMS 24a allows remote attackers to inject arbitrary web script or HTML via the conteudo parameter.

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5201

Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the conteudo parameter. NOTE: in some e…

CVSS: 7.5 CWE: CWE-22
Read more
High

CVE-2008-5200

SQL injection vulnerability in the Xe webtv (com_xewebtv) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5199

PHP remote file inclusion vulnerability in include.php in PHPOutsourcing IdeaBox (aka IdeBox) 1.1 allows remote attackers to execute arbitrary PHP code via a URL in the gorumDir parameter.

CVSS: 7.5 CWE: CWE-94
Read more
High

CVE-2008-5198

SQL injection vulnerability in memberlist.php in Acmlmboard 1.A2 allows remote attackers to execute arbitrary SQL commands via the pow parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5197

SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter in a detail_adverts action.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5196

SQL injection vulnerability in kroax.php in the Kroax (the_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the category parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5195

Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands via (1) the recid parameter to cms/form/read.php, (2) the uname parameter to c…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5194

SQL injection vulnerability in checkavail.php in SoftVisions Software Online Booking Manager (obm) 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5193

Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to inject arbitrary web script or HTML via the searchterms parameter. NOTE: this might…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5192

SQL injection vulnerability in forum.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to execute arbitrary SQL commands via the forumid parameter. NOTE: this might overlap CVE-2008-2334,…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5191

Multiple SQL injection vulnerabilities in SePortal 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) poll_id parameter to poll.php and the (2) sp_id parameter to staticpages.ph…

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5190

SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the SUB parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5189

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to fu…

CVSS: 5.0 CWE: CWE-352
Read more
High

CVE-2008-5187

The load function in the XPM loader for imlib2 1.4.2, and possibly other versions, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XPM file tha…

CVSS: 7.5 CWE: CWE-119
Read more
High

CVE-2008-5186

The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the d…

CVSS: 7.5 CWE: CWE-20
Read more
High

CVE-2008-5183

cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a large number of RSS Subscriptions, which triggers a NULL poi…

CVSS: 7.5 CWE: CWE-476
Read more
Medium

CVE-2008-5182

The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.

CVSS: 6.9 CWE: CWE-362
Read more
2008-11-20
Medium

CVE-2008-5180

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trig…

CVSS: 5.3 CWE: CWE-770
Read more
Critical

CVE-2008-5178

Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute arbitrary code via a long file:// URI. NOTE: this might overlap CVE-2008-5680.

CVSS: 9.3 CWE: CWE-119
Read more
Critical

CVE-2008-5177

Stack-based buffer overflow in the DtbClsLogin function in Yosemite Backup 8.7 allows remote attackers to (1) execute arbitrary code on a Linux platform, related to libytlindtb.so; or (2) cause a den…

CVSS: 10.0 CWE: CWE-119
Read more
Critical

CVE-2008-5176

Multiple buffer overflows in Client Software WinCom LPD Total 3.0.2.623 and earlier allow remote attackers to execute arbitrary code via (1) a long 0x02 command to the remote administration service o…

CVSS: 9.3 CWE: CWE-119
Read more
2008-11-19
Critical

CVE-2008-5175

Directory traversal vulnerability in the FTP client in AceFTP Freeware 3.80.3 and AceFTP Pro 3.80.3 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response t…

CVSS: 9.3 CWE: CWE-22
Read more
High

CVE-2008-5174

SQL injection vulnerability in joke.php in Jokes Complete Website 2.1.3 allows remote attackers to execute arbitrary SQL commands via the jokeid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Critical

CVE-2008-5173

Unspecified vulnerability in testMaker before 3.0p16 allows remote authenticated users to execute arbitrary PHP code via unspecified attack vectors.

CVSS: 9.0 CWE: CWE-94
Read more
Medium

CVE-2008-5172

Multiple cross-site scripting (XSS) vulnerabilities in Yazd Forum Software 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to (a) search.jsp, and the (2) msg…

CVSS: 4.3 CWE: CWE-79
Read more
Critical

CVE-2008-5171

Multiple directory traversal vulnerabilities in admin/minibb/index.php in phpBLASTER CMS 1.0 RC1, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files…

CVSS: 9.3 CWE: CWE-22
Read more
High

CVE-2008-5170

SQL injection vulnerability in item.php in Cheats Complete Website 1.1.1 allows remote attackers to execute arbitrary SQL commands via the itemid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5169

SQL injection vulnerability in drinks/drink.php in Drinks Complete Website 2.1.0 allows remote attackers to execute arbitrary SQL commands via the drinkid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5168

SQL injection vulnerability in tip.php in Tips Complete Website 1.2.0 allows remote attackers to execute arbitrary SQL commands via the tipid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
Critical

CVE-2008-5167

PHP remote file inclusion vulnerability in layout/default/params.php in Boonex Orca 2.0 and 2.0.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in…

CVSS: 9.3 CWE: CWE-94
Read more
High

CVE-2008-5166

SQL injection vulnerability in riddle.php in Riddles Website 1.2.1 allows remote attackers to execute arbitrary SQL commands via the riddleid parameter.

CVSS: 7.5 CWE: CWE-89
Read more
High

CVE-2008-5165

Multiple SQL injection vulnerabilities in eTicket 1.5.7 allow remote attackers to execute arbitrary SQL commands via the pri parameter to (1) index.php, (2) open.php, (3) open_raw.php, and (4) newtic…

CVSS: 7.5 CWE: CWE-89
Read more
Medium

CVE-2008-5164

Multiple cross-site scripting (XSS) vulnerabilities in The Rat CMS Pre-Alpha 2 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to (a) viewarticle.php and (b) vi…

CVSS: 4.3 CWE: CWE-79
Read more
High

CVE-2008-5163

Multiple SQL injection vulnerabilities in The Rat CMS Pre-Alpha 2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) viewarticle.php and (2) viewarticle2.php.

CVSS: 7.5 CWE: CWE-89
Read more
Low

CVE-2008-5161

Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.…

CVSS: 2.6 CWE: CWE-200
Read more
2008-11-18
High

CVE-2008-5158

Client Software WinCom LPD Total 3.0.2.623 and earlier allows remote attackers to bypass authentication and perform administrative actions via vectors involving "simply skipping the auth stage."

CVSS: 7.5 CWE: CWE-287
Read more
Medium

CVE-2008-5157

tau 2.16.4 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/makefile.tau.*.##### or (2) /tmp/makefile.tau*.##### temporary file, related to the (a) tau_cxx, (b) tau_…

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5156

si_mkbootserver in systemimager-server 3.6.3 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/*.inetd.conf or (2) /tmp/pxe.conf.*.tmp temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Critical

CVE-2008-5155

mail2sms.sh in smsclient 2.0.8z allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/header.##### or (2) /tmp/body.##### temporary file, or append data to arbitrary file…

CVSS: 9.3 CWE: CWE-59
Read more
Medium

CVE-2008-5154

bluetooth.rc in p3nfs 5.19 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/blue.log temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5153

spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-…

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5152

inmail-show in mh-book 200605 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/inmail#####.log or (2) /tmp/inmail#####.stdin temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5151

test_parser.py in mayavi 1.5 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/err.log temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5150

sample.sh in maildirsync 1.1 allows local users to append data to arbitrary files via a symlink attack on a /tmp/maildirsync-*.#####.log temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5149

fwd_check.sh in libncbi6 6.1.20080302 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5148

sch2eaglepos.sh in geda-gnetlist 1.4.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5147

test-pipe-to-pyodconverter.org.sh in docvert 2.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/outer.odt temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5146

add-accession-numbers in ctn 3.0.6 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/accession temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5145

ltpmenu in ltp 20060918 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/runltp.mainmenu.##### temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5144

nvidia-cg-toolkit-installer in nvidia-cg-toolkit 2.0.0015 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvidia-cg-toolkit-manifest temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5143

mgt-helper in multi-gnome-terminal 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/*.debug or (2) /tmp/*.env temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5142

sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5141

flamethrower in flamethrower 0.1.8 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/multicast.tar.##### temporary file.

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5140

trend-autoupdate.new in mailscanner 4.55.10 and other versions before 4.74.16-1 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/opr.ini.##### or (2) /tmp/lpt*.zip t…

CVSS: 6.9 CWE: CWE-59
Read more
Medium

CVE-2008-5139

updatejail in jailer 0.4 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/#####.updatejail temporary file.

CVSS: 6.9 CWE: CWE-59
Read more