Archive
September 2008
Vulnerabilities first published in this month (UTC), newest first.
450 results · Feed
-
Unscored —CVE-2008-3945 Public exploit
SQL injection vulnerability in index.php in Words tag 1.2 allows remote attackers to execute arbitrary SQL commands via…
-
Unscored —CVE-2008-3942 Public exploit
SQL injection vulnerability in landsee.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL co…
-
Medium 6.1CVE-2008-3937 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Open Media Collectors Database (OpenDb) 1.0.6 allow remote attac…
-
Medium 6.1
Cross-site scripting (XSS) vulnerability in DIC shop_v50 3.0 and earlier and shop_v52 2.0 and earlier allows remote att…
-
High 8.8
Cross-site request forgery (CSRF) vulnerability in user_admin.php in Open Media Collectors Database (OpenDb) 1.0.6 allo…
-
Unscored —
Format string vulnerability in the finger client in HP TCP/IP Services for OpenVMS 5.x allows local users to gain privi…
-
Unscored —CVE-2008-3944 Public exploit
SQL injection vulnerability in index.php in ACG-PTP 1.0.6 allows remote attackers to execute arbitrary SQL commands via…
-
High 7.5
Directory traversal vulnerability in the web interface in AVTECH PageR Enterprise before 5.0.7 allows remote attackers …
-
Unscored —CVE-2008-3943 Public exploit
SQL injection vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to execute arbitra…
-
Unscored —
Unspecified vulnerability in Wireshark (formerly Ethereal) 0.99.6 through 1.0.2 allows attackers to cause a denial of s…
-
Unscored —
Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition …
-
Unscored —
Wireshark (formerly Ethereal) 0.10.14 through 1.0.2 allows attackers to cause a denial of service (crash) via a packet …
-
Unscored —
Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a denial of service (hang) via a crafted NC…
-
Unscored —
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequence…
-
Unscored —
test.sh in Honeyd 1.5c might allow local users to overwrite arbitrary files via a symlink attack on a temporary file.
-
Unscored —
Unspecified vulnerability in multiple JustSystems Ichitaro products allows remote attackers to execute arbitrary code v…
-
Unscored —
migrate_aliases.sh in Citadel Server 7.37 allows local users to overwrite arbitrary files via a symlink attack on a tem…
-
Unscored —CVE-2008-3926 Public exploit
Multiple directory traversal vulnerabilities in Content Management Made Easy (CMME) 1.12 allow remote attackers to (1) …
-
Unscored —
gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/fi…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject…
-
Unscored —
javareconf in R 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
-
Unscored —
Heap-based buffer overflow in the strip_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or u…
-
Unscored —CVE-2008-3924 Public exploit
The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the we…
-
Unscored —CVE-2008-3925 Public exploit
Cross-site request forgery (CSRF) vulnerability in admin.php in Content Management Made Easy (CMME) 1.12 allows remote …
-
Unscored —CVE-2008-3917 Public exploit
Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to inject arbitrary we…
-
Unscored —
Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts …
-
Unscored —CVE-2008-3923 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in statistics.php in Content Management Made Easy (CMME) 1.12 allow…
-
Unscored —
genmsgidx in Tiger 3.2.2 allows local users to overwrite or delete arbitrary files via a symlink attack on temporary fi…
-
Unscored —CVE-2008-3918 Public exploit
SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands v…
-
Unscored —
dns2tcp before 0.4.1 does not properly handle negative values in a certain length field in the input argument to the (1…
-
Unscored —CVE-2008-3906 Public exploit
CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP header…
-
Unscored —
The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell me…
-
Unscored —
The proc_do_xprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain bu…
-
Unscored —
Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via…
-
Unscored —
src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to ex…
-
Unscored —
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses s…
-
High 7.5
Django cross-site request forgery (CSRF) vulnerability
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or…
-
Unscored —
fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which …
-
Unscored —
libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (app…
-
Unscored —
Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2…