# CVEs published 2008-09-30

41 CVEs were published on September 30, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4361](https://cve.now/CVE-2008-4361.md): Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary files via a .. (no CVSS)
- [CVE-2008-4362](https://cve.now/CVE-2008-4362.md): The Virtual Token driver (vdlptokn.sys) 1.0.2.43 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) via a… (no CVSS)
- [CVE-2008-4363](https://cve.now/CVE-2008-4363.md): DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary… (no CVSS)
- [CVE-2008-4364](https://cve.now/CVE-2008-4364.md): SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-4365](https://cve.now/CVE-2008-4365.md): Cross-site scripting (XSS) vulnerability in search.php in Siteman 1.1.11 and earlier allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2008-4366](https://cve.now/CVE-2008-4366.md): Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute… (no CVSS)
- [CVE-2008-4345](https://cve.now/CVE-2008-4345.md): SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2008-4346](https://cve.now/CVE-2008-4346.md): Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary local files via a… (no CVSS)
- [CVE-2008-4347](https://cve.now/CVE-2008-4347.md): SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid… (no CVSS)
- [CVE-2008-4348](https://cve.now/CVE-2008-4348.md): SQL injection vulnerability in photo.php in PHPortfolio, possibly 1.3, allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-4349](https://cve.now/CVE-2008-4349.md): Multiple cross-site scripting (XSS) vulnerabilities in news.php in s0nic Paranews 3.4 allow remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2008-4350](https://cve.now/CVE-2008-4350.md): SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2008-4351](https://cve.now/CVE-2008-4351.md): Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitrary files via a .. (no CVSS)
- [CVE-2008-4352](https://cve.now/CVE-2008-4352.md): SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2008-4353](https://cve.now/CVE-2008-4353.md): SQL injection vulnerability in link.php in Linkarity allows remote attackers to execute arbitrary SQL commands via the cat\_id parameter. (no CVSS)
- [CVE-2008-4354](https://cve.now/CVE-2008-4354.md): SQL injection vulnerability in the products module in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2008-4355](https://cve.now/CVE-2008-4355.md): SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to… (no CVSS)
- [CVE-2008-4356](https://cve.now/CVE-2008-4356.md): Multiple SQL injection vulnerabilities in Kasseler CMS 1.1.0 and 1.2.0 allow remote attackers to execute arbitrary SQL commands via (1)… (no CVSS)
- [CVE-2008-4357](https://cve.now/CVE-2008-4357.md): SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands via the id… (no CVSS)
- [CVE-2008-4358](https://cve.now/CVE-2008-4358.md): Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors… (no CVSS)
- [CVE-2008-4094](https://cve.now/CVE-2008-4094.md): Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1)… (no CVSS, activerecord)
- [CVE-2008-4328](https://cve.now/CVE-2008-4328.md): SQL injection vulnerability in site\_search.php in EasyRealtorPRO 2008 allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-4329](https://cve.now/CVE-2008-4329.md): PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to… (no CVSS)
- [CVE-2008-4330](https://cve.now/CVE-2008-4330.md): Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrary local files via… (no CVSS)
- [CVE-2008-4331](https://cve.now/CVE-2008-4331.md): Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attackers to include and… (no CVSS)
- [CVE-2008-4332](https://cve.now/CVE-2008-4332.md): SQL injection vulnerability in the showjavatopic function in func.php in PHP infoBoard V.7 Plus allows remote attackers to execute… (no CVSS)
- [CVE-2008-4333](https://cve.now/CVE-2008-4333.md): Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2008-4334](https://cve.now/CVE-2008-4334.md): PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1. (no CVSS)
- [CVE-2008-4335](https://cve.now/CVE-2008-4335.md): SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2008-4336](https://cve.now/CVE-2008-4336.md): Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2008-4337](https://cve.now/CVE-2008-4337.md): Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL… (no CVSS)
- [CVE-2008-4338](https://cve.now/CVE-2008-4338.md): SQL injection vulnerability in the brilliant\_gallery\_checklist\_save function in the bgchecklist/save script in Brilliant Gallery 5.x and… (no CVSS)
- [CVE-2008-4339](https://cve.now/CVE-2008-4339.md): Unspecified vulnerability in the Java Administration GUI (jnbSA) in Symantec Veritas NetBackup Server and NetBackup Enterprise Server 5.1… (no CVSS)
- [CVE-2008-4340](https://cve.now/CVE-2008-4340.md): Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document… (no CVSS)
- [CVE-2008-4341](https://cve.now/CVE-2008-4341.md): add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie… (no CVSS)
- [CVE-2008-4342](https://cve.now/CVE-2008-4342.md): NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP… (no CVSS)
- [CVE-2008-4343](https://cve.now/CVE-2008-4343.md): The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite… (no CVSS)
- [CVE-2008-4344](https://cve.now/CVE-2008-4344.md): SQL injection vulnerability in cat.php in 6rbScript allows remote attackers to execute arbitrary SQL commands via the CatID parameter. (no CVSS)
- [CVE-2008-4325](https://cve.now/CVE-2008-4325.md): lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which… (no CVSS)
- [CVE-2008-4326](https://cve.now/CVE-2008-4326.md): The PMA\_escapeJsString function in libraries/js\_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows… (no CVSS)
- [CVE-2008-4327](https://cve.now/CVE-2008-4327.md): gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2008-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.