# CVEs published 2008-10-21

47 CVEs were published on October 21, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4662](https://cve.now/CVE-2008-4662.md): Directory traversal vulnerability in admin.php in LokiCMS 0.3.4, when magic\_quotes\_gpc is disabled, allows remote attackers to include and… (no CVSS)
- [CVE-2008-4663](https://cve.now/CVE-2008-4663.md): Cross-site scripting (XSS) vulnerability in analysis.cgi 1.44, as used in K's CGI Access Log Kaiseki (1) jcode.pl and (2) Jcode.pm, allows… (no CVSS)
- [CVE-2008-4643](https://cve.now/CVE-2008-4643.md): SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands via the sortby… (no CVSS)
- [CVE-2008-4644](https://cve.now/CVE-2008-4644.md): hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header. (no CVSS)
- [CVE-2008-4645](https://cve.now/CVE-2008-4645.md): plugins/event\_tracer/event\_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administrators to execute arbitrary PHP… (no CVSS)
- [CVE-2008-4646](https://cve.now/CVE-2008-4646.md): The Websense Reporter Module in Websense Enterprise 6.3.2 stores the SQL database system administrator password in plaintext in… (no CVSS)
- [CVE-2008-4647](https://cve.now/CVE-2008-4647.md): SQL injection vulnerability in index.php in sweetCMS 1.5.2 allows remote attackers to execute arbitrary SQL commands via the page parameter. (no CVSS)
- [CVE-2008-4648](https://cve.now/CVE-2008-4648.md): Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2008-4649](https://cve.now/CVE-2008-4649.md): Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID… (no CVSS)
- [CVE-2008-4650](https://cve.now/CVE-2008-4650.md): SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate… (no CVSS)
- [CVE-2008-4651](https://cve.now/CVE-2008-4651.md): Multiple SQL injection vulnerabilities in Jetbox CMS 2.1 allow remote authenticated users to execute arbitrary SQL commands via the (1)… (no CVSS)
- [CVE-2008-4652](https://cve.now/CVE-2008-4652.md): Buffer overflow in the ActiveX control (DartFtp.dll) in Dart Communications PowerTCP FTP for ActiveX 2.0.2 0 allows remote attackers to… (no CVSS)
- [CVE-2008-4653](https://cve.now/CVE-2008-4653.md): SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to… (no CVSS)
- [CVE-2008-4654](https://cve.now/CVE-2008-4654.md): Stack-based buffer overflow in the parse\_master function in the Ty demux plugin (modules/demux/ty.c) in VLC Media Player 0.9.0 through… (no CVSS)
- [CVE-2008-4655](https://cve.now/CVE-2008-4655.md): SQL injection vulnerability in the Simple survey (simplesurvey) 1.7.0 and earlier extension for TYPO3 allows remote attackers to execute… (no CVSS)
- [CVE-2008-4656](https://cve.now/CVE-2008-4656.md): SQL injection vulnerability in the Frontend Users View (feusersview) 0.1.6 and earlier extension for TYPO3 allows remote attackers to… (no CVSS)
- [CVE-2008-4657](https://cve.now/CVE-2008-4657.md): SQL injection vulnerability in the Econda Plugin (econda) 0.0.2 and earlier extension for TYPO3 allows remote attackers to execute… (no CVSS)
- [CVE-2008-4658](https://cve.now/CVE-2008-4658.md): SQL injection vulnerability in the JobControl (dmmjobcontrol) 1.15.4 and earlier extension for TYPO3 allows remote attackers to execute… (no CVSS)
- [CVE-2008-4659](https://cve.now/CVE-2008-4659.md): SQL injection vulnerability in the Mannschaftsliste (kiddog\_playerlist) 1.0.3 and earlier extension for TYPO3 allows remote attackers to… (no CVSS)
- [CVE-2008-4660](https://cve.now/CVE-2008-4660.md): SQL injection vulnerability in the M1 Intern (m1\_intern) 1.0.0 extension for TYPO3 allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2008-4661](https://cve.now/CVE-2008-4661.md): Cross-site scripting (XSS) vulnerability in the Page Improvements (sm\_pageimprovements) 1.1.0 and earlier extension for TYPO3 allows… (no CVSS)
- [CVE-2008-4642](https://cve.now/CVE-2008-4642.md): SQL injection vulnerability in profile.php in AstroSPACES 1.1.1 allows remote attackers to execute arbitrary SQL commands via the id… (no CVSS)
- [CVE-2007-4350](https://cve.now/CVE-2007-4350.md): Cross-site scripting (XSS) vulnerability in the management interface in HP SiteScope 9.0 build 911 allows remote attackers to inject… (no CVSS)
- [CVE-2008-3248](https://cve.now/CVE-2008-3248.md): qiomkfile in the Quick I/O for Database feature in Symantec Veritas File System (VxFS) on HP-UX, and before 5.0 MP3 on Solaris, Linux, and… (no CVSS)
- [CVE-2008-4121](https://cve.now/CVE-2008-4121.md): Multiple cross-site scripting (XSS) vulnerabilities in cpCommerce before 1.2.4 allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2008-4637](https://cve.now/CVE-2008-4637.md): Cross-site scripting (XSS) vulnerability in cpCommerce before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2008-4638](https://cve.now/CVE-2008-4638.md): qioadmin in the Quick I/O for Database feature in Symantec Veritas File System (VxFS) on HP-UX, and before 5.0 MP3 on Solaris, Linux, and… (no CVSS)
- [CVE-2008-4639](https://cve.now/CVE-2008-4639.md): jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file. (no CVSS)
- [CVE-2008-4640](https://cve.now/CVE-2008-4640.md): The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors… (no CVSS)
- [CVE-2008-4641](https://cve.now/CVE-2008-4641.md): The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell… (no CVSS)
- [CVE-2008-1547](https://cve.now/CVE-2008-1547.md): Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build… (no CVSS)
- [CVE-2008-4620](https://cve.now/CVE-2008-4620.md): SQL injection vulnerability in Meeting Room Booking System (MRBS) before 1.4 allows remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2008-4621](https://cve.now/CVE-2008-4621.md): SQL injection vulnerability in bannerclick.php in ZeeScripts Zeeproperty allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-4622](https://cve.now/CVE-2008-4622.md): The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative… (no CVSS)
- [CVE-2008-4623](https://cve.now/CVE-2008-4623.md): SQL injection vulnerability in the DS-Syndicate (com\_ds-syndicate) component 1.1.1 for Joomla allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2008-4624](https://cve.now/CVE-2008-4624.md): PHP remote file inclusion vulnerability in init.php in Fast Click SQL Lite 1.1.7, when register\_globals is enabled, allows remote… (no CVSS)
- [CVE-2008-4625](https://cve.now/CVE-2008-4625.md): SQL injection vulnerability in stnl\_iframe.php in the ShiftThis Newsletter (st\_newsletter) plugin for WordPress allows remote attackers to… (no CVSS)
- [CVE-2008-4626](https://cve.now/CVE-2008-4626.md): Directory traversal vulnerability in index.php in Fritz Berger yet another php photo album - next generation (yappa-ng) 2.3.2 and possibly… (no CVSS)
- [CVE-2008-4627](https://cve.now/CVE-2008-4627.md): SQL injection vulnerability in the rGallery plugin 1.09 for WoltLab Burning Board (WBB) allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2008-4628](https://cve.now/CVE-2008-4628.md): SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-4629](https://cve.now/CVE-2008-4629.md): Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0 and earlier allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2008-4630](https://cve.now/CVE-2008-4630.md): Multiple unspecified vulnerabilities in Midgard Components (MidCOM) Framework before 8.09.1 have unknown impact and attack vectors. (no CVSS)
- [CVE-2008-4631](https://cve.now/CVE-2008-4631.md): Stack-based buffer overflow in the Message::AddToString function in message/Message.cpp in MUSCLE before 4.40 allows remote attackers to… (no CVSS)
- [CVE-2008-4632](https://cve.now/CVE-2008-4632.md): Multiple directory traversal vulnerabilities in index.php in Kure 0.6.3, when magic\_quotes\_gpc is disabled, allow remote attackers to read… (no CVSS)
- [CVE-2008-4633](https://cve.now/CVE-2008-4633.md): SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again"… (no CVSS)
- [CVE-2008-4634](https://cve.now/CVE-2008-4634.md): Cross-site scripting (XSS) vulnerability in Movable Type 4 through 4.21 allows remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2008-4635](https://cve.now/CVE-2008-4635.md): Unspecified vulnerability in Hisanaga Electric Co, Ltd. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2008-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.