# CVEs published 2008-11-04

38 CVEs were published on November 4, 2008: 0 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-4306](https://cve.now/CVE-2008-4306.md): Buffer overflow in enscript before 1.6.4 has unknown impact and attack vectors, possibly related to the font escape sequence. (no CVSS)
- [CVE-2008-4918](https://cve.now/CVE-2008-4918.md): Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190… (no CVSS)
- [CVE-2008-4919](https://cve.now/CVE-2008-4919.md): Insecure method vulnerability in VISAGESOFT eXPert PDF Viewer X ActiveX control (VSPDFViewerX.ocx) 3.0.990.0 allows remote attackers to… (no CVSS)
- [CVE-2008-4921](https://cve.now/CVE-2008-4921.md): board/admin/reguser.php in Chipmunk CMS 1.3 allows remote attackers to bypass authentication and gain administrator privileges via a… (no CVSS)
- [CVE-2008-4922](https://cve.now/CVE-2008-4922.md): Buffer overflow in the DjVu ActiveX Control 3.0 for Microsoft Office (DjVu\_ActiveX\_MSOffice.dll) allows remote attackers to execute… (no CVSS)
- [CVE-2008-4923](https://cve.now/CVE-2008-4923.md): Multiple insecure method vulnerabilities in MW6 Technologies Aztec ActiveX control (AZTECLib.MW6Aztec, Aztec.dll) 3.0.0.1 allow remote… (no CVSS)
- [CVE-2008-4924](https://cve.now/CVE-2008-4924.md): Multiple insecure method vulnerabilities in MW6 Technologies 1D Barcode ActiveX control (BARCODELib.MW6Barcode, Barcode.dll) 3.0.0.1 allow… (no CVSS)
- [CVE-2008-4925](https://cve.now/CVE-2008-4925.md): Multiple insecure method vulnerabilities in MW6 Technologies DataMatrix ActiveX control (DATAMATRIXLib.MW6DataMatrix, DataMatrix.dll)… (no CVSS)
- [CVE-2008-4926](https://cve.now/CVE-2008-4926.md): Multiple insecure method vulnerabilities in MW6 Technologies PDF417 ActiveX control (MW6PDF417Lib.PDF417, MW6PDF417.dll) 3.0.0.1 allow… (no CVSS)
- [CVE-2008-4927](https://cve.now/CVE-2008-4927.md): Microsoft Windows Media Player (WMP) 9.0 through 11 allows user-assisted attackers to cause a denial of service (application crash) via a… (no CVSS)
- [CVE-2008-4928](https://cve.now/CVE-2008-4928.md): Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote… (no CVSS)
- [CVE-2008-4929](https://cve.now/CVE-2008-4929.md): MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it… (CVSS 7.5)
- [CVE-2008-4930](https://cve.now/CVE-2008-4930.md): MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences… (no CVSS)
- [CVE-2008-2992](https://cve.now/CVE-2008-2992.md): Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file t (CVSS 7.8, KEV)
- [CVE-2008-4413](https://cve.now/CVE-2008-4413.md): Unspecified vulnerability in HP System Management Homepage (SMH) 2.2.6 and earlier on HP-UX B.11.11 and B.11.23, and SMH 2.2.6 and 2.2.8… (no CVSS)
- [CVE-2008-4908](https://cve.now/CVE-2008-4908.md): maps/Info/combine.pl in CrossFire crossfire-maps 1.11.0 allows local users to overwrite arbitrary files via a symlink attack on a… (no CVSS)
- [CVE-2008-4909](https://cve.now/CVE-2008-4909.md): Cross-site request forgery (CSRF) vulnerability in CompactCMS 1.1 and earlier allows remote attackers to perform unauthorized actions as… (no CVSS)
- [CVE-2008-4910](https://cve.now/CVE-2008-4910.md): The BasicService in Sun Java Web Start allows remote attackers to execute arbitrary programs on a client machine via a file:// URL… (no CVSS)
- [CVE-2008-4911](https://cve.now/CVE-2008-4911.md): PHP remote file inclusion vulnerability in read.php in Chattaitaliano Istant-Replay allows remote attackers to execute arbitrary PHP code… (no CVSS)
- [CVE-2008-4912](https://cve.now/CVE-2008-4912.md): SQL injection vulnerability in popup\_img.php in the fotogalerie module in RS MAXSOFT allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2008-4913](https://cve.now/CVE-2008-4913.md): Directory traversal vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to delete arbitrary files via a .. (no CVSS)
- [CVE-2008-4891](https://cve.now/CVE-2008-4891.md): Cross-site scripting (XSS) vulnerability in signme.inc.php in Planetluc SignMe 1.5 before 1.55 allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2008-4892](https://cve.now/CVE-2008-4892.md): Cross-site scripting (XSS) vulnerability in gallery.inc.php in Planetluc MyGallery 1.7.2 and earlier, and possibly other versions before… (no CVSS)
- [CVE-2008-4893](https://cve.now/CVE-2008-4893.md): Cross-site scripting (XSS) vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10a, when… (no CVSS)
- [CVE-2008-4894](https://cve.now/CVE-2008-4894.md): Directory traversal vulnerability in templates/mytribiqsite/tribal-GPL-1066/includes/header.inc.php in Tribiq CMS 5.0.10a, when… (no CVSS)
- [CVE-2008-4895](https://cve.now/CVE-2008-4895.md): SQL injection vulnerability in tr.php in YourFreeWorld Downline Builder allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-4896](https://cve.now/CVE-2008-4896.md): Cross-site scripting (XSS) vulnerability in fichiers/add\_url.php in Logz CMS 1.3.1 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2008-4897](https://cve.now/CVE-2008-4897.md): SQL injection vulnerability in fichiers/add\_url.php in Logz podcast CMS 1.3.1, when magic\_quotes\_gpc is disabled, allows remote attackers… (no CVSS)
- [CVE-2008-4898](https://cve.now/CVE-2008-4898.md): Cross-site scripting (XSS) vulnerability in planetluc RateMe 1.3.3 allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2008-4899](https://cve.now/CVE-2008-4899.md): Cross-site request forgery (CSRF) vulnerability in Planetluc RateMe 1.3.3 allows remote attackers to perform unauthorized actions as other… (no CVSS)
- [CVE-2008-4900](https://cve.now/CVE-2008-4900.md): SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Blaster Script allows remote attackers to execute arbitrary SQL… (no CVSS)
- [CVE-2008-4901](https://cve.now/CVE-2008-4901.md): SQL injection vulnerability in admin/admin.php in Article Publisher Pro 1.5 allows remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2008-4902](https://cve.now/CVE-2008-4902.md): SQL injection vulnerability in contact\_author.php in Article Publisher Pro 1.5 allows remote attackers to execute arbitrary SQL commands… (no CVSS)
- [CVE-2008-4903](https://cve.now/CVE-2008-4903.md): Cross-site scripting (XSS) vulnerability in the leave comment (feedback) feature in Typo 5.1.3 and earlier allows remote attackers to… (no CVSS)
- [CVE-2008-4904](https://cve.now/CVE-2008-4904.md): SQL injection vulnerability in the "Manage pages" feature (admin/pages) in Typo 5.1.3 and earlier allows remote authenticated users with… (no CVSS)
- [CVE-2008-4905](https://cve.now/CVE-2008-4905.md): Typo 5.1.3 and earlier uses a hard-coded salt for calculating password hashes, which makes it easier for attackers to guess passwords via… (no CVSS)
- [CVE-2008-4906](https://cve.now/CVE-2008-4906.md): SQL injection vulnerability in lyrics\_song.php in the Lyrics (lyrics\_menu) plugin 0.42 for e107 allows remote attackers to execute… (no CVSS)
- [CVE-2008-4907](https://cve.now/CVE-2008-4907.md): The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2008-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.