# CVEs published 2008-11-25 25 CVEs were published on November 25, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-1586](https://cve.now/CVE-2008-1586.md): ImageIO in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allow remote attackers to cause a denial of… (no CVSS) - [CVE-2008-4225](https://cve.now/CVE-2008-4225.md): Integer overflow in the xmlBufferResize function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service… (no CVSS) - [CVE-2008-4226](https://cve.now/CVE-2008-4226.md): Integer overflow in the xmlSAX2Characters function in libxml2 2.7.2 allows context-dependent attackers to cause a denial of service… (no CVSS) - [CVE-2008-4227](https://cve.now/CVE-2008-4227.md): Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 changes the encryption level of PPTP VPN connections to a… (no CVSS) - [CVE-2008-4228](https://cve.now/CVE-2008-4228.md): The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 allows physically proximate… (no CVSS) - [CVE-2008-4229](https://cve.now/CVE-2008-4229.md): Race condition in the Passcode Lock feature in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.0 through 2.1 allows… (no CVSS) - [CVE-2008-4230](https://cve.now/CVE-2008-4230.md): The Passcode Lock feature in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 displays SMS messages when the… (no CVSS) - [CVE-2008-4231](https://cve.now/CVE-2008-4231.md): Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which… (no CVSS) - [CVE-2008-4232](https://cve.now/CVE-2008-4232.md): Safari in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.1 through 2.1 does not restrict an IFRAME's content display to… (no CVSS) - [CVE-2008-4233](https://cve.now/CVE-2008-4233.md): Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not isolate the call-approval dialog from the… (no CVSS) - [CVE-2008-4829](https://cve.now/CVE-2008-4829.md): Multiple buffer overflows in lib/http.c in Streamripper 1.63.5 allow remote attackers to execute arbitrary code via (1) a long "Zwitterion… (no CVSS) - [CVE-2008-5109](https://cve.now/CVE-2008-5109.md): The default configuration of Adobe Flash Media Server (FMS) 3.0 does not enable SWF Verification for (1) RTMPE and (2) RTMPTE sessions… (no CVSS) - [CVE-2008-5227](https://cve.now/CVE-2008-5227.md): Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a "file inclusion… (no CVSS) - [CVE-2008-5228](https://cve.now/CVE-2008-5228.md): Cross-site scripting (XSS) vulnerability in IBM Workplace Content Management (WCM) 6.0G and 6.1 before CF8, when a Page Navigation… (no CVSS) - [CVE-2008-5229](https://cve.now/CVE-2008-5229.md): Stack-based buffer overflow in Microsoft Device IO Control in iphlpapi.dll in Microsoft Windows Vista Gold and SP1 allows local users in… (no CVSS) - [CVE-2008-5230](https://cve.now/CVE-2008-5230.md): The Temporal Key Integrity Protocol (TKIP) implementation in unspecified Cisco products and other vendors' products, as used in WPA and… (no CVSS) - [CVE-2008-5222](https://cve.now/CVE-2008-5222.md): SQL injection vulnerability in login.asp in Dvbbs 8.2.0 allows remote attackers to execute arbitrary SQL commands via the username… (no CVSS) - [CVE-2008-5223](https://cve.now/CVE-2008-5223.md): SQL injection vulnerability in index.php in Airvae Commerce 3.0 allows remote attackers to execute arbitrary SQL commands via the pid… (no CVSS) - [CVE-2008-5224](https://cve.now/CVE-2008-5224.md): Cross-site scripting (XSS) vulnerability in Kent Web Mart 1.61 and earlier allows remote attackers to inject arbitrary web script or HTML… (no CVSS) - [CVE-2008-5225](https://cve.now/CVE-2008-5225.md): Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script… (no CVSS) - [CVE-2008-5226](https://cve.now/CVE-2008-5226.md): SQL injection vulnerability in the MambAds (com\_mambads) component 1.0 RC1 Beta and 1.0 RC1 for Mambo allows remote attackers to execute… (no CVSS) - [CVE-2008-5218](https://cve.now/CVE-2008-5218.md): ScriptsEz FREEze Greetings 1.0 stores pwd.txt under the web root with insufficient access control, which allows remote attackers to obtain… (no CVSS) - [CVE-2008-5219](https://cve.now/CVE-2008-5219.md): The password change feature (admin/cp.php) in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does… (no CVSS) - [CVE-2008-5220](https://cve.now/CVE-2008-5220.md): Unrestricted file upload vulnerability in admin/upload\_form.php in wPortfolio 0.3 and earlier allows remote attackers to execute arbitrary… (no CVSS) - [CVE-2008-5221](https://cve.now/CVE-2008-5221.md): The account\_save action in admin/userinfo.php in wPortfolio 0.3 and earlier does not require authentication and does not require knowledge… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2008-11-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.