# CVEs published 2008-12-09

30 CVEs were published on December 9, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-5399](https://cve.now/CVE-2008-5399.md): Cross-site scripting (XSS) vulnerability in the listonlineusers (aka "Who's online") component in mvnForum before 1.2.1 GA allows remote… (no CVSS)
- [CVE-2008-5400](https://cve.now/CVE-2008-5400.md): Multiple cross-site request forgery (CSRF) vulnerabilities in mvnForum before 1.2.1 GA allow remote attackers to (1) create forums, (2)… (no CVSS)
- [CVE-2008-5401](https://cve.now/CVE-2008-5401.md): Stack-based buffer overflow in the image tooltip implementation in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2008-5402](https://cve.now/CVE-2008-5402.md): Double free vulnerability in the XML parser in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a crafted… (no CVSS)
- [CVE-2008-5403](https://cve.now/CVE-2008-5403.md): Heap-based buffer overflow in the XML parser in the AIM plugin in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2008-5404](https://cve.now/CVE-2008-5404.md): Insecure method vulnerability in the FlexCell.Grid ActiveX control in FlexCell.ocx 5.7.0.1 in FlexCell Grid ActiveX Component allows… (no CVSS)
- [CVE-2008-5405](https://cve.now/CVE-2008-5405.md): Stack-based buffer overflow in the RDP protocol password decoder in Cain & Abel 4.9.23 and 4.9.24, and possibly earlier, allows remote… (no CVSS)
- [CVE-2008-5406](https://cve.now/CVE-2008-5406.md): Stack-based buffer overflow in Apple QuickTime Player 7.5.5 and iTunes 8.0.2.20 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2008-5407](https://cve.now/CVE-2008-5407.md): Multiple unspecified vulnerabilities in the Backup Exec remote-agent logon process in Symantec Backup Exec for Windows Servers 11.0 (aka… (no CVSS)
- [CVE-2008-5408](https://cve.now/CVE-2008-5408.md): Buffer overflow in the data management protocol in Symantec Backup Exec for Windows Servers 11.0 (aka 11d) builds 6235 and 7170, 12.0… (no CVSS)
- [CVE-2008-5409](https://cve.now/CVE-2008-5409.md): Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and Antivirus Standard 10, (2) BullGuard Internet… (no CVSS)
- [CVE-2008-4310](https://cve.now/CVE-2008-4310.md): httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of… (no CVSS, webrick)
- [CVE-2008-4390](https://cve.now/CVE-2008-4390.md): The Cisco Linksys WVC54GC wireless video camera before firmware 1.25 sends cleartext configuration data in response to a Setup Wizard… (no CVSS)
- [CVE-2008-4391](https://cve.now/CVE-2008-4391.md): Stack-based buffer overflow in the SetSource method in the NetCamPlayerWeb11gv2 ActiveX control in NetCamPlayerWeb11gv2.ocx on the Cisco… (no CVSS)
- [CVE-2008-4917](https://cve.now/CVE-2008-4917.md): Unspecified vulnerability in VMware Workstation 5.5.8 and earlier, and 6.0.5 and earlier 6.x versions; VMware Player 1.0.8 and earlier… (no CVSS)
- [CVE-2008-5079](https://cve.now/CVE-2008-5079.md): net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel… (no CVSS)
- [CVE-2008-5277](https://cve.now/CVE-2008-5277.md): PowerDNS before 2.9.21.2 allows remote attackers to cause a denial of service (daemon crash) via a CH HINFO query. (no CVSS)
- [CVE-2008-5381](https://cve.now/CVE-2008-5381.md): Buffer overflow in the URL processing in ffdshow (aka ffdshow-tryout) before SVN revision 2347 allows remote attackers to execute… (no CVSS)
- [CVE-2008-5382](https://cve.now/CVE-2008-5382.md): Cross-site request forgery (CSRF) vulnerability in I-O DATA DEVICE HDL-F160, HDL-F250, HDL-F300, and HDL-F320 firmware before 1.02 allows… (no CVSS)
- [CVE-2008-5383](https://cve.now/CVE-2008-5383.md): Stack-based buffer overflow in National Instruments Electronics Workbench allows user-assisted attackers to cause a denial of service… (no CVSS)
- [CVE-2008-5384](https://cve.now/CVE-2008-5384.md): crontab in bos.rte.cron in IBM AIX 6.1.0 through 6.1.2 allows local users with aix.system.config.cron authorization to gain privileges by… (no CVSS)
- [CVE-2008-5385](https://cve.now/CVE-2008-5385.md): enq in bos.rte.printers in IBM AIX 6.1.0 through 6.1.2, when a print queue is defined in /etc/qconfig, allows local users to delete… (no CVSS)
- [CVE-2008-5386](https://cve.now/CVE-2008-5386.md): Buffer overflow in ndp in IBM AIX 6.1.0 through 6.1.2, when the netcd daemon is running, allows local users to gain privileges via… (no CVSS)
- [CVE-2008-5387](https://cve.now/CVE-2008-5387.md): Buffer overflow in autoconf6 in IBM AIX 6.1.0 through 6.1.2, when Role-Based Access Control is enabled, allows local users with… (no CVSS)
- [CVE-2008-5393](https://cve.now/CVE-2008-5393.md): UPR-Kernel in Ubuntu Privacy Remix (UPR) before 8.04\_r1 includes kernel support for mounting RAID arrays, which might allow remote… (no CVSS)
- [CVE-2008-5394](https://cve.now/CVE-2008-5394.md): /bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to… (no CVSS)
- [CVE-2008-5395](https://cve.now/CVE-2008-5395.md): The parisc\_show\_stack function in arch/parisc/kernel/traps.c in the Linux kernel before 2.6.28-rc7 on PA-RISC allows local users to cause… (no CVSS)
- [CVE-2008-5396](https://cve.now/CVE-2008-5396.md): Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the… (no CVSS)
- [CVE-2008-5397](https://cve.now/CVE-2008-5397.md): Tor before 0.2.0.32 does not properly process the (1) User and (2) Group configuration options, which might allow local users to gain… (no CVSS)
- [CVE-2008-5398](https://cve.now/CVE-2008-5398.md): Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations where an exit relay… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2008-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.