# CVEs published 2008-01-08

45 CVEs were published on January 8, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2007-0066](https://cve.now/CVE-2007-0066.md): The kernel in Microsoft Windows 2000 SP4, XP SP2, and Server 2003, when ICMP Router Discovery Protocol (RDP) is enabled, allows remote attac (no CVSS)
- [CVE-2007-0069](https://cve.now/CVE-2007-0069.md): Unspecified vulnerability in the kernel in Microsoft Windows XP SP2, Server 2003, and Vista allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2007-5352](https://cve.now/CVE-2007-5352.md): Unspecified vulnerability in Local Security Authority Subsystem Service (LSASS) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 a (no CVSS)
- [CVE-2007-5360](https://cve.now/CVE-2007-5360.md): Buffer overflow in OpenPegasus Management server, when compiled to use PAM and with PEGASUS\_USE\_PAM\_STANDALONE\_PROC defined, as used in VMWa (no CVSS)
- [CVE-2008-0003](https://cve.now/CVE-2008-0003.md): Stack-based buffer overflow in the PAMBasicAuthenticator::PAMCallback function in OpenPegasus CIM management server (tog-pegasus), when comp (no CVSS)
- [CVE-2007-6421](https://cve.now/CVE-2007-6421.md): Cross-site scripting (XSS) vulnerability in balancer-manager in mod\_proxy\_balancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remo (no CVSS)
- [CVE-2007-6674](https://cve.now/CVE-2007-6674.md): Cross-site scripting (XSS) vulnerability in Default.asp in RapidShare Database allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2007-6675](https://cve.now/CVE-2007-6675.md): The b\_system\_comments\_show function in htdocs/modules/system/blocks/system\_blocks.php in XOOPS before 2.0.18 does not check permissions, whi (no CVSS)
- [CVE-2007-6676](https://cve.now/CVE-2007-6676.md): The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html, (2) .asp, and other possibly dangerou (no CVSS)
- [CVE-2008-0133](https://cve.now/CVE-2008-0133.md): Multiple SQL injection vulnerabilities in Tribisur 2.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id p (no CVSS)
- [CVE-2008-0134](https://cve.now/CVE-2008-0134.md): Cross-site scripting (XSS) vulnerability in Forums/setup.asp in Snitz Forums 2000 3.4.06 and earlier allows remote attackers to inject arbit (no CVSS)
- [CVE-2008-0135](https://cve.now/CVE-2008-0135.md): Snitz Forums 2000 3.4.06 and earlier stores sensitive information under the web root with insufficient access control, which allows remote a (no CVSS)
- [CVE-2008-0136](https://cve.now/CVE-2008-0136.md): Snitz Forums 2000 3.4.05 allows remote attackers to obtain sensitive information via a direct request to forum/whereami.asp, which reveals t (no CVSS)
- [CVE-2008-0137](https://cve.now/CVE-2008-0137.md): PHP remote file inclusion vulnerability in config.inc.php in SNETWORKS PHP CLASSIFIEDS 5.0 allows remote attackers to execute arbitrary PHP (no CVSS)
- [CVE-2008-0138](https://cve.now/CVE-2008-0138.md): PHP remote file inclusion vulnerability in xoopsgallery/init\_basic.php in the mod\_gallery module for XOOPS, when register\_globals is disable (no CVSS)
- [CVE-2008-0139](https://cve.now/CVE-2008-0139.md): Eval injection vulnerability in loudblog/inc/parse\_old.php in Loudblog 0.8.0 and earlier allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2008-0140](https://cve.now/CVE-2008-0140.md): Directory traversal vulnerability in error.php in Uebimiau Webmail 2.7.10 and 2.7.2 allows remote authenticated users to read arbitrary file (no CVSS)
- [CVE-2008-0141](https://cve.now/CVE-2008-0141.md): actions.php in WebPortal CMS 0.6-beta generates predictable passwords containing only the time of day, which makes it easier for remote atta (no CVSS)
- [CVE-2008-0142](https://cve.now/CVE-2008-0142.md): Multiple SQL injection vulnerabilities in WebPortal CMS 0.6-beta allow remote attackers to execute arbitrary SQL commands via the user\_name (no CVSS)
- [CVE-2008-0143](https://cve.now/CVE-2008-0143.md): PHP remote file inclusion vulnerability in common/db.php in samPHPweb, possibly 4.2.2 and others, as provided with SAM Broadcaster, allows r (no CVSS)
- [CVE-2008-0144](https://cve.now/CVE-2008-0144.md): PHP remote file inclusion vulnerability in index.php in NetRisk 1.9.7 and earlier allows remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2008-0145](https://cve.now/CVE-2008-0145.md): Unspecified vulnerability in glob in PHP before 4.4.8, when open\_basedir is enabled, has unknown impact and attack vectors. (no CVSS)
- [CVE-2008-0146](https://cve.now/CVE-2008-0146.md): Cross-site scripting (XSS) vulnerability in the error page in W3-mSQL allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2007-6388](https://cve.now/CVE-2007-6388.md): Cross-site scripting (XSS) vulnerability in mod\_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 throu (no CVSS)
- [CVE-2007-6422](https://cve.now/CVE-2007-6422.md): The balancer\_handler function in mod\_proxy\_balancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module i (no CVSS)
- [CVE-2007-6671](https://cve.now/CVE-2007-6671.md): SQL injection vulnerability in login\_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2007-6672](https://cve.now/CVE-2007-6672.md): Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) (no CVSS, org.mortbay.jetty:jetty)
- [CVE-2007-6673](https://cve.now/CVE-2007-6673.md): Cross-site scripting (XSS) vulnerability in Makale Scripti allows remote attackers to inject arbitrary web script or HTML via the ara parame (no CVSS)
- [CVE-2008-0129](https://cve.now/CVE-2008-0129.md): SQL injection vulnerability in starnet/addons/slideshow\_full.php in Site@School 2.3.10 and earlier allows remote attackers to execute arbitr (no CVSS)
- [CVE-2008-0130](https://cve.now/CVE-2008-0130.md): SQL injection vulnerability in login\_form.asp in Instant Softwares Dating Site allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-0131](https://cve.now/CVE-2008-0131.md): Cross-site scripting (XSS) vulnerability in login\_form.asp in Instant Softwares Dating Site allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-0132](https://cve.now/CVE-2008-0132.md): Pragma FortressSSH 5.0 Build 4 Revision 293 and earlier handles long input to sshd.exe by creating an error-message window and waiting for t (no CVSS)
- [CVE-2007-6668](https://cve.now/CVE-2007-6668.md): admin/uploadgames.php in MySpace Content Zone (MCZ) 3.x does not require administrative privileges, which allows remote attackers to perform (no CVSS)
- [CVE-2007-6669](https://cve.now/CVE-2007-6669.md): Cross-site scripting (XSS) vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2007-6670](https://cve.now/CVE-2007-6670.md): SQL injection vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to execute arbitrary SQL commands via the string para (no CVSS)
- [CVE-2008-0094](https://cve.now/CVE-2008-0094.md): Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arb (no CVSS)
- [CVE-2008-0095](https://cve.now/CVE-2008-0095.md): The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance (no CVSS)
- [CVE-2008-0096](https://cve.now/CVE-2008-0096.md): Multiple buffer overflows in Georgia SoftWorks SSH2 Server (GSW\_SSHD) 7.01.0003 and earlier allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-0097](https://cve.now/CVE-2008-0097.md): Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW\_SSHD) 7.01.0003 and earlier allows remote attackers to (no CVSS)
- [CVE-2008-0098](https://cve.now/CVE-2008-0098.md): Buffer overflow in RealPlayer 11 build 6.0.14.748 allows remote attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2008-0099](https://cve.now/CVE-2008-0099.md): Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searc (no CVSS)
- [CVE-2008-0100](https://cve.now/CVE-2008-0100.md): Stack-based buffer overflow in the Scene::errorf function in Scene.cpp in White\_Dune 0.29 beta791 and earlier allows remote attackers to exe (no CVSS)
- [CVE-2008-0101](https://cve.now/CVE-2008-0101.md): Format string vulnerability in the swDebugf function in DuneApp.cpp in White\_Dune 0.29 beta791 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2007-5965](https://cve.now/CVE-2007-5965.md): QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to (no CVSS)
- [CVE-2008-0093](https://cve.now/CVE-2008-0093.md): Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.