# CVEs published 2008-01-09

34 CVEs were published on January 9, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2007-0012](https://cve.now/CVE-2007-0012.md): Sun JRE 5.0 before update 14 allows remote attackers to cause a denial of service (Internet Explorer crash) via an object tag with an encode (no CVSS)
- [CVE-2007-6250](https://cve.now/CVE-2007-6250.md): Stack-based buffer overflow in AOL AOLMediaPlaybackControl (AOLMediaPlaybackControl.exe), as used by AmpX ActiveX control (AmpX.dll), might (no CVSS)
- [CVE-2007-6531](https://cve.now/CVE-2007-6531.md): Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code (no CVSS)
- [CVE-2007-6532](https://cve.now/CVE-2007-6532.md): Double free vulnerability in the Widget Library (libxfcegui4) in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2007-5762](https://cve.now/CVE-2007-5762.md): NICM.SYS driver 3.0.0.4, as used in Novell NetWare Client 4.91 SP4, allows local users to execute arbitrary code by opening the \\\\.\\nicm dev (no CVSS)
- [CVE-2008-0184](https://cve.now/CVE-2008-0184.md): Absolute path traversal vulnerability in index.php in Sys-Hotel on Line System allows remote attackers to read arbitrary files via an encode (no CVSS)
- [CVE-2008-0185](https://cve.now/CVE-2008-0185.md): SQL injection vulnerability in index.php in NetRisk 1.9.7 and possibly earlier versions allows remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2008-0186](https://cve.now/CVE-2008-0186.md): Cross-site scripting (XSS) vulnerability in index.php in NetRisk 1.9.7 and possibly earlier allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-0187](https://cve.now/CVE-2008-0187.md): SQL injection vulnerability in songinfo.php in SAM Broadcaster samPHPweb, possibly 4.2.2 and earlier, allows remote attackers to execute arb (no CVSS)
- [CVE-2007-4769](https://cve.now/CVE-2007-4769.md): The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 be (no CVSS)
- [CVE-2007-4772](https://cve.now/CVE-2007-4772.md): The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 be (no CVSS)
- [CVE-2007-5401](https://cve.now/CVE-2007-5401.md): Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute (no CVSS)
- [CVE-2007-5402](https://cve.now/CVE-2007-5402.md): Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys\_requ (no CVSS)
- [CVE-2007-5403](https://cve.now/CVE-2007-5403.md): Multiple cross-site scripting (XSS) vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script (no CVSS)
- [CVE-2007-5404](https://cve.now/CVE-2007-5404.md): Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows r (no CVSS)
- [CVE-2007-5616](https://cve.now/CVE-2007-5616.md): ssh-signer in SSH Tectia Client and Server 5.x before 5.2.4, and 5.3.x before 5.3.6, on Unix and Linux allows local users to gain privileges (no CVSS)
- [CVE-2007-6067](https://cve.now/CVE-2007-6067.md): Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 befo (no CVSS)
- [CVE-2007-6600](https://cve.now/CVE-2007-6600.md): PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instea (no CVSS)
- [CVE-2007-6601](https://cve.now/CVE-2007-6601.md): The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local (no CVSS)
- [CVE-2007-5665](https://cve.now/CVE-2007-5665.md): STEngine.exe 3.5.0.20 in Novell ZENworks Endpoint Security Management (ESM) 3.5, and other ESM versions before 3.5.0.82, dynamically creates (no CVSS)
- [CVE-2007-5761](https://cve.now/CVE-2007-5761.md): The NantSys device 5.0.0.115 in Motorola netOctopus 5.1.2 build 1011 has weak permissions for the \\\\.\\NantSys device interface (nantsys.sys) (no CVSS)
- [CVE-2008-0147](https://cve.now/CVE-2008-0147.md): SQL injection vulnerability in index.php in SmallNuke 2.0.4 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to execu (no CVSS)
- [CVE-2008-0148](https://cve.now/CVE-2008-0148.md): TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd param (no CVSS)
- [CVE-2008-0149](https://cve.now/CVE-2008-0149.md): TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function (no CVSS)
- [CVE-2008-0150](https://cve.now/CVE-2008-0150.md): Unspecified vulnerability in the LDAP authentication feature in Aruba Mobility Controller 2.3.6.15, 2.5.2.11, 2.5.4.25, 2.5.5.7, 3.1.1.3, an (no CVSS)
- [CVE-2008-0151](https://cve.now/CVE-2008-0151.md): Heap-based buffer overflow in Foxit WAC Server 2.1.0.910, 2.0 Build 3503, and earlier allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2008-0152](https://cve.now/CVE-2008-0152.md): SLnet.exe in SeattleLab SLNet RF Telnet Server 4.1.1.3758 and earlier allows user-assisted remote attackers to cause a denial of service (cr (no CVSS)
- [CVE-2008-0153](https://cve.now/CVE-2008-0153.md): telnetd.exe in Pragma TelnetServer 7.0.4.589 allows remote attackers to cause a denial of service (process crash and resource exhaustion) vi (no CVSS)
- [CVE-2008-0154](https://cve.now/CVE-2008-0154.md): SQL injection vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to execute arbitrary SQL commands the c parameter (no CVSS)
- [CVE-2008-0155](https://cve.now/CVE-2008-0155.md): Cross-site scripting (XSS) vulnerability in index.php in EvilBoard 0.1a (Alpha) allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-0156](https://cve.now/CVE-2008-0156.md): Absolute path traversal vulnerability in index.php in Million Dollar Script 2.0.14 allows remote attackers to read arbitrary files via encod (no CVSS)
- [CVE-2008-0157](https://cve.now/CVE-2008-0157.md): SQL injection vulnerability in FlexBB 0.6.3 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb\_temp\_id par (no CVSS)
- [CVE-2008-0158](https://cve.now/CVE-2008-0158.md): Directory traversal vulnerability in index.php in Shop-Script 2.0 and possibly other versions allows remote attackers to read arbitrary file (no CVSS)
- [CVE-2008-0159](https://cve.now/CVE-2008-0159.md): SQL injection vulnerability in index.php in eggBlog 3.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the eggb (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.