# CVEs published 2008-01-15

35 CVEs were published on January 15, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-0285](https://cve.now/CVE-2008-0285.md): ngIRCd 0.10.x before 0.10.4 and 0.11.0 before 0.11.0-pre2 allows remote attackers to cause a denial of service (crash) via crafted IRC PART (no CVSS)
- [CVE-2008-0280](https://cve.now/CVE-2008-0280.md): SQL injection vulnerability in index.php in MTCMS 2.0 and possibly earlier versions allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-0281](https://cve.now/CVE-2008-0281.md): SQL injection vulnerability in liste.php in ID-Commerce 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id (no CVSS)
- [CVE-2008-0282](https://cve.now/CVE-2008-0282.md): SQL injection vulnerability in welcome/inscription.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-0283](https://cve.now/CVE-2008-0283.md): PHP remote file inclusion vulnerability in /aides/index.php in DomPHP 0.81 and earlier allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2008-0284](https://cve.now/CVE-2008-0284.md): Cross-site scripting (XSS) vulnerability in Simple Machines Forum (SMF) 1.1.4 and earlier allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2008-0001](https://cve.now/CVE-2008-0001.md): VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of (no CVSS)
- [CVE-2008-0173](https://cve.now/CVE-2008-0173.md): SQL injection vulnerability in Gforge 4.6.99 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified parameter (no CVSS)
- [CVE-2008-0253](https://cve.now/CVE-2008-0253.md): SQL injection vulnerability in full\_text.php in Binn SBuilder allows remote attackers to execute arbitrary SQL commands via the nid paramete (no CVSS)
- [CVE-2008-0254](https://cve.now/CVE-2008-0254.md): SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic\_quotes\_gpc is disabled, allows remote (no CVSS)
- [CVE-2008-0255](https://cve.now/CVE-2008-0255.md): SQL injection vulnerability in archive.php in iGaming 1.5, and 1.3.1 and earlier, allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-0256](https://cve.now/CVE-2008-0256.md): Multiple SQL injection vulnerabilities in Matteo Binda ASP Photo Gallery 1.0 allow remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-0257](https://cve.now/CVE-2008-0257.md): Cross-site scripting (XSS) vulnerability in search.pl in Dansie Search Engine 2.7 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-0258](https://cve.now/CVE-2008-0258.md): Cross-site scripting (XSS) vulnerability in index.php in PHP Running Management (phpRunMan) before 1.0.3 allows remote attackers to inject a (no CVSS)
- [CVE-2008-0259](https://cve.now/CVE-2008-0259.md): Multiple directory traversal vulnerabilities in \_mg/php/mg\_thumbs.php in minimal Gallery 0.8 allow remote attackers to read arbitrary files (no CVSS)
- [CVE-2008-0260](https://cve.now/CVE-2008-0260.md): minimal Gallery 0.8 allows remote attackers to obtain configuration information via a direct request to php\_info.php, which calls the phpinf (no CVSS)
- [CVE-2008-0261](https://cve.now/CVE-2008-0261.md): Unspecified vulnerability in the search component and module in Mambo 4.5.x and 4.6.x allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2008-0262](https://cve.now/CVE-2008-0262.md): SQL injection vulnerability in includes/articleblock.php in Agares PhpAutoVideo 2.21 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-0263](https://cve.now/CVE-2008-0263.md): The SIP module in Ingate Firewall before 4.6.1 and SIParator before 4.6.1 does not reuse SIP media ports in unspecified call hold and send-o (no CVSS)
- [CVE-2008-0264](https://cve.now/CVE-2008-0264.md): Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remot (no CVSS)
- [CVE-2008-0265](https://cve.now/CVE-2008-0265.md): Multiple cross-site scripting (XSS) vulnerabilities in the Search function in the web management interface in F5 BIG-IP 9.4.3 allow remote a (no CVSS)
- [CVE-2008-0266](https://cve.now/CVE-2008-0266.md): Cross-site request forgery (CSRF) vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative passwor (no CVSS)
- [CVE-2008-0267](https://cve.now/CVE-2008-0267.md): Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sta (no CVSS)
- [CVE-2008-0268](https://cve.now/CVE-2008-0268.md): Cross-site scripting (XSS) vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2008-0269](https://cve.now/CVE-2008-0269.md): Unspecified vulnerability in the dotoprocs function in Sun Solaris 10 allows local users to cause a denial of service (panic) via unspecifie (no CVSS)
- [CVE-2008-0270](https://cve.now/CVE-2008-0270.md): SQL injection vulnerability in index.php in TaskFreak! 0.6.1 and earlier allows remote authenticated users to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-0271](https://cve.now/CVE-2008-0271.md): The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API (no CVSS)
- [CVE-2008-0272](https://cve.now/CVE-2008-0272.md): Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote atta (no CVSS)
- [CVE-2008-0273](https://cve.now/CVE-2008-0273.md): Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to condu (no CVSS)
- [CVE-2008-0274](https://cve.now/CVE-2008-0274.md): Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers t (no CVSS)
- [CVE-2008-0275](https://cve.now/CVE-2008-0275.md): The Atom 4.7 before 4.7.x-1.0 and 5.x before 5.x-1.0 module for Drupal does not properly manage permissions for node (1) titles, (2) teasers (no CVSS)
- [CVE-2008-0276](https://cve.now/CVE-2008-0276.md): Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-0277](https://cve.now/CVE-2008-0277.md): Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbi (no CVSS)
- [CVE-2008-0278](https://cve.now/CVE-2008-0278.md): SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-0279](https://cve.now/CVE-2008-0279.md): SQL injection vulnerability in liretopic.php in Xforum 1.4 and possibly others allows remote attackers to execute arbitrary SQL commands via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.