# CVEs published 2008-01-16 28 CVEs were published on January 16, 2008: 1 critical, 0 high. Days are UTC. - [CVE-2008-0081](https://cve.now/CVE-2008-0081.md): Unspecified vulnerability in Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, and Office 2004 for Mac allows user-assisted remote att (CVSS 9.8) - [CVE-2008-0297](https://cve.now/CVE-2008-0297.md): PhotoKorn allows remote attackers to obtain database credentials via a direct request to update/update3.php, which includes the credentials (no CVSS) - [CVE-2008-0298](https://cve.now/CVE-2008-0298.md): KHTML WebKit as used in Apple Safari 2.x allows remote attackers to cause a denial of service (browser crash) via a crafted web page, possib (no CVSS) - [CVE-2008-0299](https://cve.now/CVE-2008-0299.md): common.py in Paramiko 1.7.1 and earlier, when using threads or forked processes, does not properly use RandomPool, which allows one session (no CVSS, paramiko) - [CVE-2008-0291](https://cve.now/CVE-2008-0291.md): SQL injection vulnerability in showproduct.asp in RichStrong CMS allows remote attackers to execute arbitrary SQL commands via the cat param (no CVSS) - [CVE-2008-0292](https://cve.now/CVE-2008-0292.md): Cross-site scripting (XSS) vulnerability in photo\_album.pl in Dansie Photo Album 1.0 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2008-0293](https://cve.now/CVE-2008-0293.md): Unspecified vulnerability in cron.php in FreeSeat before 1.1.5d, when format.php has certain modifications, allows remote attackers to bypas (no CVSS) - [CVE-2008-0294](https://cve.now/CVE-2008-0294.md): Unspecified vulnerability in the seat-locking implementation in FreeSeat before 1.1.5d allows attackers to book a seat more than once via un (no CVSS) - [CVE-2008-0295](https://cve.now/CVE-2008-0295.md): Heap-based buffer overflow in modules/access/rtsp/real\_sdpplin.c in the Xine library, as used in VideoLAN VLC Media Player 0.8.6d and earlie (no CVSS) - [CVE-2008-0296](https://cve.now/CVE-2008-0296.md): Heap-based buffer overflow in the libaccess\_realrtsp plugin in VideoLAN VLC Media Player 0.8.6d and earlier on Windows might allow remote RT (no CVSS) - [CVE-2007-5655](https://cve.now/CVE-2007-5655.md): TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote (no CVSS) - [CVE-2007-5656](https://cve.now/CVE-2007-5656.md): TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote (no CVSS) - [CVE-2007-5657](https://cve.now/CVE-2007-5657.md): TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0.0 through 4.4.1 allows remote (no CVSS) - [CVE-2007-5658](https://cve.now/CVE-2007-5658.md): Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise Message Service (EMS) 4.0. (no CVSS) - [CVE-2008-0032](https://cve.now/CVE-2008-0032.md): Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a movie file containing a Macintosh Resource record with a (no CVSS) - [CVE-2008-0033](https://cve.now/CVE-2008-0033.md): Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and e (no CVSS) - [CVE-2008-0036](https://cve.now/CVE-2008-0036.md): Buffer overflow in Apple QuickTime before 7.4 allows remote attackers to execute arbitrary code via a crafted compressed PICT image, which t (no CVSS) - [CVE-2008-0031](https://cve.now/CVE-2008-0031.md): Unspecified vulnerability in Apple QuickTime before 7.4 allows remote attackers to cause a denial of service (application termination) and e (no CVSS) - [CVE-2008-0034](https://cve.now/CVE-2008-0034.md): Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physical access to execute applications witho (no CVSS) - [CVE-2008-0035](https://cve.now/CVE-2008-0035.md): Unspecified vulnerability in Foundation, as used in Apple iPhone 1.0 through 1.1.2, iPod touch 1.1 through 1.1.2, and Mac OS X 10.5 through (no CVSS) - [CVE-2008-0122](https://cve.now/CVE-2008-0122.md): Off-by-one error in the inet\_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 through 7.0-PRERELEAS (no CVSS) - [CVE-2008-0216](https://cve.now/CVE-2008-0216.md): The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated wi (no CVSS) - [CVE-2008-0217](https://cve.now/CVE-2008-0217.md): The script program in FreeBSD 5.0 through 7.0-PRERELEASE invokes openpty, which creates a pseudo-terminal with world-readable and world-writ (no CVSS) - [CVE-2008-0287](https://cve.now/CVE-2008-0287.md): PHP remote file inclusion vulnerability in VisionBurst vcart 3.3.2 allows remote attackers to execute arbitrary PHP code via a URL in the ab (no CVSS) - [CVE-2008-0288](https://cve.now/CVE-2008-0288.md): Multiple SQL injection vulnerabilities in ImageAlbum 2.0.0b2 allow remote attackers to execute arbitrary SQL commands via the id, which is n (no CVSS) - [CVE-2008-0289](https://cve.now/CVE-2008-0289.md): PHP remote file inclusion vulnerability in view\_func.php in Member Area System (MAS) 1.7 and possibly others allows remote attackers to exec (no CVSS) - [CVE-2008-0290](https://cve.now/CVE-2008-0290.md): Multiple SQL injection vulnerabilities in Digital Hive 2.0 RC2 and earlier allow (1) remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2008-0286](https://cve.now/CVE-2008-0286.md): SQL injection vulnerability in admin/login.php in Article Dashboard allows remote attackers to execute arbitrary SQL commands via the (1) us (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-01-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.