# CVEs published 2008-01-23

41 CVEs were published on January 23, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-0440](https://cve.now/CVE-2008-0440.md): AlstraSoft Forum Pay Per Post Exchange 2.0 stores passwords in cleartext, which makes it easier for attackers to access user accounts. (no CVSS)
- [CVE-2008-0422](https://cve.now/CVE-2008-0422.md): SQL injection vulnerability in mail.php in boastMachine (aka bMachine) 3.1 and earlier allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2008-0423](https://cve.now/CVE-2008-0423.md): Multiple PHP remote file inclusion vulnerabilities in Lama Software allow remote attackers to execute arbitrary PHP code via a URL in the MY (no CVSS)
- [CVE-2008-0424](https://cve.now/CVE-2008-0424.md): SQL injection vulnerability in blog.php in Mooseguy Blog System (MGBS) 1.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-0425](https://cve.now/CVE-2008-0425.md): Absolute path traversal vulnerability in explorerdir.php in Frimousse 0.0.2 allows remote attackers to read arbitrary files and list arbitra (no CVSS)
- [CVE-2008-0426](https://cve.now/CVE-2008-0426.md): Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PacerCMS before 0.6.1 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2008-0427](https://cve.now/CVE-2008-0427.md): Directory traversal vulnerability in file.php in bloofoxCMS 0.3 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-0428](https://cve.now/CVE-2008-0428.md): Multiple SQL injection vulnerabilities in the login function in system/class\_permissions.php in bloofoxCMS 0.3 allow remote attackers to exe (no CVSS)
- [CVE-2008-0429](https://cve.now/CVE-2008-0429.md): SQL injection vulnerability in index.php in AlstraSoft Forum Pay Per Post Exchange 2.0 allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2008-0430](https://cve.now/CVE-2008-0430.md): SQL injection vulnerability in form.php in 360 Web Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the IDFM parame (no CVSS)
- [CVE-2008-0431](https://cve.now/CVE-2008-0431.md): Directory traversal vulnerability in administrator/download.php in IDMOS (aka Phoenix) 1.0 allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2008-0432](https://cve.now/CVE-2008-0432.md): Cross-site scripting (XSS) vulnerability in index.php in phpAutoVideo 2.21 and earlier allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-0433](https://cve.now/CVE-2008-0433.md): PHP remote file inclusion vulnerability in theme/phpAutoVideo/LightTwoOh/sidebar.php in Agares phpAutoVideo 2.21 and earlier allows remote a (no CVSS)
- [CVE-2008-0434](https://cve.now/CVE-2008-0434.md): Format string vulnerability in the AXIMilter module in AXIGEN Mail Server 5.0.2 allows remote attackers to execute arbitrary code via format (no CVSS)
- [CVE-2008-0435](https://cve.now/CVE-2008-0435.md): Directory traversal vulnerability in index.php in OZJournals 2.1.1 allows remote attackers to read portions of arbitrary files via a .. (no CVSS)
- [CVE-2008-0436](https://cve.now/CVE-2008-0436.md): Cross-site scripting (XSS) vulnerability in profile-upload/upload.asp in PD9 Software MegaBBS 1.5.14b allows remote attackers to inject arbi (no CVSS)
- [CVE-2008-0437](https://cve.now/CVE-2008-0437.md): Multiple buffer overflows in the WebHPVCInstall.HPVirtualRooms14 ActiveX control in HPVirtualRooms14.dll 1.0.0.100, as used in the installat (no CVSS)
- [CVE-2008-0438](https://cve.now/CVE-2008-0438.md): Cross-site scripting (XSS) vulnerability in the font rendering functionality in Novemberborn sIFR 2.0.2 allows remote attackers to inject ar (no CVSS)
- [CVE-2008-0439](https://cve.now/CVE-2008-0439.md): Cross-site scripting (XSS) vulnerability in templates/default/admincp/attachments\_header.php in DeluxeBB 1.1 allows remote attackers to inje (no CVSS)
- [CVE-2007-6425](https://cve.now/CVE-2007-6425.md): Unspecified vulnerability in HP-UX B.11.31, when running ARPA Transport, allows remote attackers to cause a denial of service via unknown ve (no CVSS)
- [CVE-2008-0028](https://cve.now/CVE-2008-0028.md): Unspecified vulnerability in Cisco PIX 500 Series Security Appliance and 5500 Series Adaptive Security Appliance (ASA) before 7.2(3)6 and 8. (no CVSS)
- [CVE-2008-0029](https://cve.now/CVE-2008-0029.md): Cisco Application Velocity System (AVS) before 5.1.0 is installed with default passwords for some system accounts, which allows remote attac (no CVSS)
- [CVE-2008-0421](https://cve.now/CVE-2008-0421.md): SQL injection vulnerability in Invision Gallery 2.0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the album pa (no CVSS)
- [CVE-2008-0394](https://cve.now/CVE-2008-0394.md): Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which (no CVSS)
- [CVE-2008-0395](https://cve.now/CVE-2008-0395.md): Kayako SupportSuite 3.11.01 allows remote attackers to obtain server configuration information via a direct request to syncml/index.php, whi (no CVSS)
- [CVE-2008-0396](https://cve.now/CVE-2008-0396.md): Directory traversal vulnerability in BitDefender Update Server (http.exe), as used in BitDefender products including Security for Fileserver (no CVSS)
- [CVE-2008-0397](https://cve.now/CVE-2008-0397.md): Multiple SQL injection vulnerabilities in aflog 1.01, and possibly earlier versions, allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-0398](https://cve.now/CVE-2008-0398.md): Cross-site scripting (XSS) vulnerability in aflog 1.01, and possibly earlier versions, allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-0399](https://cve.now/CVE-2008-0399.md): Multiple buffer overflows in Toshiba Surveillance (Surveillix) RecordSend ActiveX control (MeIpCamX.DLL 1.0.0.4) allow remote attackers to e (no CVSS)
- [CVE-2008-0400](https://cve.now/CVE-2008-0400.md): Cross-site scripting (XSS) vulnerability in header.tpl.php in the modern template for Singapore 0.10.1 allows remote attackers to inject arb (no CVSS)
- [CVE-2008-0401](https://cve.now/CVE-2008-0401.md): Buffer overflow in the logging functionality of the HTTP server in IBM Tivoli Provisioning Manager for OS Deployment (TPMfOSD) before 5.1.0. (no CVSS)
- [CVE-2008-0402](https://cve.now/CVE-2008-0402.md): Unspecified vulnerability in IBM WebSphere Business Modeler Basic and Advanced 6.0.2.1 before Interim Fix 11 allows remote authenticated use (no CVSS)
- [CVE-2008-0403](https://cve.now/CVE-2008-0403.md): The web server in Belkin Wireless G Plus MIMO Router F5D9230-4 does not require authentication for SaveCfgFile.cgi, which allows remote atta (no CVSS)
- [CVE-2008-0404](https://cve.now/CVE-2008-0404.md): Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors r (no CVSS)
- [CVE-2008-0392](https://cve.now/CVE-2008-0392.md): Multiple buffer overflows in Microsoft Visual Basic Enterprise Edition 6.0 SP6 allow user-assisted remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2008-0393](https://cve.now/CVE-2008-0393.md): Directory traversal vulnerability in info.php in GradMan 0.1.3 and earlier allows remote attackers to include and execute arbitrary local fi (no CVSS)
- [CVE-2008-0128](https://cve.now/CVE-2008-0128.md): The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the (no CVSS)
- [CVE-2008-0388](https://cve.now/CVE-2008-0388.md): SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the use (no CVSS)
- [CVE-2008-0389](https://cve.now/CVE-2008-0389.md): Unspecified vulnerability in the serveServletsByClassnameEnabled feature in IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.25, 6.1 (no CVSS)
- [CVE-2008-0390](https://cve.now/CVE-2008-0390.md): stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via t (no CVSS)
- [CVE-2008-0391](https://cve.now/CVE-2008-0391.md): inc/elementz.php in aliTalk 1.9.1.1 does not properly verify authentication, which allows remote attackers to add an arbitrary user account (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.