# CVEs published 2008-03-10

55 CVEs were published on March 10, 2008: 0 critical, 1 high. Days are UTC.

- [CVE-2008-1218](https://cve.now/CVE-2008-1218.md): Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attack (no CVSS)
- [CVE-2008-1272](https://cve.now/CVE-2008-1272.md): Multiple SQL injection vulnerabilities in BM Classifieds 20080309 and earlier allow remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-1273](https://cve.now/CVE-2008-1273.md): Multiple cross-site scripting (XSS) vulnerabilities in imageVue 1.7 allow remote attackers to inject arbitrary web script or HTML via the pa (no CVSS)
- [CVE-2008-1274](https://cve.now/CVE-2008-1274.md): Untrusted search path vulnerability in man in IBM AIX 6.1.0 allows local users to execute arbitrary code via a malicious program in the man (no CVSS)
- [CVE-2008-1275](https://cve.now/CVE-2008-1275.md): Multiple unspecified vulnerabilities in the SMTP service in MailEnable Standard Edition 1.x, Professional Edition 3.x and earlier, and Enter (no CVSS)
- [CVE-2008-1276](https://cve.now/CVE-2008-1276.md): Multiple buffer overflows in the IMAP service (MEIMAPS.EXE) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allow (no CVSS)
- [CVE-2008-1277](https://cve.now/CVE-2008-1277.md): The IMAP service (MEIMAPS.exe) in MailEnable Professional Edition and Enterprise Edition 3.13 and earlier allows remote attackers to cause a (no CVSS)
- [CVE-2008-1278](https://cve.now/CVE-2008-1278.md): The RemotelyAnywhere.exe service in the Remotely Anywhere Server and Workstation 8.0.668 and earlier allows remote attackers to cause a deni (no CVSS)
- [CVE-2008-1279](https://cve.now/CVE-2008-1279.md): Acronis True Image Group Server 1.5.19.191 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image (no CVSS)
- [CVE-2008-1280](https://cve.now/CVE-2008-1280.md): Acronis True Image Windows Agent 1.0.0.54 and earlier, included in Acronis True Image Enterprise Server 9.5.0.8072 and the other True Image (no CVSS)
- [CVE-2008-1281](https://cve.now/CVE-2008-1281.md): Directory traversal vulnerability in TFTPsrvs.exe 2.5.3.1 and earlier, as used in Argon Technology Client Management Services (CMS) 1.31 and (no CVSS)
- [CVE-2008-1282](https://cve.now/CVE-2008-1282.md): Buffer overflow in the BFup ActiveX control (BFup.dll) in B21Soft BFup before 1.0.802.29 allows remote attackers to execute arbitrary code v (no CVSS)
- [CVE-2008-1161](https://cve.now/CVE-2008-1161.md): Buffer overflow in the Matroska demuxer (demuxers/demux\_matroska.c) in xine-lib before 1.1.10.1 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2008-1270](https://cve.now/CVE-2008-1270.md): mod\_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to rea (no CVSS)
- [CVE-2008-1219](https://cve.now/CVE-2008-1219.md): SQL injection vulnerability in the Kutub-i Sitte (KutubiSitte) 1.1 module for PHP-Nuke allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2008-1220](https://cve.now/CVE-2008-1220.md): SQL injection vulnerability in the 4nChat 0.91 module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the roomid (no CVSS)
- [CVE-2008-1221](https://cve.now/CVE-2008-1221.md): Absolute path traversal vulnerability in the FTP server in MicroWorld eScan Corporate Edition 9.0.742.98 and eScan Management Console (aka e (no CVSS)
- [CVE-2008-1222](https://cve.now/CVE-2008-1222.md): Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspe (no CVSS)
- [CVE-2008-1223](https://cve.now/CVE-2008-1223.md): Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors. (no CVSS)
- [CVE-2008-1224](https://cve.now/CVE-2008-1224.md): Cross-site scripting (XSS) vulnerability in account.php in BosClassifieds Classified Ads System 3.0 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2008-1225](https://cve.now/CVE-2008-1225.md): Multiple cross-site scripting (XSS) vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authent (no CVSS)
- [CVE-2008-1226](https://cve.now/CVE-2008-1226.md): Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration Suite (ZCS) 4.0.3, 4.5.6, and possibly other versions before 4.5 (no CVSS)
- [CVE-2008-1227](https://cve.now/CVE-2008-1227.md): Stack-based buffer overflow in the silc\_fingerprint function in lib/silcutil/silcutil.c in Secure Internet Live Conferencing (SILC) Toolkit (no CVSS)
- [CVE-2008-1228](https://cve.now/CVE-2008-1228.md): Cross-site scripting (XSS) vulnerability in admin.php in MG2 (formerly Minigal) allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-1229](https://cve.now/CVE-2008-1229.md): Cross-site scripting (XSS) vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2008-1230](https://cve.now/CVE-2008-1230.md): Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via (no CVSS)
- [CVE-2008-1231](https://cve.now/CVE-2008-1231.md): Directory traversal vulnerability in Edit.jsp in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2008-1242](https://cve.now/CVE-2008-1242.md): The control panel on the Belkin F5D7230-4 router with firmware 9.01.10 maintains authentication state by IP address, which allows remote att (no CVSS)
- [CVE-2008-1243](https://cve.now/CVE-2008-1243.md): Cross-site scripting (XSS) vulnerability on the Linksys WRT300N router with firmware 2.00.20, when Mozilla Firefox or Apple Safari is used, (no CVSS)
- [CVE-2008-1244](https://cve.now/CVE-2008-1244.md): cgi-bin/setup\_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to (no CVSS)
- [CVE-2008-1245](https://cve.now/CVE-2008-1245.md): cgi-bin/setup\_virtualserver.exe on the Belkin F5D7230-4 router with firmware 9.01.10 allows remote attackers to cause a denial of service (c (no CVSS)
- [CVE-2008-1246](https://cve.now/CVE-2008-1246.md): The Cisco PIX/ASA Finesse Operation System 7.1 and 7.2 allows local users to gain privileges by entering characters at the enable prompt, er (CVSS 7.8)
- [CVE-2008-1247](https://cve.now/CVE-2008-1247.md): The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote (no CVSS)
- [CVE-2008-1248](https://cve.now/CVE-2008-1248.md): The web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers to make arbitrary phone calls via the "Call (no CVSS)
- [CVE-2008-1249](https://cve.now/CVE-2008-1249.md): snomControl.swf in the central phone server for the Snom 320 SIP Phone allows remote attackers to cause a denial of service (application cra (no CVSS)
- [CVE-2008-1250](https://cve.now/CVE-2008-1250.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface on the central phone server for the Snom 320 SIP Phone allow (no CVSS)
- [CVE-2008-1251](https://cve.now/CVE-2008-1251.md): Cross-site scripting (XSS) vulnerability in the web interface on the central phone server for the Snom 320 SIP Phone allows remote attackers (no CVSS)
- [CVE-2008-1252](https://cve.now/CVE-2008-1252.md): b\_banner.stm (aka the login page) on the Deutsche Telekom Speedport W500 DSL router allows remote attackers to obtain the logon password by (no CVSS)
- [CVE-2008-1253](https://cve.now/CVE-2008-1253.md): Cross-site scripting (XSS) vulnerability in cgi-bin/webcm on the D-Link DSL-G604T router allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-1254](https://cve.now/CVE-2008-1254.md): Multiple cross-site request forgery (CSRF) vulnerabilities on the ZyXEL P-660HW series router allow remote attackers to (1) change DNS serve (no CVSS)
- [CVE-2008-1255](https://cve.now/CVE-2008-1255.md): The ZyXEL P-660HW series router maintains authentication state by IP address, which allows remote attackers to bypass authentication by esta (no CVSS)
- [CVE-2008-1256](https://cve.now/CVE-2008-1256.md): The ZyXEL P-660HW series router has "admin" as its default password, which allows remote attackers to gain administrative access. (no CVSS)
- [CVE-2008-1257](https://cve.now/CVE-2008-1257.md): Cross-site scripting (XSS) vulnerability in Forms/DiagGeneral\_2 on the ZyXEL P-660HW series router allows remote attackers to inject arbitra (no CVSS)
- [CVE-2008-1258](https://cve.now/CVE-2008-1258.md): Cross-site scripting (XSS) vulnerability in prim.htm on the D-Link DI-604 router allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-1259](https://cve.now/CVE-2008-1259.md): The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware maintains authentication state by IP address, which allows remote attackers to bypas (no CVSS)
- [CVE-2008-1260](https://cve.now/CVE-2008-1260.md): Multiple cross-site request forgery (CSRF) vulnerabilities on the Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware allow remote attackers (no CVSS)
- [CVE-2008-1261](https://cve.now/CVE-2008-1261.md): The Zyxel P-2602HW-D1A router with 3.40(AJZ.1) firmware provides different responses to admin page requests depending on whether a user is l (no CVSS)
- [CVE-2008-1262](https://cve.now/CVE-2008-1262.md): The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which all (no CVSS)
- [CVE-2008-1263](https://cve.now/CVE-2008-1263.md): The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obt (no CVSS)
- [CVE-2008-1264](https://cve.now/CVE-2008-1264.md): The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.c (no CVSS)
- [CVE-2008-1265](https://cve.now/CVE-2008-1265.md): The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password to the FTP (no CVSS)
- [CVE-2008-1266](https://cve.now/CVE-2008-1266.md): Multiple buffer overflows in the web interface on the D-Link DI-524 router allow remote attackers to cause a denial of service (device crash (no CVSS)
- [CVE-2008-1267](https://cve.now/CVE-2008-1267.md): The Siemens SpeedStream 6520 router allows remote attackers to cause a denial of service (web interface crash) via an HTTP request to basehe (no CVSS)
- [CVE-2008-1268](https://cve.now/CVE-2008-1268.md): The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers (no CVSS)
- [CVE-2008-1269](https://cve.now/CVE-2008-1269.md): cp06\_wifi\_m\_nocifr.cgi in the admin panel on the Alice Gate 2 Plus Wi-Fi router does not verify authentication credentials, which allows rem (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-03-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.