# CVEs published 2008-03-20

47 CVEs were published on March 20, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-1425](https://cve.now/CVE-2008-1425.md): SQL injection vulnerability in index.php in the gallery module in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-1426](https://cve.now/CVE-2008-1426.md): SQL injection vulnerability in album.asp in KAPhotoservice allows remote attackers to execute arbitrary SQL commands via the albumid paramet (no CVSS)
- [CVE-2008-1427](https://cve.now/CVE-2008-1427.md): SQL injection vulnerability in the Joobi Acajoom (com\_acajoom) 1.1.5 and 1.2.5 component for Joomla! allows remote attackers to execute arbi (no CVSS)
- [CVE-2008-1428](https://cve.now/CVE-2008-1428.md): Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-beta7 module for Drupal allow remote attackers to inj (no CVSS)
- [CVE-2008-1429](https://cve.now/CVE-2008-1429.md): Secure Internet Live Conferencing (SILC) Server before 1.1.1 allows remote attackers to cause a denial of service (daemon crash) via a NEW\_C (no CVSS)
- [CVE-2008-1430](https://cve.now/CVE-2008-1430.md): SQL injection vulnerability in links.asp in ASPapp allows remote attackers to execute arbitrary SQL commands via the CatId parameter. (no CVSS)
- [CVE-2008-1431](https://cve.now/CVE-2008-1431.md): RaidSonic NAS-4220-B with 2.6.0-n(2007-10-11) firmware stores a partition encryption key in an unencrypted /system/.crypt file with base64 e (no CVSS)
- [CVE-2008-1432](https://cve.now/CVE-2008-1432.md): Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine SupportCenter Plus 7.0.0 allows remote attackers to inject arb (no CVSS)
- [CVE-2008-1417](https://cve.now/CVE-2008-1417.md): The prerm script in axyl 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the axyl.conf temporary file. (no CVSS)
- [CVE-2008-1012](https://cve.now/CVE-2008-1012.md): Unspecified vulnerability in Apple AirPort Extreme Base Station Firmware 7.3.1 allows remote attackers to cause a denial of service (file sh (no CVSS)
- [CVE-2008-1398](https://cve.now/CVE-2008-1398.md): SQL injection vulnerability in online.php in AuraCMS 2.0 through 2.2.1 allows remote attackers to execute arbitrary SQL commands via the X-F (no CVSS)
- [CVE-2008-1399](https://cve.now/CVE-2008-1399.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Clansphere 2008 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-1400](https://cve.now/CVE-2008-1400.md): Directory traversal vulnerability in the Net Inspector HTTP Server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allo (no CVSS)
- [CVE-2008-1401](https://cve.now/CVE-2008-1401.md): Format string vulnerability in the Net Inspector HTTP server (mghttpd) in MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows rem (no CVSS)
- [CVE-2008-1402](https://cve.now/CVE-2008-1402.md): MG-SOFT Net Inspector 6.5.0.828 and earlier for Windows allows remote attackers to cause a (1) denial of service (exception and crash) via a (no CVSS)
- [CVE-2008-1403](https://cve.now/CVE-2008-1403.md): Stack-based buffer overflow in the TFTP server in BootManage TFTPD 1.99 and earlier in BootManage Administrator 7.1 and earlier allows remot (no CVSS)
- [CVE-2008-1404](https://cve.now/CVE-2008-1404.md): SQL injection vulnerability in index.php in the Viso (Industry Book) 2.04 and 2.03 module for eXV2 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2008-1405](https://cve.now/CVE-2008-1405.md): PHP remote file inclusion vulnerability in code/display.php in fuzzylime (cms) 3.01 allows remote attackers to execute arbitrary PHP code vi (no CVSS)
- [CVE-2008-1406](https://cve.now/CVE-2008-1406.md): SQL injection vulnerability in annonces-p-f.php in the MyAnnonces 1.8 module for eXV2 allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2008-1407](https://cve.now/CVE-2008-1407.md): SQL injection vulnerability in index.php in the WebChat 1.60 module for eXV2 allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-1408](https://cve.now/CVE-2008-1408.md): SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 (2.204) FIX 4 allows remote attackers to execute arbit (no CVSS)
- [CVE-2008-1409](https://cve.now/CVE-2008-1409.md): Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary (no CVSS)
- [CVE-2008-1410](https://cve.now/CVE-2008-1410.md): Directory traversal vulnerability in the PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to re (no CVSS)
- [CVE-2008-1411](https://cve.now/CVE-2008-1411.md): The PXE Server (pxesrv.exe) in Acronis Snap Deploy 2.0.0.1076 and earlier allows remote attackers to cause a denial of service (crash) via a (no CVSS)
- [CVE-2008-1412](https://cve.now/CVE-2008-1412.md): Unspecified vulnerability in multiple F-Secure anti-virus products, including Internet Security 2006 through 2008, Anti-Virus 2006 through 2 (no CVSS)
- [CVE-2008-1413](https://cve.now/CVE-2008-1413.md): Cross-site scripting (XSS) vulnerability in search.php in SNewsCMS Rus 2.1 through 2.4 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-1414](https://cve.now/CVE-2008-1414.md): Cross-site scripting (XSS) vulnerability in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-1415](https://cve.now/CVE-2008-1415.md): Directory traversal vulnerability in index.php in Multiple Time Sheets (MTS) 5.0 and earlier allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2008-1416](https://cve.now/CVE-2008-1416.md): Multiple PHP remote file inclusion vulnerabilities in PHPauction GPL 2.51 allow remote attackers to execute arbitrary PHP code via a URL in (no CVSS)
- [CVE-2007-4592](https://cve.now/CVE-2007-4592.md): Multiple cross-site scripting (XSS) vulnerabilities in the web interface for IBM Rational ClearQuest before 2003.06.16 Patch 2008A, 7.0.0.2\_ (no CVSS)
- [CVE-2007-6254](https://cve.now/CVE-2007-6254.md): Stack-based buffer overflow in the SAP Business Objects BusinessObjects RptViewerAX ActiveX control in RptViewerAX.dll in Business Objects 6 (no CVSS)
- [CVE-2008-0164](https://cve.now/CVE-2008-0164.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts (no CVSS, plone)
- [CVE-2008-0707](https://cve.now/CVE-2008-0707.md): HP StorageWorks Library and Tape Tools (LTT) before 4.5 SR1 on HP-UX B.11.11 and B.11.23 allows local users to gain privileges via unspecifi (no CVSS)
- [CVE-2008-0889](https://cve.now/CVE-2008-0889.md): Red Hat Directory Server 8.0, when running on Red Hat Enterprise Linux, uses insecure permissions for the redhat-idm-console script, which a (no CVSS)
- [CVE-2008-1332](https://cve.now/CVE-2008-1332.md): Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x b (no CVSS)
- [CVE-2008-1333](https://cve.now/CVE-2008-1333.md): Format string vulnerability in Asterisk Open Source 1.6.x before 1.6.0-beta6 might allow remote attackers to execute arbitrary code via logg (no CVSS)
- [CVE-2008-1340](https://cve.now/CVE-2008-1340.md): Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.0.x before 6.0.3, VMware Player 2.0.x before 2.0.3, and VMware ACE 2. (no CVSS)
- [CVE-2008-1361](https://cve.now/CVE-2008-1361.md): VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x befo (no CVSS)
- [CVE-2008-1362](https://cve.now/CVE-2008-1362.md): VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x befo (no CVSS)
- [CVE-2008-1363](https://cve.now/CVE-2008-1363.md): VMware Workstation 6.0.x before 6.0.3 and 5.5.x before 5.5.6, VMware Player 2.0.x before 2.0.3 and 1.0.x before 1.0.6, VMware ACE 2.0.x befo (no CVSS)
- [CVE-2008-1364](https://cve.now/CVE-2008-1364.md): Unspecified vulnerability in the DHCP service in VMware Workstation 5.5.x before 5.5.6, VMware Player 1.0.x before 1.0.6, VMware ACE 1.0.x b (no CVSS)
- [CVE-2008-1392](https://cve.now/CVE-2008-1392.md): The default configuration of VMware Workstation 6.0.2, VMware Player 2.0.x before 2.0.3, and VMware ACE 2.0.x before 2.0.1 makes the console (no CVSS)
- [CVE-2008-1393](https://cve.now/CVE-2008-1393.md): Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the \_\_ac cookie for the admin (no CVSS, plone)
- [CVE-2008-1394](https://cve.now/CVE-2008-1394.md): Plone CMS before 3 places a base64 encoded form of the username and password in the \_\_ac cookie for all user accounts, which makes it easier (no CVSS, plone)
- [CVE-2008-1395](https://cve.now/CVE-2008-1395.md): Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier f (no CVSS)
- [CVE-2008-1396](https://cve.now/CVE-2008-1396.md): Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, (no CVSS, plone)
- [CVE-2008-1397](https://cve.now/CVE-2008-1397.md): Check Point VPN-1 Power/UTM, with NGX R60 through R65 and NG AI R55 software, allows remote authenticated users to cause a denial of service (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.