# CVEs published 2008-03-24

42 CVEs were published on March 24, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6711](https://cve.now/CVE-2007-6711.md): Unspecified vulnerability in customer.php in FreeWebshop.org 2.2.5, 2.2.6 and 2.2.7WIP1/2 allows remote attackers to gain administrator priv (no CVSS)
- [CVE-2008-1483](https://cve.now/CVE-2008-1483.md): OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even (no CVSS)
- [CVE-2008-1484](https://cve.now/CVE-2008-1484.md): The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authent (no CVSS)
- [CVE-2008-1485](https://cve.now/CVE-2008-1485.md): Cross-site scripting (XSS) vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2008-1486](https://cve.now/CVE-2008-1486.md): SQL injection vulnerability in Phorum before 5.2.6, when mysql\_use\_ft is disabled, allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-1487](https://cve.now/CVE-2008-1487.md): Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.3 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-1488](https://cve.now/CVE-2008-1488.md): Stack-based buffer overflow in apc.c in Alternative PHP Cache (APC) 3.0.11 through 3.0.16 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-0073](https://cve.now/CVE-2008-0073.md): Array index error in the sdpplin\_parse function in input/libreal/sdpplin.c in xine-lib 1.1.10.1 allows remote RTSP servers to execute arbitr (no CVSS)
- [CVE-2008-0125](https://cve.now/CVE-2008-0125.md): Cross-site scripting (XSS) vulnerability in phpstats.php in Michael Wagner phpstats 0.1 alpha allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-0951](https://cve.now/CVE-2008-0951.md): Microsoft Windows Vista does not properly enforce the NoDriveTypeAutoRun registry value, which allows user-assisted remote attackers, and po (no CVSS)
- [CVE-2008-1470](https://cve.now/CVE-2008-1470.md): Incomplete blacklist vulnerability in IISWebAgentIF.dll in the WebID RSA Authentication Agent 5.3, and possibly earlier, allows remote attac (no CVSS)
- [CVE-2008-1471](https://cve.now/CVE-2008-1471.md): The cpoint.sys driver in Panda Internet Security 2008 and Antivirus+ Firewall 2008 allows local users to cause a denial of service (system c (no CVSS)
- [CVE-2008-1472](https://cve.now/CVE-2008-1472.md): Stack-based buffer overflow in the ListCtrl ActiveX Control (ListCtrl.ocx), as used in multiple CA products including BrightStor ARCserve Ba (no CVSS)
- [CVE-2008-1473](https://cve.now/CVE-2008-1473.md): The Altiris Client Service (AClient.exe) in Symantec Altiris Deployment Solution 6.8.x before 6.9.164 allows local users to gain privileges (no CVSS)
- [CVE-2008-1474](https://cve.now/CVE-2008-1474.md): Multiple unspecified vulnerabilities in Roundup before 1.4.4 have unknown impact and attack vectors, some of which may be related to cross-s (no CVSS, roundup)
- [CVE-2008-1475](https://cve.now/CVE-2008-1475.md): The xml-rpc server in Roundup 1.4.4 does not check property permissions, which allows attackers to bypass restrictions and edit or read rest (no CVSS, roundup)
- [CVE-2008-1476](https://cve.now/CVE-2008-1476.md): Cross-site scripting (XSS) vulnerability in Serendipity (S9Y) before 1.3 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-1477](https://cve.now/CVE-2008-1477.md): Multiple cross-site scripting (XSS) vulnerabilities in busca.php in eForum 0.4 allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-1478](https://cve.now/CVE-2008-1478.md): Home FTP Server 1.4.5.89 allows remote attackers to cause a denial of service (crash) by opening a FTP passive mode connection, then closing (no CVSS)
- [CVE-2008-1479](https://cve.now/CVE-2008-1479.md): Cross-site scripting (XSS) vulnerability in index.php in cyberfrogs.net cfnetgs 0.24 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-1480](https://cve.now/CVE-2008-1480.md): rpc.metad in Sun Solaris 10 allows remote attackers to cause a denial of service (daemon crash) via a malformed RPC request. (no CVSS)
- [CVE-2008-1481](https://cve.now/CVE-2008-1481.md): Cross-site scripting (XSS) vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2008-1482](https://cve.now/CVE-2008-1482.md): Multiple integer overflows in xine-lib 1.1.11 and earlier allow remote attackers to trigger heap-based buffer overflows and possibly execute (no CVSS)
- [CVE-2008-1462](https://cve.now/CVE-2008-1462.md): SQL injection vulnerability in the sections (Section) module in RunCMS allows remote attackers to execute arbitrary SQL commands via the art (no CVSS)
- [CVE-2008-1463](https://cve.now/CVE-2008-1463.md): Cross-site scripting (XSS) vulnerability in the management GUI in Imperva SecureSphere MX Management Server 5.0 allows remote attackers to i (no CVSS)
- [CVE-2008-1464](https://cve.now/CVE-2008-1464.md): Multiple SQL injection vulnerabilities in Gallarific Free Edition 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) q (no CVSS)
- [CVE-2008-1465](https://cve.now/CVE-2008-1465.md): SQL injection vulnerability in the Detodas Restaurante (com\_restaurante) 1.0 component for Mambo and Joomla! allows remote attackers to exec (no CVSS)
- [CVE-2008-1466](https://cve.now/CVE-2008-1466.md): Multiple PHP remote file inclusion vulnerabilities in W-Agora 4.0 allow remote attackers to execute arbitrary PHP code via a URL in the bn\_d (no CVSS)
- [CVE-2008-1467](https://cve.now/CVE-2008-1467.md): CenterIM 4.22.3 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URI, related t (no CVSS)
- [CVE-2008-1468](https://cve.now/CVE-2008-1468.md): Cross-site scripting (XSS) vulnerability in namazu.cgi in Namazu before 2.0.18 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-1469](https://cve.now/CVE-2008-1469.md): Gallarific Free Edition 1.1 does not require authentication for (1) photos.php, (2) comments.php, and (3) gallery.php in gadmin/, which allo (no CVSS)
- [CVE-2008-1458](https://cve.now/CVE-2008-1458.md): Cross-site scripting (XSS) vulnerability in index.php in CS-Cart 1.3.2 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2008-1459](https://cve.now/CVE-2008-1459.md): SQL injection vulnerability in the Alberghi (com\_alberghi) 2.1.3 and earlier component for Mambo and Joomla! allows remote attackers to exec (no CVSS)
- [CVE-2008-1460](https://cve.now/CVE-2008-1460.md): SQL injection vulnerability in the Joovideo (com\_joovideo) 1.0 and 1.2.2 component for Mambo and Joomla! allows remote attackers to execute (no CVSS)
- [CVE-2008-1461](https://cve.now/CVE-2008-1461.md): Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long filename argument on the command (no CVSS)
- [CVE-2008-1201](https://cve.now/CVE-2008-1201.md): Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows (no CVSS)
- [CVE-2008-1289](https://cve.now/CVE-2008-1289.md): Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Editi (no CVSS)
- [CVE-2008-1290](https://cve.now/CVE-2008-1290.md): ViewVC before 1.0.5 includes "all-forbidden" files within search results that list CVS or Subversion (SVN) commits, which allows remote atta (no CVSS)
- [CVE-2008-1291](https://cve.now/CVE-2008-1291.md): ViewVC before 1.0.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read (no CVSS)
- [CVE-2008-1292](https://cve.now/CVE-2008-1292.md): ViewVC before 1.0.5 provides revision metadata without properly checking whether access was intended, which allows remote attackers to obtai (no CVSS)
- [CVE-2008-1390](https://cve.now/CVE-2008-1390.md): The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1. (no CVSS)
- [CVE-2005-4873](https://cve.now/CVE-2005-4873.md): Multiple stack-based buffer overflows in the phpcups PHP module for CUPS 1.1.23rc1 might allow context-dependent attackers to execute arbitr (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-03-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.