# CVEs published 2008-03-25

27 CVEs were published on March 25, 2008: 1 critical, 0 high. Days are UTC.

- [CVE-2008-1508](https://cve.now/CVE-2008-1508.md): SQL injection vulnerability in EfesTech E-Kontör and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2008-1509](https://cve.now/CVE-2008-1509.md): SQL injection vulnerability in index.php in XLPortal 2.2.4 and earlier allows remote attackers to execute arbitrary SQL commands via the que (no CVSS)
- [CVE-2008-1510](https://cve.now/CVE-2008-1510.md): Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users\_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers (no CVSS, org.opencms:opencms-core)
- [CVE-2008-1511](https://cve.now/CVE-2008-1511.md): Multiple PHP remote file inclusion vulnerabilities in ooComments 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the P (CVSS 9.8)
- [CVE-2008-1512](https://cve.now/CVE-2008-1512.md): Directory traversal vulnerability in admin/admin\_xs.php in eXtreme Styles module (XS-Mod) 2.3.1 and 2.4.0 for phpBB allows remote attackers (no CVSS)
- [CVE-2008-1513](https://cve.now/CVE-2008-1513.md): SQL injection vulnerability in index.php in Danneo CMS 0.5.1 and earlier, when the Referers statistics option is enabled, allows remote atta (no CVSS)
- [CVE-2008-1506](https://cve.now/CVE-2008-1506.md): PEEL, possibly 3.x and earlier, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls (no CVSS)
- [CVE-2008-1507](https://cve.now/CVE-2008-1507.md): PEEL, possibly 3.x and earlier, has (1) a default info@peel.fr account with password admin, and (2) a default contact@peel.fr account with p (no CVSS)
- [CVE-2008-1490](https://cve.now/CVE-2008-1490.md): Buffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0, as used with Piczo (aka Pizco) and possibly other onlin (no CVSS)
- [CVE-2008-1491](https://cve.now/CVE-2008-1491.md): Stack-based buffer overflow in the DPC Proxy server (DpcProxy.exe) in ASUS Remote Console (aka ARC or ASMB3) 2.0.0.19 and 2.0.0.24 allows re (no CVSS)
- [CVE-2008-1492](https://cve.now/CVE-2008-1492.md): Multiple directory traversal vulnerabilities in CoronaMatrix phpAddressBook 2.11 allow remote attackers to include and execute arbitrary loc (no CVSS)
- [CVE-2008-1493](https://cve.now/CVE-2008-1493.md): Directory traversal vulnerability in login.php in Cuteflow Bin 1.5.0 allows remote attackers to include and execute arbitrary local files vi (no CVSS)
- [CVE-2008-1494](https://cve.now/CVE-2008-1494.md): SQL injection vulnerability in inc/module/online.php in Easy-Clanpage 2.2 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-1495](https://cve.now/CVE-2008-1495.md): Unrestricted file upload vulnerability in administrer/produits.php in PEEL, possibly 3.x and earlier, allows remote authenticated administra (no CVSS)
- [CVE-2008-1496](https://cve.now/CVE-2008-1496.md): Multiple SQL injection vulnerabilities in PEEL, possibly 3.x and earlier, allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2008-1497](https://cve.now/CVE-2008-1497.md): Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2008-1498](https://cve.now/CVE-2008-1498.md): Stack-based buffer overflow in the IMAP service in NetWin Surgemail 3.8k4-4 and earlier allows remote authenticated users to execute arbitra (no CVSS)
- [CVE-2008-1499](https://cve.now/CVE-2008-1499.md): Cross-site scripting (XSS) vulnerability in frontend/x/manpage.html in cPanel 11.18.3 and 11.21.0-BETA allows remote attackers to inject arb (no CVSS)
- [CVE-2008-1500](https://cve.now/CVE-2008-1500.md): Cross-site scripting (XSS) vulnerability in index.php in TinyPortal 0.8.6 and 1.0.3 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2008-1501](https://cve.now/CVE-2008-1501.md): The send\_user\_mode function in s\_user.c in (1) Undernet ircu 2.10.12.12 and earlier, (2) snircd 1.3.4 and earlier, and unspecified other irc (no CVSS)
- [CVE-2008-1502](https://cve.now/CVE-2008-1502.md): The \_bad\_protocol\_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and o (no CVSS, moodle/moodle)
- [CVE-2008-1503](https://cve.now/CVE-2008-1503.md): Cross-site scripting (XSS) vulnerability in the web management interface in F5 BIG-IP 9.4.3 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-1504](https://cve.now/CVE-2008-1504.md): Cross-site scripting (XSS) vulnerability in setup.php3 in phpHeaven phpMyChat 0.14.5 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-1505](https://cve.now/CVE-2008-1505.md): PHP remote file inclusion vulnerability in the SSTREAMTV custompages (com\_custompages) 1.1 and earlier component for Joomla! allows remote a (no CVSS)
- [CVE-2008-1092](https://cve.now/CVE-2008-1092.md): Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a cr (no CVSS)
- [CVE-2008-1160](https://cve.now/CVE-2008-1160.md): ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows re (no CVSS)
- [CVE-2008-1489](https://cve.now/CVE-2008-1489.md): Integer overflow in the MP4\_ReadBox\_rdrf function in libmp4.c for VLC 0.8.6e allows remote attackers to cause a denial of service (crash) an (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-03-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.