# CVEs published 2008-04-02

40 CVEs were published on April 2, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-1331](https://cve.now/CVE-2008-1331.md): cgi-data/FastJSData.cgi in OmniPCX Office with Internet Access services OXO210 before 210/091.001, OXO600 before 610/014.001, and other vers (no CVSS)
- [CVE-2008-1654](https://cve.now/CVE-2008-1654.md): Interaction error between Adobe Flash and multiple Universal Plug and Play (UPnP) services allow remote attackers to perform Cross-Site Requ (no CVSS)
- [CVE-2008-1657](https://cve.now/CVE-2008-1657.md): OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd\_config ForceCommand directive by modifying the .s (no CVSS)
- [CVE-2008-0069](https://cve.now/CVE-2008-0069.md): Stack-based buffer overflow in XnView 1.92 and 1.92.1 allows user-assisted remote attackers to execute arbitrary code via a long FontName pa (no CVSS)
- [CVE-2008-1620](https://cve.now/CVE-2008-1620.md): Directory traversal vulnerability in 2X TFTP service (TFTPd.exe) 3.2.0.0 and earlier in 2X ThinClientServer 5.0\_sp1-r3497 and earlier allows (no CVSS)
- [CVE-2008-1621](https://cve.now/CVE-2008-1621.md): Multiple cross-site scripting (XSS) vulnerabilities in GeeCarts allow remote attackers to inject arbitrary web script or HTML via the id par (no CVSS)
- [CVE-2008-1622](https://cve.now/CVE-2008-1622.md): Multiple PHP remote file inclusion vulnerabilities in GeeCarts allow remote attackers to execute arbitrary PHP code via a URL in the id para (no CVSS)
- [CVE-2008-1623](https://cve.now/CVE-2008-1623.md): SQL injection vulnerability in admin\_view\_image.php in Smoothflash allows remote attackers to execute arbitrary SQL commands via the cid par (no CVSS)
- [CVE-2008-1624](https://cve.now/CVE-2008-1624.md): Directory traversal vulnerability in v2demo/page.php in Jshop Server 1.x through 2.x allows remote attackers to include and execute arbitrar (no CVSS)
- [CVE-2008-1625](https://cve.now/CVE-2008-1625.md): aavmker4.sys in avast! Home and Professional 4.7 for Windows does not properly validate input to IOCTL 0xb2d60030, which allows local users (no CVSS)
- [CVE-2008-1626](https://cve.now/CVE-2008-1626.md): SQL injection vulnerability in eggBlog before 4.0.1 allows remote attackers to execute arbitrary SQL commands via an unspecified cookie. (no CVSS)
- [CVE-2008-1627](https://cve.now/CVE-2008-1627.md): CDS Invenio 0.92.1 and earlier allows remote authenticated users to delete email notification alerts of arbitrary users via a modified inter (no CVSS)
- [CVE-2008-1628](https://cve.now/CVE-2008-1628.md): Stack-based buffer overflow in the audit\_log\_user\_command function in lib/audit\_logging.c in Linux Audit before 1.7 might allow remote attac (no CVSS)
- [CVE-2008-1629](https://cve.now/CVE-2008-1629.md): Cross-site scripting (XSS) vulnerability in PHPkrm before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecifi (no CVSS)
- [CVE-2008-1630](https://cve.now/CVE-2008-1630.md): Multiple cross-site scripting (XSS) vulnerabilities in CuteFlow 1.5.0 and 2.10.0 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-1631](https://cve.now/CVE-2008-1631.md): SQL injection vulnerability in login.php in CuteFlow 1.5.0 and 2.10.0 allows remote attackers to execute arbitrary SQL commands via the User (no CVSS)
- [CVE-2008-1632](https://cve.now/CVE-2008-1632.md): Multiple SQL injection vulnerabilities in CuteFlow 2.10.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) lis (no CVSS)
- [CVE-2008-1633](https://cve.now/CVE-2008-1633.md): Unspecified vulnerability in Mondo Rescue before 2.2.5 has unknown impact and attack vectors, related to the use of (1) /tmp and (2) MINDI\_C (no CVSS)
- [CVE-2008-1634](https://cve.now/CVE-2008-1634.md): Cross-site scripting (XSS) vulnerability in index.php in JV2 Folder Gallery 3.1 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-1635](https://cve.now/CVE-2008-1635.md): Directory traversal vulnerability in view\_private.php in Keep It Simple Guest Book (KISGB) 5.0.0 and earlier allows remote attackers to incl (no CVSS)
- [CVE-2008-1636](https://cve.now/CVE-2008-1636.md): Cross-site scripting (XSS) vulnerability in index.php in JV2 Quick Gallery 1.1 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-1637](https://cve.now/CVE-2008-1637.md): PowerDNS Recursor before 3.1.5 uses insufficient randomness to calculate (1) TRXID values and (2) UDP source port numbers, which makes it ea (no CVSS)
- [CVE-2008-1638](https://cve.now/CVE-2008-1638.md): Nik Sharpener Pro, possibly 2.0, uses world-writable permissions for plug-in files, which allows local users to gain privileges by replacing (no CVSS)
- [CVE-2008-1639](https://cve.now/CVE-2008-1639.md): SQL injection vulnerability in index.php in Neat weblog 0.2 allows remote attackers to execute arbitrary SQL commands via the articleId para (no CVSS)
- [CVE-2008-1640](https://cve.now/CVE-2008-1640.md): SQL injection vulnerability in jgs\_treffen.php in the JGS-XA JGS-Treffen 2.0.2 and earlier addon for Woltlab Burning Board (wBB) allows remo (no CVSS)
- [CVE-2008-1641](https://cve.now/CVE-2008-1641.md): SQL injection vulnerability in default.asp in EfesTECH Video 5.0 allows remote attackers to execute arbitrary SQL commands via the catID par (no CVSS)
- [CVE-2008-1642](https://cve.now/CVE-2008-1642.md): Directory traversal vulnerability in index.php in Sava's GuestBook 2.0 allows remote attackers to include and execute arbitrary local files (no CVSS)
- [CVE-2008-1643](https://cve.now/CVE-2008-1643.md): Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.7 SP5 and earlier and 8.8 allo (no CVSS)
- [CVE-2008-1644](https://cve.now/CVE-2008-1644.md): SQL injection vulnerability in viewlinks.php in Sava's Link Manager 2.0 allows remote attackers to execute arbitrary SQL commands via the ca (no CVSS)
- [CVE-2008-1645](https://cve.now/CVE-2008-1645.md): Directory traversal vulnerability in body.php in phpSpamManager (phpSM) 0.53 beta allows remote attackers to read arbitrary local files via (no CVSS)
- [CVE-2008-1646](https://cve.now/CVE-2008-1646.md): SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-1647](https://cve.now/CVE-2008-1647.md): The ChilkatHttp.ChilkatHttp.1 and ChilkatHttp.ChilkatHttpRequest.1 ActiveX controls in ChilkatHttp.dll 2.4.0.0, 2.3.0.0, and earlier in Chil (no CVSS)
- [CVE-2008-1648](https://cve.now/CVE-2008-1648.md): Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Con (no CVSS)
- [CVE-2008-1649](https://cve.now/CVE-2008-1649.md): Cross-site scripting (XSS) vulnerability in staticpages/easypublish/index.php in EasyNews 4.0 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-1650](https://cve.now/CVE-2008-1650.md): SQL injection vulnerability in dynamicpages/index.php in EasyNews 4.0 allows remote attackers to execute arbitrary SQL commands via the read (no CVSS)
- [CVE-2008-1651](https://cve.now/CVE-2008-1651.md): Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbitrary local files vi (no CVSS)
- [CVE-2008-1652](https://cve.now/CVE-2008-1652.md): Directory traversal vulnerability in the \_serve\_request\_multiple function in lib/Perlbal/ClientHTTPBase.pm in Perlbal before 1.70, when conc (no CVSS)
- [CVE-2008-1653](https://cve.now/CVE-2008-1653.md): Directory traversal vulnerability in index.php in Sava's Link Manager 2.0 allows remote attackers to include and execute arbitrary local fil (no CVSS)
- [CVE-2008-1614](https://cve.now/CVE-2008-1614.md): suPHP before 0.6.3 allows local users to gain privileges via (1) a race condition that involves multiple symlink changes to point a file own (no CVSS)
- [CVE-2008-1619](https://cve.now/CVE-2008-1619.md): The ssm\_i emulation in Xen 5.1 on IA64 architectures allows attackers to cause a denial of service (dom0 panic) via certain traffic, as demo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.