# CVEs published 2008-04-17 30 CVEs were published on April 17, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-1881](https://cve.now/CVE-2008-1881.md): Stack-based buffer overflow in the ParseSSA function (modules/demux/subtitle.c) in VLC 0.8.6e allows remote attackers to execute arbitrary c (no CVSS) - [CVE-2007-6714](https://cve.now/CVE-2007-6714.md): DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers (no CVSS) - [CVE-2007-6715](https://cve.now/CVE-2007-6715.md): Mozilla Firefox allows remote attackers to cause a denial of service (crash) via crafted image, as demonstrated by the zzuf lol-firefox.gif (no CVSS) - [CVE-2008-1878](https://cve.now/CVE-2008-1878.md): Stack-based buffer overflow in the demux\_nsf\_send\_chunk function in src/demuxers/demux\_nsf.c in xine-lib 1.1.12 and earlier allows remote at (no CVSS) - [CVE-2008-1877](https://cve.now/CVE-2008-1877.md): tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges. (no CVSS) - [CVE-2007-5745](https://cve.now/CVE-2007-5745.md): Multiple heap-based buffer overflows in OpenOffice.org before 2.4 allow remote attackers to cause a denial of service (crash) and possibly e (no CVSS) - [CVE-2007-5746](https://cve.now/CVE-2007-5746.md): Integer overflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary co (no CVSS) - [CVE-2007-5747](https://cve.now/CVE-2007-5747.md): Integer underflow in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c (no CVSS) - [CVE-2008-0320](https://cve.now/CVE-2008-0320.md): Heap-based buffer overflow in the OLE importer in OpenOffice.org before 2.4 allows remote attackers to cause a denial of service (crash) and (no CVSS) - [CVE-2008-1024](https://cve.now/CVE-2008-1024.md): Apple Safari before 3.1.1, when running on Windows XP or Vista, allows remote attackers to cause a denial of service (crash) and possibly ex (no CVSS) - [CVE-2008-1025](https://cve.now/CVE-2008-1025.md): Cross-site scripting (XSS) vulnerability in Apple WebKit, as used in Safari before 3.1.1, allows remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2008-1026](https://cve.now/CVE-2008-1026.md): Integer overflow in the PCRE regular expression compiler (JavaScriptCore/pcre/pcre\_compile.cpp) in Apple WebKit, as used in Safari before 3. (no CVSS) - [CVE-2008-1380](https://cve.now/CVE-2008-1380.md): The JavaScript engine in Mozilla Firefox before 2.0.0.14, Thunderbird before 2.0.0.14, and SeaMonkey before 1.1.10 allows remote attackers t (no CVSS) - [CVE-2008-1863](https://cve.now/CVE-2008-1863.md): SQL injection vulnerability in view\_reviews.php in Prozilla Cheat Script (aka Cheats) 2.0 allows remote attackers to execute arbitrary SQL c (no CVSS) - [CVE-2008-1864](https://cve.now/CVE-2008-1864.md): SQL injection vulnerability in project.php in Prozilla Freelancers allows remote attackers to execute arbitrary SQL commands via the project (no CVSS) - [CVE-2008-1865](https://cve.now/CVE-2008-1865.md): Stack-based buffer overflow in the msx\_readnode function in libmosix.c in openmosix-tools (aka userspace-tools) in openMosix might allow loc (no CVSS) - [CVE-2008-1866](https://cve.now/CVE-2008-1866.md): admin/modif\_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users (no CVSS) - [CVE-2008-1867](https://cve.now/CVE-2008-1867.md): SQL injection vulnerability in Blog Pixel Motion (aka Blog PixelMotion) allows remote attackers to execute arbitrary SQL commands via the ca (no CVSS) - [CVE-2008-1868](https://cve.now/CVE-2008-1868.md): admin/sauvBase.php in Blog Pixel Motion (aka Blog PixelMotion) does not require authentication, which allows remote attackers to trigger a d (no CVSS) - [CVE-2008-1869](https://cve.now/CVE-2008-1869.md): SQL injection vulnerability in Site Sift Listings allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail (no CVSS) - [CVE-2008-1870](https://cve.now/CVE-2008-1870.md): SQL injection vulnerability in getdata.php in PIGMy-SQL 1.4.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2008-1871](https://cve.now/CVE-2008-1871.md): SQL injection vulnerability in links.php in Scriptsagent.com Links Directory 1.1 allows remote authenticated users to execute arbitrary SQL (no CVSS) - [CVE-2008-1872](https://cve.now/CVE-2008-1872.md): SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary SQL commands via th (no CVSS) - [CVE-2008-1873](https://cve.now/CVE-2008-1873.md): Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote (no CVSS) - [CVE-2008-1874](https://cve.now/CVE-2008-1874.md): SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary S (no CVSS) - [CVE-2008-1875](https://cve.now/CVE-2008-1875.md): SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote attackers to execute (no CVSS) - [CVE-2008-1876](https://cve.now/CVE-2008-1876.md): PHP remote file inclusion vulnerability in index.php in VisualPic 0.3.1 allows remote attackers to execute arbitrary PHP code via a URL in t (no CVSS) - [CVE-2008-1860](https://cve.now/CVE-2008-1860.md): Static code injection vulnerability in admin.php in LokiCMS 0.3.3 and earlier allows remote attackers to inject arbitrary PHP code into incl (no CVSS) - [CVE-2008-1861](https://cve.now/CVE-2008-1861.md): Directory traversal vulnerability in modules/threadstop/threadstop.php in ExBB Italia 0.22 and earlier, when register\_globals is enabled and (no CVSS) - [CVE-2008-1862](https://cve.now/CVE-2008-1862.md): ExBB Italia 0.22 and earlier only checks GET requests that use the QUERY\_STRING for certain path manipulations, which allows remote attacker (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-04-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.