# CVEs published 2008-04-27 29 CVEs were published on April 27, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-1985](https://cve.now/CVE-2008-1985.md): Cross-site scripting (XSS) vulnerability in base.php in DigitalHive 2.0 RC2 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2008-1986](https://cve.now/CVE-2008-1986.md): Cross-site scripting (XSS) vulnerability in liste\_article.php in Blog Pixel Motion (aka PixelMotion) allows remote attackers to inject arbit (no CVSS) - [CVE-2008-1987](https://cve.now/CVE-2008-1987.md): Cross-site scripting (XSS) vulnerability in search.php in EncapsGallery 2.0.2 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2008-1988](https://cve.now/CVE-2008-1988.md): Unrestricted file upload vulnerability in the file\_upload function in core/misc.class.php in EncapsGallery 2.0.2 allows remote authenticated (no CVSS) - [CVE-2008-1989](https://cve.now/CVE-2008-1989.md): PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register\_globals is enabled, a (no CVSS) - [CVE-2008-1990](https://cve.now/CVE-2008-1990.md): Multiple SQL injection vulnerabilities in Acidcat CMS 3.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) cID paramet (no CVSS) - [CVE-2008-1991](https://cve.now/CVE-2008-1991.md): Cross-site scripting (XSS) vulnerability in admin\_colors\_swatch.asp in Acidcat CMS 3.4.1 allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2008-1992](https://cve.now/CVE-2008-1992.md): Acidcat CMS 3.4.1 does not properly restrict access to (1) default\_mail\_aspemail.asp, (2) default\_mail\_cdosys.asp or (3) default\_mail\_jmail. (no CVSS) - [CVE-2008-1993](https://cve.now/CVE-2008-1993.md): Acidcat CMS 3.4.1 does not restrict access to the FCKEditor component, which allows remote attackers to upload arbitrary files. (no CVSS) - [CVE-2008-1994](https://cve.now/CVE-2008-1994.md): Multiple stack-based buffer overflows in (a) acon.c, (b) menu.c, and (c) child.c in Acon 1.0.5-5 through 1.0.5-7 allow local users to execut (no CVSS) - [CVE-2008-1976](https://cve.now/CVE-2008-1976.md): Multiple cross-site scripting (XSS) vulnerabilities in the Drupal modules (1) Internationalization (i18n) 5.x before 5.x-2.3 and 5.x-1.1 and (no CVSS) - [CVE-2008-1977](https://cve.now/CVE-2008-1977.md): Cross-site request forgery (CSRF) vulnerability in the Internationalization (i18n) Drupal module 5.x before 5.x-2.3 and 5.x-1.1, and 6.x bef (no CVSS) - [CVE-2008-1978](https://cve.now/CVE-2008-1978.md): Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to injec (no CVSS) - [CVE-2008-1979](https://cve.now/CVE-2008-1979.md): The Discovery Service (casdscvc) in CA ARCserve Backup 12.0.5454.0 and earlier allows remote attackers to cause a denial of service (crash) (no CVSS) - [CVE-2008-1980](https://cve.now/CVE-2008-1980.md): Cross-site scripting (XSS) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attack (no CVSS) - [CVE-2008-1981](https://cve.now/CVE-2008-1981.md): Cross-site request forgery (CSRF) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote (no CVSS) - [CVE-2008-1982](https://cve.now/CVE-2008-1982.md): SQL injection vulnerability in ss\_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute (no CVSS) - [CVE-2008-1983](https://cve.now/CVE-2008-1983.md): Cross-site scripting (XSS) vulnerability in Advanced Electron Forum (AEF) 1.0.6 allows remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2008-1984](https://cve.now/CVE-2008-1984.md): The eTrust Common Services (Transport) Daemon (eCSqdmn) in CA Secure Content Manager 8.0.28000.511 and earlier allows remote attackers to ca (no CVSS) - [CVE-2008-1974](https://cve.now/CVE-2008-1974.md): Cross-site scripting (XSS) vulnerability in addevent.php in Horde Kronolith 2.1.7, Groupware Webmail Edition 1.0.6, and Groupware 1.0.5 allo (no CVSS) - [CVE-2008-1975](https://cve.now/CVE-2008-1975.md): SQL injection vulnerability in index.php in E-RESERV 2.1 allows remote attackers to execute arbitrary SQL commands via the ID\_loc parameter. (no CVSS) - [CVE-2008-1966](https://cve.now/CVE-2008-1966.md): Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, an (no CVSS) - [CVE-2008-1967](https://cve.now/CVE-2008-1967.md): Cross-site scripting (XSS) vulnerability in CFLogon/CFLogon.asp in Cezanne 6.5.1 and 7 allows remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2008-1968](https://cve.now/CVE-2008-1968.md): Multiple SQL injection vulnerabilities in Cezanne 7 allow remote authenticated users to execute arbitrary SQL commands via the FUNID paramet (no CVSS) - [CVE-2008-1969](https://cve.now/CVE-2008-1969.md): Multiple cross-site scripting (XSS) vulnerabilities in Cezanne 6.5.1 and 7 allow remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2008-1970](https://cve.now/CVE-2008-1970.md): muCommander before 0.8.2 stores credentials.xml with insecure permissions, which allows local users to obtain credentials. (no CVSS) - [CVE-2008-1971](https://cve.now/CVE-2008-1971.md): phShoutBox Final 1.5 and earlier only checks passwords when specified in $\_POST, which allows remote attackers to gain privileges by setting (no CVSS) - [CVE-2008-1972](https://cve.now/CVE-2008-1972.md): Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when (no CVSS) - [CVE-2008-1973](https://cve.now/CVE-2008-1973.md): Heap-based buffer overflow in SubEdit Player build 4056 and 4066 allows remote attackers to cause a denial of service (crash) or execute arb (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-04-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.