# CVEs published 2008-04-28

13 CVEs were published on April 28, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-1103](https://cve.now/CVE-2008-1103.md): Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues." (no CVSS)
- [CVE-2008-1930](https://cve.now/CVE-2008-1930.md): The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY\_TIME, which allow (no CVSS)
- [CVE-2008-1996](https://cve.now/CVE-2008-1996.md): licq before 1.3.6 allows remote attackers to cause a denial of service (file-descriptor exhaustion and application crash) via a large number (no CVSS)
- [CVE-2008-1997](https://cve.now/CVE-2008-1997.md): Unspecified vulnerability in the ADMIN\_SP\_C2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authentic (no CVSS)
- [CVE-2008-1998](https://cve.now/CVE-2008-1998.md): The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticat (no CVSS)
- [CVE-2008-1999](https://cve.now/CVE-2008-1999.md): Apple Safari 3.1.1 allows remote attackers to spoof the address bar by placing many "invisible" characters in the userinfo subcomponent of t (no CVSS)
- [CVE-2008-2000](https://cve.now/CVE-2008-2000.md): Unspecified vulnerability in Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code (no CVSS)
- [CVE-2008-2001](https://cve.now/CVE-2008-2001.md): Apple Safari 3.1.1 allows remote attackers to cause a denial of service (application crash) via a file:///%E2 link that triggers an out-of-b (no CVSS)
- [CVE-2008-2002](https://cve.now/CVE-2008-2002.md): Multiple cross-site request forgery (CSRF) vulnerabilities on Motorola Surfboard with software SB5100-2.3.3.0-SCM00-NOSH allow remote attack (no CVSS)
- [CVE-2008-2003](https://cve.now/CVE-2008-2003.md): BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control, which allows remote attack (no CVSS)
- [CVE-2008-1670](https://cve.now/CVE-2008-1670.md): Heap-based buffer overflow in the progressive PNG Image loader (decoders/pngloader.cpp) in KHTML in KDE 4.0.x up to 4.0.3 allows remote atta (no CVSS)
- [CVE-2008-1671](https://cve.now/CVE-2008-1671.md): start\_kdeinit in KDE 3.5.5 through 3.5.9, when installed setuid root, allows local users to cause a denial of service and possibly execute a (no CVSS)
- [CVE-2008-1995](https://cve.now/CVE-2008-1995.md): Sun Java System Directory Proxy Server 6.0, 6.1, and 6.2 classifies a connection using the "bind-dn" criteria, which can cause an incorrect (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.