# CVEs published 2008-04-30

27 CVEs were published on April 30, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2028](https://cve.now/CVE-2008-2028.md): miniBB 2.2, and possibly earlier, when register\_globals is enabled, allows remote attackers to obtain the full path via a direct request to (no CVSS)
- [CVE-2008-2029](https://cve.now/CVE-2008-2029.md): Multiple SQL injection vulnerabilities in (1) setup\_mysql.php and (2) setup\_options.php in miniBB 2.2 and possibly earlier, when register\_gl (no CVSS)
- [CVE-2008-2030](https://cve.now/CVE-2008-2030.md): Cross-site scripting (XSS) vulnerability in installControl.php3 in F5 FirePass 4100 SSL VPN 5.4.2-5.5.2 and 6.0-6.2 allows remote attackers (no CVSS)
- [CVE-2008-2031](https://cve.now/CVE-2008-2031.md): VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a crafted LIST command, which triggers a NULL pointer dereferen (no CVSS)
- [CVE-2008-2032](https://cve.now/CVE-2008-2032.md): The FTP service in Acritum Femitter Server 1.03 allows remote attackers to cause a denial of service (crash) by sending multiple crafted RET (no CVSS)
- [CVE-2008-2034](https://cve.now/CVE-2008-2034.md): SQL injection vulnerability in wp-download\_monitor/download.php in the Download Monitor 2.0.6 plugin for WordPress allows remote attackers t (no CVSS)
- [CVE-2008-2035](https://cve.now/CVE-2008-2035.md): Cross-site scripting (XSS) vulnerability in the Bluemoon, Inc. (no CVSS)
- [CVE-2008-2036](https://cve.now/CVE-2008-2036.md): SQL injection vulnerability in index.php in dream4 Koobi Pro 6.25 allows remote attackers to execute arbitrary SQL commands via the poll\_id (no CVSS)
- [CVE-2008-2037](https://cve.now/CVE-2008-2037.md): Multiple cross-site scripting (XSS) vulnerabilities in EditeurScripts EsContacts 1.0 allow remote authenticated users to inject arbitrary we (no CVSS)
- [CVE-2008-2038](https://cve.now/CVE-2008-2038.md): Multiple SQL injection vulnerabilities in admin/adminindex.php in Turnkey Web Tools SunShop Shopping Cart 4.1.0 allow remote authenticated a (no CVSS)
- [CVE-2008-2040](https://cve.now/CVE-2008-2040.md): Stack-based buffer overflow in the HTTP::getAuthUserPass function (core/common/http.cpp) in Peercast 0.1218 and gnome-peercast allows remote (no CVSS)
- [CVE-2008-2041](https://cve.now/CVE-2008-2041.md): Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has (no CVSS)
- [CVE-2008-2026](https://cve.now/CVE-2008-2026.md): Cross-site scripting (XSS) vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258, and other versions before 5.3.3.3 (no CVSS)
- [CVE-2008-2027](https://cve.now/CVE-2008-2027.md): Open redirect vulnerability in WebID/IISWebAgentIF.dll in RSA Authentication Agent 5.3.0.258 for Web for IIS, when accessed via certain brow (no CVSS)
- [CVE-2008-2021](https://cve.now/CVE-2008-2021.md): Heap-based buffer overflow in Lhaplus before 1.57 allows remote attackers to execute arbitrary code via a long comment field in a ZOO archiv (no CVSS)
- [CVE-2008-2022](https://cve.now/CVE-2008-2022.md): Mulatiple cross-site scripting (XSS) vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-2023](https://cve.now/CVE-2008-2023.md): Multiple SQL injection vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) invi (no CVSS)
- [CVE-2008-2024](https://cve.now/CVE-2008-2024.md): Cross-site scripting (XSS) vulnerability in index.php in miniBB 2.2, and possibly earlier, when register\_globals is enabled, allows remote a (no CVSS)
- [CVE-2008-2014](https://cve.now/CVE-2008-2014.md): Mozilla Firefox 3.0 beta 5 allows remote attackers to cause a denial of service (application crash) via JavaScript code that calls document. (no CVSS)
- [CVE-2008-2015](https://cve.now/CVE-2008-2015.md): Multiple absolute path traversal vulnerabilities in certain ActiveX controls in WatchFire AppScan 7.0 allow remote attackers to create or ov (no CVSS)
- [CVE-2008-2016](https://cve.now/CVE-2008-2016.md): PHP remote file inclusion vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-2017](https://cve.now/CVE-2008-2017.md): Directory traversal vulnerability in Chilek Content Management System (aka ChiCoMaS) 2.0.4 allows remote attackers to include and execute ar (no CVSS)
- [CVE-2008-2018](https://cve.now/CVE-2008-2018.md): The AssignUser function in template.class.php in PHPizabi 0.848b C1 HFP3 performs unsafe macro expansions on strings delimited by '{' and '} (no CVSS)
- [CVE-2008-2019](https://cve.now/CVE-2008-2019.md): Simple Machines Forum (SMF), probably 1.1.4, relies on "randomly generated static" to hinder brute-force attacks on the WAV file (aka audio) (no CVSS)
- [CVE-2008-2020](https://cve.now/CVE-2008-2020.md): The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) (no CVSS)
- [CVE-2008-2012](https://cve.now/CVE-2008-2012.md): SQL injection vulnerability in index.php in the PostSchedule 1.0 module for PostNuke allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-2013](https://cve.now/CVE-2008-2013.md): SQL injection vulnerability in index.php in the pnFlashGames 1.5 through 2.5 module for PostNuke, when magic\_quotes\_gpc is disabled, allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-04-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.