# CVEs published 2008-05-07

10 CVEs were published on May 7, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2110](https://cve.now/CVE-2008-2110.md): Unrestricted file upload vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to execute arbitrary PHP code by uploading (no CVSS)
- [CVE-2008-2111](https://cve.now/CVE-2008-2111.md): The ActiveX Control (yNotifier.dll) in Yahoo! Assistant 3.6 and earlier allows remote attackers to execute arbitrary code via unspecified ve (no CVSS)
- [CVE-2008-2107](https://cve.now/CVE-2008-2107.md): The GENERATE\_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values (no CVSS)
- [CVE-2008-2108](https://cve.now/CVE-2008-2108.md): The GENERATE\_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generat (no CVSS)
- [CVE-2008-2109](https://cve.now/CVE-2008-2109.md): field.c in the libid3tag 0.15.0b library allows context-dependent attackers to cause a denial of service (CPU consumption) via an ID3\_FIELD\_ (no CVSS)
- [CVE-2008-2103](https://cve.now/CVE-2008-2103.md): Cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later allows remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2008-2104](https://cve.now/CVE-2008-2104.md): The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a (no CVSS)
- [CVE-2008-2105](https://cve.now/CVE-2008-2105.md): email\_in.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the change (no CVSS)
- [CVE-2008-2106](https://cve.now/CVE-2008-2106.md): Call of Duty 4 (CoD4) 1.5 and earlier allows remote authenticated users to cause a denial of service (crash) via a type 7 stats packet, whic (no CVSS)
- [CVE-2008-2096](https://cve.now/CVE-2008-2096.md): SQL injection vulnerability in BackLinkSpider allows remote attackers to execute arbitrary SQL commands via the cat\_id parameter to a site-s (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-05-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.