# CVEs published 2008-05-20

12 CVEs were published on May 20, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-0957](https://cve.now/CVE-2008-0957.md): Multiple stack-based buffer overflows in the PhotoStockPlus Uploader Tool ActiveX control (PSPUploader.ocx) allow remote attackers to execut (no CVSS)
- [CVE-2008-2346](https://cve.now/CVE-2008-2346.md): AlkalinePHP 0.77.35 and earlier allows remote attackers to bypass authentication and gain administrative access by creating an admin account (no CVSS)
- [CVE-2008-2347](https://cve.now/CVE-2008-2347.md): MyPicGallery 1.0 allows remote attackers to bypass application authentication and gain administrative access by setting the userID parameter (no CVSS)
- [CVE-2008-2348](https://cve.now/CVE-2008-2348.md): MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application qu (no CVSS)
- [CVE-2008-2349](https://cve.now/CVE-2008-2349.md): Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install (no CVSS)
- [CVE-2008-2350](https://cve.now/CVE-2008-2350.md): Directory traversal vulnerability in highlight.php in bcoos 1.0.9 through 1.0.13 allows remote attackers to read arbitrary files via (1) .. (no CVSS)
- [CVE-2008-2351](https://cve.now/CVE-2008-2351.md): Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2008-2352](https://cve.now/CVE-2008-2352.md): Directory traversal vulnerability in index.php in Smeego 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to include and exec (no CVSS)
- [CVE-2008-2353](https://cve.now/CVE-2008-2353.md): Directory traversal vulnerability in admin.php in GNU/Gallery 1.1.1.0 and earlier allows remote attackers to include and execute arbitrary l (no CVSS)
- [CVE-2008-2354](https://cve.now/CVE-2008-2354.md): Unspecified vulnerability in the data export function in testMaker before 3.0p10 allows test authors to obtain access to export data via unk (no CVSS)
- [CVE-2008-2355](https://cve.now/CVE-2008-2355.md): Directory traversal vulnerability in index.php in WR-Meeting 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to include and (no CVSS)
- [CVE-2008-2356](https://cve.now/CVE-2008-2356.md): SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.