# CVEs published 2008-05-23

17 CVEs were published on May 23, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2302](https://cve.now/CVE-2008-2302.md): Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95. (no CVSS, django)
- [CVE-2008-2333](https://cve.now/CVE-2008-2333.md): Cross-site scripting (XSS) vulnerability in ldap\_test.cgi in Barracuda Spam Firewall (BSF) before 3.5.11.025 allows remote attackers to inje (no CVSS)
- [CVE-2008-2407](https://cve.now/CVE-2008-2407.md): Stack-based buffer overflow in AIM.DLL in Cerulean Studios Trillian before 3.1.10.0 allows user-assisted remote attackers to execute arbitra (no CVSS)
- [CVE-2008-2408](https://cve.now/CVE-2008-2408.md): Heap-based buffer overflow in the XML parsing functionality in talk.dll in Cerulean Studios Trillian Pro before 3.1.10.0 allows remote attac (no CVSS)
- [CVE-2008-2409](https://cve.now/CVE-2008-2409.md): Stack-based buffer overflow in Cerulean Studios Trillian before 3.1.10.0 allows remote attackers to execute arbitrary code via unspecified a (no CVSS)
- [CVE-2008-2419](https://cve.now/CVE-2008-2419.md): Mozilla Firefox 2.0.0.14 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly execute ar (no CVSS)
- [CVE-2008-2420](https://cve.now/CVE-2008-2420.md): The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to (no CVSS)
- [CVE-2008-2421](https://cve.now/CVE-2008-2421.md): Cross-site scripting (XSS) vulnerability in the Web GUI in SAP Web Application Server (WAS) 7.0, Web Dynpro for ABAP (aka WD4A or WDA), and (no CVSS)
- [CVE-2008-2422](https://cve.now/CVE-2008-2422.md): SQL injection vulnerability in index.php in Web Slider 0.6 allows remote attackers to execute arbitrary SQL commands via the slide parameter (no CVSS)
- [CVE-2008-2423](https://cve.now/CVE-2008-2423.md): Unspecified vulnerability in Interchange before 5.6.0 and before 5.5.2 allows remote attackers to cause a denial of service via crafted HTTP (no CVSS)
- [CVE-2008-2424](https://cve.now/CVE-2008-2424.md): Unspecified vulnerability in the 404 error page for the "Standard demo" in Interchange before 5.6.0 and before 5.5.2 has unknown impact and (no CVSS)
- [CVE-2008-2425](https://cve.now/CVE-2008-2425.md): SQL injection vulnerability in index.php in FicHive 1.0 allows remote attackers to execute arbitrary SQL commands via the letter parameter i (no CVSS)
- [CVE-2007-5495](https://cve.now/CVE-2007-5495.md): sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file. (no CVSS)
- [CVE-2007-5496](https://cve.now/CVE-2007-5496.md): Cross-site scripting (XSS) vulnerability in setroubleshoot 2.0.5 allows local users to inject arbitrary web script or HTML via a crafted (1) (no CVSS)
- [CVE-2007-5961](https://cve.now/CVE-2007-5961.md): Cross-site scripting (XSS) vulnerability in the Red Hat Network channel search feature, as used in RHN and Red Hat Network Satellite before (no CVSS)
- [CVE-2008-1767](https://cve.now/CVE-2008-1767.md): Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly e (no CVSS)
- [CVE-2008-2418](https://cve.now/CVE-2008-2418.md): Race condition in the STREAMS Administrative Driver (sad) in Sun Solaris 10 allows local users to cause a denial of service (panic) via unkn (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.