# CVEs published 2008-07-18

30 CVEs were published on July 18, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2934](https://cve.now/CVE-2008-2934.md): Mozilla Firefox 3 before 3.0.1 on Mac OS X allows remote attackers to cause a denial of service (application crash) or possibly execute arbi (no CVSS)
- [CVE-2008-3214](https://cve.now/CVE-2008-3214.md): dnsmasq 2.25 allows remote attackers to cause a denial of service (daemon crash) by (1) renewing a nonexistent lease or (2) sending a DHCPRE (no CVSS)
- [CVE-2008-3215](https://cve.now/CVE-2008-3215.md): libclamav/petite.c in ClamAV before 0.93.3 allows remote attackers to cause a denial of service via a malformed Petite file that triggers an (no CVSS)
- [CVE-2008-3216](https://cve.now/CVE-2008-3216.md): The save function in br/prefmanager.d in projectl 1.001 creates a projectL.prf file in the current working directory, which allows local use (no CVSS)
- [CVE-2008-3217](https://cve.now/CVE-2008-3217.md): PowerDNS Recursor before 3.1.6 does not always use the strongest random number generator for source port selection, which makes it easier fo (no CVSS)
- [CVE-2008-3218](https://cve.now/CVE-2008-3218.md): Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML v (no CVSS, drupal/drupal)
- [CVE-2008-3219](https://cve.now/CVE-2008-3219.md): The Drupal filter\_xss\_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator inpu (no CVSS)
- [CVE-2008-3220](https://cve.now/CVE-2008-3220.md): Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrativ (no CVSS)
- [CVE-2008-3221](https://cve.now/CVE-2008-3221.md): Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vecto (no CVSS)
- [CVE-2008-3222](https://cve.now/CVE-2008-3222.md): Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a (no CVSS)
- [CVE-2008-3223](https://cve.now/CVE-2008-3223.md): SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors (no CVSS)
- [CVE-2008-3224](https://cve.now/CVE-2008-3224.md): Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used wi (no CVSS)
- [CVE-2008-3225](https://cve.now/CVE-2008-3225.md): Joomla! before 1.5.4 allows attackers to access administration functionality, which has unknown impact and attack vectors related to a missi (no CVSS)
- [CVE-2008-3226](https://cve.now/CVE-2008-3226.md): The file caching implementation in Joomla! before 1.5.4 allows attackers to access cached pages via unknown attack vectors. (no CVSS, joomla/joomla-platform)
- [CVE-2008-3227](https://cve.now/CVE-2008-3227.md): Unspecified vulnerability in Joomla! before 1.5.4 has unknown impact and attack vectors related to a "User Redirect Spam fix," possibly an o (no CVSS, joomla/framework)
- [CVE-2008-3228](https://cve.now/CVE-2008-3228.md): Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unkno (no CVSS, joomla/joomla-platform)
- [CVE-2008-3229](https://cve.now/CVE-2008-3229.md): Stack-based buffer overflow in op before Changeset 563, when xauth support is enabled, allows local users to gain privileges via a long XAUT (no CVSS)
- [CVE-2008-3230](https://cve.now/CVE-2008-3230.md): The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial of service (application crash) via a crafted GIF file, possibly rel (no CVSS)
- [CVE-2008-3231](https://cve.now/CVE-2008-3231.md): xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via a crafted OGG file, as demonstrated by playing lol-f (no CVSS)
- [CVE-2008-3232](https://cve.now/CVE-2008-3232.md): Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arb (no CVSS)
- [CVE-2008-3233](https://cve.now/CVE-2008-3233.md): Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2008-3234](https://cve.now/CVE-2008-3234.md): sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SE (no CVSS)
- [CVE-2008-3206](https://cve.now/CVE-2008-3206.md): SQL injection vulnerability in browse.groups.php in Yuhhu Pubs Black Cat allows remote attackers to execute arbitrary SQL commands via the c (no CVSS)
- [CVE-2008-3207](https://cve.now/CVE-2008-3207.md): PHP remote file inclusion vulnerability in cms/modules/form.lib.php in Pragyan CMS 2.6.2, when register\_globals is enabled, allows remote at (no CVSS)
- [CVE-2008-3208](https://cve.now/CVE-2008-3208.md): Simple DNS Plus 4.1, 5.0, and possibly other versions before 5.1.101 allows remote attackers to cause a denial of service via multiple DNS r (no CVSS)
- [CVE-2008-3209](https://cve.now/CVE-2008-3209.md): Heap-based buffer overflow in the OpenGifFile function in BiGif.dll in Black Ice Document Imaging SDK 10.95 allows remote attackers to execu (no CVSS)
- [CVE-2008-3210](https://cve.now/CVE-2008-3210.md): rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service (daemon crash) via a SIP (no CVSS)
- [CVE-2008-3211](https://cve.now/CVE-2008-3211.md): Scripteen Free Image Hosting Script 1.2 and 1.2.1 allows remote attackers to bypass authentication and gain administrative access by setting (no CVSS)
- [CVE-2008-3212](https://cve.now/CVE-2008-3212.md): Multiple SQL injection vulnerabilities in Scripteen Free Image Hosting Script 1.2.1 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-3213](https://cve.now/CVE-2008-3213.md): SQL injection vulnerability in secciones/tablon/tablon.php in WebCMS Portal Edition allows remote attackers to execute arbitrary SQL command (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-07-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.