# CVEs published 2008-07-31

39 CVEs were published on July 31, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-3424](https://cve.now/CVE-2008-3424.md): Condor before 7.0.4 does not properly handle wildcards in the ALLOW\_WRITE, DENY\_WRITE, HOSTALLOW\_WRITE, or HOSTDENY\_WRITE configuration vari (no CVSS)
- [CVE-2008-3425](https://cve.now/CVE-2008-3425.md): Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System (SPS) 5.2 and 6.0 allows remote (no CVSS)
- [CVE-2008-3426](https://cve.now/CVE-2008-3426.md): Unspecified vulnerability in the Solaris Platform Information and Control Library daemon (picld) in Sun Solaris 8 through 10, and OpenSolari (no CVSS)
- [CVE-2008-3428](https://cve.now/CVE-2008-3428.md): Session fixation vulnerability in phpFreeChat 1.1 allows remote authenticated users to hijack web sessions by setting the session\_id paramet (no CVSS)
- [CVE-2008-3429](https://cve.now/CVE-2008-3429.md): Buffer overflow in URI processing in HTTrack and WinHTTrack before 3.42-3 allows remote attackers to cause a denial of service (crash) and p (no CVSS)
- [CVE-2008-3430](https://cve.now/CVE-2008-3430.md): Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3 (no CVSS)
- [CVE-2008-3422](https://cve.now/CVE-2008-3422.md): Multiple cross-site scripting (XSS) vulnerabilities in the ASP.net class libraries in Mono 2.0 and earlier allow remote attackers to inject (no CVSS)
- [CVE-2008-3408](https://cve.now/CVE-2008-3408.md): Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-3409](https://cve.now/CVE-2008-3409.md): Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daem (no CVSS)
- [CVE-2008-3410](https://cve.now/CVE-2008-3410.md): Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) vi (no CVSS)
- [CVE-2008-3411](https://cve.now/CVE-2008-3411.md): The Axesstel AXW-D800 modem with D2\_ETH\_109\_01\_VEBR Jun-14-2006 software does not require authentication for (1) etc/config/System.html, (2) (no CVSS)
- [CVE-2008-3412](https://cve.now/CVE-2008-3412.md): SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid (no CVSS)
- [CVE-2008-3413](https://cve.now/CVE-2008-3413.md): SQL injection vulnerability in category.php in Greatclone GC Auction Platinum allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-3414](https://cve.now/CVE-2008-3414.md): SQL injection vulnerability in line2.php in SiteAdmin allows remote attackers to execute arbitrary SQL commands via the art parameter. (no CVSS)
- [CVE-2008-3415](https://cve.now/CVE-2008-3415.md): Directory traversal vulnerability in common.php in CMScout 2.05, when .htaccess is not supported, allows remote attackers to include and exe (no CVSS)
- [CVE-2008-3416](https://cve.now/CVE-2008-3416.md): SQL injection vulnerability in modules/members.php in IceBB before 1.0-rc9.3 allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-3417](https://cve.now/CVE-2008-3417.md): SQL injection vulnerability in home/index.asp in fipsCMS light 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-3418](https://cve.now/CVE-2008-3418.md): SQL injection vulnerability in browse.php in TriO 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id param (no CVSS)
- [CVE-2008-3419](https://cve.now/CVE-2008-3419.md): SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands via the UID parameter (no CVSS)
- [CVE-2008-3420](https://cve.now/CVE-2008-3420.md): Multiple SQL injection vulnerabilities in Mobius for Mimsy XG 1 1.4.4.1 and earlier allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-3421](https://cve.now/CVE-2008-3421.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Blackboard Academic Suite 8.0.260.7 allow remote attackers to hijack the authe (no CVSS)
- [CVE-2008-3390](https://cve.now/CVE-2008-3390.md): Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register\_globals is enabled, allo (no CVSS)
- [CVE-2008-3391](https://cve.now/CVE-2008-3391.md): Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2008-3392](https://cve.now/CVE-2008-3392.md): Cross-site request forgery (CSRF) vulnerability in Web Wiz Forum 9.5 allows remote attackers to log out a user via a link or IMG tag to log\_ (no CVSS)
- [CVE-2008-3393](https://cve.now/CVE-2008-3393.md): SQL injection vulnerability in events.cfm in BookMine allows remote attackers to execute arbitrary SQL commands via the events\_id parameter. (no CVSS)
- [CVE-2008-3394](https://cve.now/CVE-2008-3394.md): Multiple cross-site scripting (XSS) vulnerabilities in search.cfm in BookMine allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-3395](https://cve.now/CVE-2008-3395.md): Calacode @Mail 5.41 on Linux uses weak world-readable permissions for (1) webmail/libs/Atmail/Config.php and (2) webmail/webadmin/.htpasswd, (no CVSS)
- [CVE-2008-3396](https://cve.now/CVE-2008-3396.md): Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon c (no CVSS)
- [CVE-2008-3397](https://cve.now/CVE-2008-3397.md): Cross-site scripting (XSS) vulnerability in Runesoft Cerberus CMS before 3\_1.4\_0.9 allows remote attackers to inject arbitrary web script or (CVSS 6.1)
- [CVE-2008-3398](https://cve.now/CVE-2008-3398.md): Multiple cross-site scripting (XSS) vulnerabilities in XRMS CRM 1.99.2 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2008-3399](https://cve.now/CVE-2008-3399.md): PHP remote file inclusion vulnerability in activities/workflow-activities.php in XRMS CRM 1.99.2, when register\_globals is enabled, allows r (no CVSS)
- [CVE-2008-3400](https://cve.now/CVE-2008-3400.md): XRMS CRM 1.99.2 allows remote attackers to obtain configuration information via a direct request to tests/info.php, which calls the phpinfo (no CVSS)
- [CVE-2008-3401](https://cve.now/CVE-2008-3401.md): PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execute arbitrary PHP cod (no CVSS)
- [CVE-2008-3402](https://cve.now/CVE-2008-3402.md): Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2008-3403](https://cve.now/CVE-2008-3403.md): SQL injection vulnerability in mojoClassified.cgi in MojoPersonals allows remote attackers to execute arbitrary SQL commands via the cat par (no CVSS)
- [CVE-2008-3404](https://cve.now/CVE-2008-3404.md): Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-3405](https://cve.now/CVE-2008-3405.md): Directory traversal vulnerability in index.php in Ricardo Amaral nzFotolog 0.4.1 allows remote attackers to include and execute arbitrary lo (no CVSS)
- [CVE-2008-3406](https://cve.now/CVE-2008-3406.md): SQL injection vulnerability in showcat.php in phpLinkat 0.1 allows remote attackers to execute arbitrary SQL commands via the catid paramete (no CVSS)
- [CVE-2008-3407](https://cve.now/CVE-2008-3407.md): phpLinkat 0.1 allows remote attackers to bypass authentication and access unspecified pages under admin/ by sending a login=right cookie. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-07-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.