# CVEs published 2008-08-13

39 CVEs were published on August 13, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-3338](https://cve.now/CVE-2008-3338.md): Multiple buffer overflows in TIBCO Hawk (1) AMI C library (libtibhawkami) and (2) Hawk HMA (tibhawkhma), as used in TIBCO Hawk before 4.8.1; (no CVSS)
- [CVE-2008-3669](https://cve.now/CVE-2008-3669.md): SQL injection vulnerability in comments.php in ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script (aka ZeeReviews) allows (no CVSS)
- [CVE-2008-3670](https://cve.now/CVE-2008-3670.md): SQL injection vulnerability in authordetail.php in Article Friendly Pro allows remote attackers to execute arbitrary SQL commands via the au (no CVSS)
- [CVE-2008-3671](https://cve.now/CVE-2008-3671.md): Acronis True Image Echo Server 9.x build 8072 on Linux does not properly encrypt backups to an FTP server, which allows remote attackers to (no CVSS)
- [CVE-2008-3672](https://cve.now/CVE-2008-3672.md): SQL injection vulnerability in showcategory.php in PozScripts Classified Ads allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-3673](https://cve.now/CVE-2008-3673.md): SQL injection vulnerability in browsecats.php in PozScripts Classified Ads allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-3674](https://cve.now/CVE-2008-3674.md): SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2008-1668](https://cve.now/CVE-2008-1668.md): ftpd.c in (1) wu-ftpd 2.4.2 and (2) ftpd in HP HP-UX B.11.11 assigns uid 0 to the FTP client in certain operating-system misconfigurations i (no CVSS)
- [CVE-2008-3667](https://cve.now/CVE-2008-3667.md): Stack-based buffer overflow in Maxthon Browser 2.0 and earlier allows remote attackers to execute arbitrary code via a long Content-type HTT (no CVSS)
- [CVE-2008-3668](https://cve.now/CVE-2008-3668.md): Multiple cross-site scripting (XSS) vulnerabilities in the Yogurt Social Network module 3.2 rc1 for XOOPS allow remote attackers to inject a (no CVSS)
- [CVE-2008-3666](https://cve.now/CVE-2008-3666.md): Unspecified vulnerability in Sun Solaris 10 and OpenSolaris before snv\_96 allows (1) context-dependent attackers to cause a denial of servic (no CVSS)
- [CVE-2008-1456](https://cve.now/CVE-2008-1456.md): Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, an (no CVSS)
- [CVE-2008-1457](https://cve.now/CVE-2008-1457.md): The Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not proper (no CVSS)
- [CVE-2008-2254](https://cve.now/CVE-2008-2254.md): Microsoft Internet Explorer 6 and 7 accesses uninitialized memory, which allows remote attackers to cause a denial of service (crash) and ex (no CVSS)
- [CVE-2008-2255](https://cve.now/CVE-2008-2255.md): Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory, which allows remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2008-2256](https://cve.now/CVE-2008-2256.md): Microsoft Internet Explorer 5.01, 6, and 7 does not properly handle objects that have been incorrectly initialized or deleted, which allows (no CVSS)
- [CVE-2008-2257](https://cve.now/CVE-2008-2257.md): Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory in certain conditions, which allows remote attackers to cause a den (no CVSS)
- [CVE-2008-2258](https://cve.now/CVE-2008-2258.md): Microsoft Internet Explorer 5.01, 6, and 7 accesses uninitialized memory in certain conditions, which allows remote attackers to cause a den (no CVSS)
- [CVE-2008-2259](https://cve.now/CVE-2008-2259.md): Microsoft Internet Explorer 6 and 7 does not perform proper "argument validation" during print preview, which allows remote attackers to exe (no CVSS)
- [CVE-2008-3514](https://cve.now/CVE-2008-3514.md): VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control (no CVSS)
- [CVE-2008-3650](https://cve.now/CVE-2008-3650.md): Multiple unspecified vulnerabilities in Horde Groupware Webmail before Edition 1.1.1 (final) have unknown impact and attack vectors related (no CVSS)
- [CVE-2008-3651](https://cve.now/CVE-2008-3651.md): Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of ser (no CVSS)
- [CVE-2008-3652](https://cve.now/CVE-2008-3652.md): src/racoon/handler.c in racoon in ipsec-tools does not remove an "orphaned ph1" (phase 1) handle when it has been initiated remotely, which (no CVSS)
- [CVE-2008-3653](https://cve.now/CVE-2008-3653.md): Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors. (no CVSS)
- [CVE-2008-3654](https://cve.now/CVE-2008-3654.md): Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors. (no CVSS)
- [CVE-2008-3655](https://cve.now/CVE-2008-3655.md): Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to criti (no CVSS)
- [CVE-2008-3656](https://cve.now/CVE-2008-3656.md): Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split\_header\_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick i (no CVSS)
- [CVE-2008-3657](https://cve.now/CVE-2008-3657.md): The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness (no CVSS)
- [CVE-2008-0082](https://cve.now/CVE-2008-0082.md): An ActiveX control (Messenger.UIAutomation.1) in Windows Messenger 4.7 and 5.1 is marked as safe-for-scripting, which allows remote attacker (no CVSS)
- [CVE-2008-0120](https://cve.now/CVE-2008-0120.md): Integer overflow in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file with a malforme (no CVSS)
- [CVE-2008-0121](https://cve.now/CVE-2008-0121.md): A "memory calculation error" in Microsoft PowerPoint Viewer 2003 allows remote attackers to execute arbitrary code via a PowerPoint file wit (no CVSS)
- [CVE-2008-1448](https://cve.now/CVE-2008-1448.md): The MHTML protocol handler in a component of Microsoft Outlook Express 5.5 SP2 and 6 through SP1, and Windows Mail, does not assign the corr (no CVSS)
- [CVE-2008-1455](https://cve.now/CVE-2008-1455.md): A "memory calculation error" in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP2, and 2007 through SP1; Office Compatibility Pack fo (no CVSS)
- [CVE-2008-2245](https://cve.now/CVE-2008-2245.md): Heap-based buffer overflow in the InternalOpenColorProfile function in mscms.dll in Microsoft Windows Image Color Management System (MSCMS) (no CVSS)
- [CVE-2008-2246](https://cve.now/CVE-2008-2246.md): Microsoft Windows Vista through SP1 and Server 2008 do not properly import the default IPsec policy from a Windows Server 2003 domain to a W (no CVSS)
- [CVE-2008-2938](https://cve.now/CVE-2008-2938.md): Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking a (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2008-3515](https://cve.now/CVE-2008-3515.md): Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inj (no CVSS)
- [CVE-2008-3516](https://cve.now/CVE-2008-3516.md): Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inj (no CVSS)
- [CVE-2008-3649](https://cve.now/CVE-2008-3649.md): SQL injection vulnerability in categorydetail.php in Article Friendly Standard allows remote attackers to execute arbitrary SQL commands via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.