# CVEs published 2008-08-27

35 CVEs were published on August 27, 2008: 1 critical, 0 high. Days are UTC.

- [CVE-2008-3845](https://cve.now/CVE-2008-3845.md): Multiple SQL injection vulnerabilities in Crafty Syntax Live Help (CSLH) 2.14.6 and earlier allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-3846](https://cve.now/CVE-2008-3846.md): Cross-site scripting (XSS) vulnerability in mysql-lists 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via u (no CVSS)
- [CVE-2008-3847](https://cve.now/CVE-2008-3847.md): Multiple cross-site scripting (XSS) vulnerabilities in AN Guestbook (ANG) before 0.7.6 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-3848](https://cve.now/CVE-2008-3848.md): SQL injection vulnerability in single.php in Z-Breaknews 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2008-3849](https://cve.now/CVE-2008-3849.md): Cross-site scripting (XSS) vulnerability in the calendar controller in Civic Website Manager before 1.0.1 allows remote attackers to inject (no CVSS)
- [CVE-2008-3850](https://cve.now/CVE-2008-3850.md): Cross-site scripting (XSS) vulnerability in Accellion File Transfer FTA\_7\_0\_135 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-3851](https://cve.now/CVE-2008-3851.md): Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local fil (no CVSS)
- [CVE-2007-1682](https://cve.now/CVE-2007-1682.md): Multiple stack-based buffer overflows in the FileManager ActiveX control in SAFmgPws.dll in SoftArtisans XFile before 2.4.0 allow remote att (no CVSS)
- [CVE-2008-2327](https://cve.now/CVE-2008-2327.md): Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif\_lzw.c in the LZW decoder in L (no CVSS)
- [CVE-2008-2433](https://cve.now/CVE-2008-2433.md): The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3. (no CVSS)
- [CVE-2008-3281](https://cve.now/CVE-2008-3281.md): libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent (no CVSS)
- [CVE-2008-3526](https://cve.now/CVE-2008-3526.md): Integer overflow in the sctp\_setsockopt\_auth\_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementa (no CVSS)
- [CVE-2008-3736](https://cve.now/CVE-2008-3736.md): Multiple cross-site request forgery (CSRF) vulnerabilities in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag Lacooda (no CVSS)
- [CVE-2008-3737](https://cve.now/CVE-2008-3737.md): Unspecified vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earlier allows remot (no CVSS)
- [CVE-2008-3738](https://cve.now/CVE-2008-3738.md): Session fixation vulnerability in SpaceTag LacoodaST 2.1.3 and earlier allows remote attackers to hijack web sessions via unspecified vector (CVSS 9.1)
- [CVE-2008-3739](https://cve.now/CVE-2008-3739.md): Cross-site scripting (XSS) vulnerability in (1) System Consultants La!Cooda WIZ 1.4.0 and earlier and (2) SpaceTag LacoodaST 2.1.3 and earli (no CVSS)
- [CVE-2008-3789](https://cve.now/CVE-2008-3789.md): Samba 3.2.0 uses weak permissions (0666) for the (1) group\_mapping.tdb and (2) group\_mapping.ldb files, which allows local users to modify t (no CVSS)
- [CVE-2008-3790](https://cve.now/CVE-2008-3790.md): The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of (no CVSS)
- [CVE-2008-3838](https://cve.now/CVE-2008-3838.md): Unspecified vulnerability in the NFS Remote Procedure Calls (RPC) zones implementation in Sun Solaris 10 and OpenSolaris before snv\_88 allow (no CVSS)
- [CVE-2008-3839](https://cve.now/CVE-2008-3839.md): Unspecified vulnerability in the NFS module in the kernel in Sun Solaris 10 and OpenSolaris snv\_59 through snv\_87, when configured as an NFS (no CVSS)
- [CVE-2008-3840](https://cve.now/CVE-2008-3840.md): Crafty Syntax Live Help (CSLH) 2.14.6 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attacker (no CVSS)
- [CVE-2008-3841](https://cve.now/CVE-2008-3841.md): Cross-site scripting (XSS) vulnerability in admin/search\_links.php in Freeway eCommerce 1.4.1.171 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2008-3842](https://cve.now/CVE-2008-3842.md): Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework without the MS07-040 update does not properly de (no CVSS)
- [CVE-2008-3843](https://cve.now/CVE-2008-3843.md): Request Validation (aka the ValidateRequest filters) in ASP.NET in Microsoft .NET Framework with the MS07-040 update does not properly detec (no CVSS)
- [CVE-2008-3844](https://cve.now/CVE-2008-3844.md): Certain Red Hat Enterprise Linux (RHEL) 4 and 5 packages for OpenSSH, as signed in August 2008 using a legitimate Red Hat GPG key, contain a (no CVSS)
- [CVE-2008-3740](https://cve.now/CVE-2008-3740.md): Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject (no CVSS)
- [CVE-2008-3741](https://cve.now/CVE-2008-3741.md): The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenti (no CVSS)
- [CVE-2008-3742](https://cve.now/CVE-2008-3742.md): Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users (no CVSS)
- [CVE-2008-3743](https://cve.now/CVE-2008-3743.md): Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified a (no CVSS)
- [CVE-2008-3744](https://cve.now/CVE-2008-3744.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the (no CVSS)
- [CVE-2008-3745](https://cve.now/CVE-2008-3745.md): The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachme (no CVSS)
- [CVE-2008-3746](https://cve.now/CVE-2008-3746.md): neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and crash) via vectors related to Di (no CVSS)
- [CVE-2008-3747](https://cve.now/CVE-2008-3747.md): The (1) get\_edit\_post\_link and (2) get\_edit\_comment\_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force S (no CVSS)
- [CVE-2008-3795](https://cve.now/CVE-2008-3795.md): Buffer overflow in Ipswitch WS\_FTP Home client allows remote FTP servers to have an unknown impact via a long "message response." (no CVSS)
- [CVE-2008-3796](https://cve.now/CVE-2008-3796.md): Swfdec 0.6 before 0.6.8 allows remote attackers to cause a denial of service (application crash) via a 1x1 JPEG image. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.