# CVEs published 2008-09-04

36 CVEs were published on September 4, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-3903](https://cve.now/CVE-2008-3903.md): Asterisk Open Source 1.2.x before 1.2.32, 1.4.x before 1.4.24.1, and 1.6.0.x before 1.6.0.8; Asterisk Business Edition A.x.x, B.x.x before B (no CVSS)
- [CVE-2008-3932](https://cve.now/CVE-2008-3932.md): Wireshark (formerly Ethereal) 0.9.7 through 1.0.2 allows attackers to cause a denial of service (hang) via a crafted NCP packet that trigger (no CVSS)
- [CVE-2008-3933](https://cve.now/CVE-2008-3933.md): Wireshark (formerly Ethereal) 0.10.14 through 1.0.2 allows attackers to cause a denial of service (crash) via a packet with crafted zlib-com (no CVSS)
- [CVE-2008-3934](https://cve.now/CVE-2008-3934.md): Unspecified vulnerability in Wireshark (formerly Ethereal) 0.99.6 through 1.0.2 allows attackers to cause a denial of service (crash) via a (no CVSS)
- [CVE-2008-3916](https://cve.now/CVE-2008-3916.md): Heap-based buffer overflow in the strip\_escapes function in signal.c in GNU ed before 1.0 allows context-dependent or user-assisted attacker (no CVSS)
- [CVE-2008-3917](https://cve.now/CVE-2008-3917.md): Cross-site scripting (XSS) vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-3918](https://cve.now/CVE-2008-3918.md): SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the field paramete (no CVSS)
- [CVE-2008-3919](https://cve.now/CVE-2008-3919.md): Unspecified vulnerability in multiple JustSystems Ichitaro products allows remote attackers to execute arbitrary code via a crafted JTD docu (no CVSS)
- [CVE-2008-3920](https://cve.now/CVE-2008-3920.md): Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vecto (no CVSS)
- [CVE-2008-3921](https://cve.now/CVE-2008-3921.md): Multiple cross-site scripting (XSS) vulnerabilities in AWStats Totals 1.0 through 1.14 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-3922](https://cve.now/CVE-2008-3922.md): awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort paramet (no CVSS)
- [CVE-2008-3923](https://cve.now/CVE-2008-3923.md): Multiple cross-site scripting (XSS) vulnerabilities in statistics.php in Content Management Made Easy (CMME) 1.12 allow remote attackers to (no CVSS)
- [CVE-2008-3924](https://cve.now/CVE-2008-3924.md): The "Make a backup" functionality in Content Management Made Easy (CMME) 1.12 stores sensitive information under the web root with insuffici (no CVSS)
- [CVE-2008-3925](https://cve.now/CVE-2008-3925.md): Cross-site request forgery (CSRF) vulnerability in admin.php in Content Management Made Easy (CMME) 1.12 allows remote attackers to trigger (no CVSS)
- [CVE-2008-3926](https://cve.now/CVE-2008-3926.md): Multiple directory traversal vulnerabilities in Content Management Made Easy (CMME) 1.12 allow remote attackers to (1) read arbitrary files (no CVSS)
- [CVE-2008-3927](https://cve.now/CVE-2008-3927.md): genmsgidx in Tiger 3.2.2 allows local users to overwrite or delete arbitrary files via a symlink attack on temporary files. (no CVSS)
- [CVE-2008-3928](https://cve.now/CVE-2008-3928.md): test.sh in Honeyd 1.5c might allow local users to overwrite arbitrary files via a symlink attack on a temporary file. (no CVSS)
- [CVE-2008-3929](https://cve.now/CVE-2008-3929.md): gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file (no CVSS)
- [CVE-2008-3930](https://cve.now/CVE-2008-3930.md): migrate\_aliases.sh in Citadel Server 7.37 allows local users to overwrite arbitrary files via a symlink attack on a temporary file. (no CVSS)
- [CVE-2008-3931](https://cve.now/CVE-2008-3931.md): javareconf in R 2.7.2 allows local users to overwrite arbitrary files via a symlink attack on temporary files. (no CVSS)
- [CVE-2007-6716](https://cve.now/CVE-2007-6716.md): fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to (no CVSS)
- [CVE-2008-3904](https://cve.now/CVE-2008-3904.md): src/main-win.c in GPicView 0.1.9 in Lightweight X11 Desktop Environment (LXDE) allows context-dependent attackers to execute arbitrary comma (no CVSS)
- [CVE-2008-3905](https://cve.now/CVE-2008-3905.md): resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction (no CVSS)
- [CVE-2008-3906](https://cve.now/CVE-2008-3906.md): CRLF injection vulnerability in Sys.Web in Mono 2.0 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP re (no CVSS)
- [CVE-2008-3907](https://cve.now/CVE-2008-3907.md): The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a fee (no CVSS)
- [CVE-2008-3908](https://cve.now/CVE-2008-3908.md): Multiple buffer overflows in Princeton WordNet (wn) 3.0 allow context-dependent attackers to execute arbitrary code via (1) a long argument (no CVSS)
- [CVE-2008-3909](https://cve.now/CVE-2008-3909.md): The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful (no CVSS, django)
- [CVE-2008-3910](https://cve.now/CVE-2008-3910.md): dns2tcp before 0.4.1 does not properly handle negative values in a certain length field in the input argument to the (1) dns\_simple\_decode o (no CVSS)
- [CVE-2008-3911](https://cve.now/CVE-2008-3911.md): The proc\_do\_xprt function in net/sunrpc/sysctl.c in the Linux kernel 2.6.26.3 does not check the length of a certain buffer obtained from us (no CVSS)
- [CVE-2008-1389](https://cve.now/CVE-2008-1389.md): libclamav/chmunpack.c in the chm-parser in ClamAV before 0.94 allows remote attackers to cause a denial of service (application crash) via a (no CVSS)
- [CVE-2008-2441](https://cve.now/CVE-2008-2441.md): Cisco Secure ACS 3.x before 3.3(4) Build 12 patch 7, 4.0.x, 4.1.x before 4.1(4) Build 13 Patch 11, and 4.2.x before 4.2(0) Build 124 Patch 4 (no CVSS)
- [CVE-2008-2732](https://cve.now/CVE-2008-2732.md): Multiple unspecified vulnerabilities in the SIP inspection functionality in Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.0 (no CVSS)
- [CVE-2008-2733](https://cve.now/CVE-2008-2733.md): Cisco PIX and Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2, 8.0 before 8.0(3)14, and 8.1 before 8.1(1)4, when configure (no CVSS)
- [CVE-2008-2734](https://cve.now/CVE-2008-2734.md): Memory leak in the crypto functionality in Cisco Adaptive Security Appliance (ASA) 5500 devices 7.2 before 7.2(4)2, 8.0 before 8.0(3)14, and (no CVSS)
- [CVE-2008-2735](https://cve.now/CVE-2008-2735.md): The HTTP server in Cisco Adaptive Security Appliance (ASA) 5500 devices 8.0 before 8.0(3)15 and 8.1 before 8.1(1)5, when configured as a cli (no CVSS)
- [CVE-2008-2736](https://cve.now/CVE-2008-2736.md): Unspecified vulnerability in Cisco Adaptive Security Appliance (ASA) 5500 devices 8.0(3)15, 8.0(3)16, 8.1(1)4, and 8.1(1)5, when configured (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-09-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.