# CVEs published 2008-09-16 25 CVEs were published on September 16, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-2305](https://cve.now/CVE-2008-2305.md): Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to execute (no CVSS) - [CVE-2008-2312](https://cve.now/CVE-2008-2312.md): Network Preferences in Apple Mac OS X 10.4.11 stores PPP passwords in cleartext in a world-readable file, which allows local users to obtain (no CVSS) - [CVE-2008-2329](https://cve.now/CVE-2008-2329.md): Directory Services in Apple Mac OS X 10.5 through 10.5.4, when Active Directory is used, allows attackers to enumerate user names via wildca (no CVSS) - [CVE-2008-2330](https://cve.now/CVE-2008-2330.md): slapconfig in Directory Services in Apple Mac OS X 10.5 through 10.5.4 allows local users to select a readable output file into which the se (no CVSS) - [CVE-2008-2331](https://cve.now/CVE-2008-2331.md): Finder in Apple Mac OS X 10.5 through 10.5.4 does not properly update permission data in the Get Info window after a lock operation that mod (no CVSS) - [CVE-2008-2332](https://cve.now/CVE-2008-2332.md): ImageIO in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows context-dependent attackers to cause a denial of service (memory corruption (no CVSS) - [CVE-2008-3608](https://cve.now/CVE-2008-3608.md): ImageIO in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows context-dependent attackers to cause a denial of service (memory corruption (no CVSS) - [CVE-2008-3609](https://cve.now/CVE-2008-3609.md): The kernel in Apple Mac OS X 10.5 through 10.5.4 does not properly flush cached credentials during recycling (aka purging) of a vnode, which (no CVSS) - [CVE-2008-3610](https://cve.now/CVE-2008-3610.md): Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4, when a blank-password account is enabled, allows attackers to bypass p (no CVSS) - [CVE-2008-3611](https://cve.now/CVE-2008-3611.md): Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by pol (no CVSS) - [CVE-2008-3613](https://cve.now/CVE-2008-3613.md): Finder in Apple Mac OS X 10.5.2 through 10.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and applicatio (no CVSS) - [CVE-2008-3616](https://cve.now/CVE-2008-3616.md): Multiple integer overflows in the SearchKit API in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allow context-dependent attackers to cause (no CVSS) - [CVE-2008-3617](https://cve.now/CVE-2008-3617.md): Remote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a password for a VNC viewer, displays additiona (no CVSS) - [CVE-2008-3618](https://cve.now/CVE-2008-3618.md): The File Sharing pane in the Sharing preference pane in Apple Mac OS X 10.5 through 10.5.4 does not inform users that the complete contents (no CVSS) - [CVE-2008-3619](https://cve.now/CVE-2008-3619.md): Time Machine in Apple Mac OS X 10.5 through 10.5.4 uses weak permissions for Time Machine Backup log files, which allows local users to obta (no CVSS) - [CVE-2008-3621](https://cve.now/CVE-2008-3621.md): VideoConference in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to cause a denial of service (memory corruption an (no CVSS) - [CVE-2008-3622](https://cve.now/CVE-2008-3622.md): Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5 through 10.5.4 allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2008-3950](https://cve.now/CVE-2008-3950.md): Off-by-one error in the \_web\_drawInRect:withFont:ellipsis:alignment:measureOnly function in WebKit in Safari in Apple iPhone 1.1.4 and 2.0 a (no CVSS) - [CVE-2008-4111](https://cve.now/CVE-2008-4111.md): Unspecified vulnerability in Servlet Engine/Web Container in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1 (no CVSS) - [CVE-2008-4113](https://cve.now/CVE-2008-4113.md): The sctp\_getsockopt\_hmac\_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux (no CVSS) - [CVE-2008-4114](https://cve.now/CVE-2008-4114.md): srv.sys in the Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 al (no CVSS) - [CVE-2008-4115](https://cve.now/CVE-2008-4115.md): TalkBack 2.3.6 allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo (no CVSS) - [CVE-2008-2437](https://cve.now/CVE-2008-2437.md): Stack-based buffer overflow in cgiRecvFile.exe in Trend Micro OfficeScan 7.3 patch 4 build 1362 and other builds, OfficeScan 8.0 and 8.0 SP1 (no CVSS) - [CVE-2008-4110](https://cve.now/CVE-2008-4110.md): Buffer overflow in the SQLVDIRLib.SQLVDirControl ActiveX control in Tools\\Binn\\sqlvdir.dll in Microsoft SQL Server 2000 (aka SQL Server 8.0) (no CVSS) - [CVE-2008-4095](https://cve.now/CVE-2008-4095.md): Multiple unspecified vulnerabilities in the Importer in Flip4Mac WMV before 2.2.1 have unknown impact and attack vectors, different vulnerab (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-09-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.