# CVEs published 2008-09-18

18 CVEs were published on September 18, 2008: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-4128](https://cve.now/CVE-2008-4128.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Serv (CVSS 8.1, KEV)
- [CVE-2008-4129](https://cve.now/CVE-2008-4129.md): Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticat (no CVSS)
- [CVE-2008-4130](https://cve.now/CVE-2008-4130.md): Cross-site scripting (XSS) vulnerability in Gallery 2.x before 2.2.6 allows remote attackers to inject arbitrary web script or HTML via a cr (no CVSS)
- [CVE-2008-2470](https://cve.now/CVE-2008-2470.md): The InstallShield Update Service Agent ActiveX control in isusweb.dll allows remote attackers to cause a denial of service (memory corruptio (no CVSS)
- [CVE-2008-3662](https://cve.now/CVE-2008-3662.md): Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the coo (no CVSS)
- [CVE-2008-4099](https://cve.now/CVE-2008-4099.md): PyDNS (aka python-dns) before 2.3.1-4 in Debian GNU/Linux does not use random source ports or transaction IDs for DNS requests, which makes (no CVSS)
- [CVE-2008-4100](https://cve.now/CVE-2008-4100.md): GNU adns 1.4 and earlier uses a fixed source port and sequential transaction IDs for DNS requests, which makes it easier for remote attacker (no CVSS)
- [CVE-2008-4101](https://cve.now/CVE-2008-4101.md): Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell (no CVSS)
- [CVE-2008-4102](https://cve.now/CVE-2008-4102.md): Joomla! 1.5 before 1.5.7 initializes PHP's PRNG with a weak seed, which makes it easier for attackers to guess the pseudo-random values prod (no CVSS)
- [CVE-2008-4103](https://cve.now/CVE-2008-4103.md): The mailto (aka com\_mailto) component in Joomla! 1.5 before 1.5.7 sends e-mail messages without validating the URL, which allows remote atta (no CVSS)
- [CVE-2008-4104](https://cve.now/CVE-2008-4104.md): Multiple open redirect vulnerabilities in Joomla! 1.5 before 1.5.7 allow remote attackers to redirect users to arbitrary web sites and condu (no CVSS, joomla/framework)
- [CVE-2008-4105](https://cve.now/CVE-2008-4105.md): JRequest in Joomla! 1.5 before 1.5.7 does not sanitize variables that were set with JRequest::setVar, which allows remote attackers to condu (no CVSS)
- [CVE-2008-4106](https://cve.now/CVE-2008-4106.md): WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of t (no CVSS)
- [CVE-2008-4107](https://cve.now/CVE-2008-4107.md): The (1) rand and (2) mt\_rand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to levera (no CVSS)
- [CVE-2008-4108](https://cve.now/CVE-2008-4108.md): Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files vi (no CVSS)
- [CVE-2008-4125](https://cve.now/CVE-2008-4125.md): The search function in phpBB 2.x provides a search\_id value that leaks the state of PHP's PRNG, which allows remote attackers to obtain pote (no CVSS)
- [CVE-2008-4126](https://cve.now/CVE-2008-4126.md): PyDNS (aka python-dns) before 2.3.1-5 in Debian GNU/Linux does not use random source ports for DNS requests and does not use random transact (no CVSS)
- [CVE-2008-4127](https://cve.now/CVE-2008-4127.md): Mshtml.dll in Microsoft Internet Explorer 7 Gold 7.0.5730 and 8 Beta 8.0.6001 on Windows XP SP2 allows remote attackers to cause a denial of (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.