# CVEs published 2008-09-19 26 CVEs were published on September 19, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-4154](https://cve.now/CVE-2008-4154.md): SQL injection vulnerability in living-e webEdition CMS allows remote attackers to execute arbitrary SQL commands via the we\_objectID paramet (no CVSS) - [CVE-2008-4155](https://cve.now/CVE-2008-4155.md): Multiple directory traversal vulnerabilities in EasySite 2.3 allow remote attackers to read arbitrary files or list directories via a .. (no CVSS) - [CVE-2008-4156](https://cve.now/CVE-2008-4156.md): SQL injection vulnerability in print.php in CustomCms (CCMS) Gaming Portal 4.0, when magic\_quotes\_gpc is disabled, allows remote attackers t (no CVSS) - [CVE-2008-4136](https://cve.now/CVE-2008-4136.md): Michael Roth Software Personal FTP Server (PFT) 6.0f allows remote attackers to cause a denial of service (service crash) via multiple RETR (no CVSS) - [CVE-2008-4137](https://cve.now/CVE-2008-4137.md): PHP remote file inclusion vulnerability in footer.php in PHP-Crawler 0.8 allows remote attackers to execute arbitrary PHP code via a URL in (no CVSS) - [CVE-2008-4138](https://cve.now/CVE-2008-4138.md): PHP remote file inclusion vulnerability in skin\_shop/standard/3\_plugin\_twindow/twindow\_notice.php in TECHNOTE 7 allows remote attackers to e (no CVSS) - [CVE-2008-4139](https://cve.now/CVE-2008-4139.md): Cross-site scripting (XSS) vulnerability in admin.php in OpenSolution Quick.Cms.Lite 2.1 allows remote attackers to inject arbitrary web scr (no CVSS) - [CVE-2008-4140](https://cve.now/CVE-2008-4140.md): Cross-site scripting (XSS) vulnerability in admin.php in Quick.Cart 3.1 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS) - [CVE-2008-4141](https://cve.now/CVE-2008-4141.md): Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to execute arbitrary PH (no CVSS) - [CVE-2008-4142](https://cve.now/CVE-2008-4142.md): SQL injection vulnerability in article.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the es\_id parameter. (no CVSS) - [CVE-2008-4143](https://cve.now/CVE-2008-4143.md): SQL injection vulnerability in category\_search.php in RazorCommerce Shopping Cart allows remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2008-4144](https://cve.now/CVE-2008-4144.md): SQL injection vulnerability in index.php in ACG-ScriptShop E-Gold Script Shop allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2008-4145](https://cve.now/CVE-2008-4145.md): SQL injection vulnerability in user\_read\_links.php in Addalink 1.0 beta 4 and earlier, when magic\_quotes\_gpc is disabled, allows remote atta (no CVSS) - [CVE-2008-4146](https://cve.now/CVE-2008-4146.md): Addalink 1.0 beta 4 and earlier allows remote attackers to (1) approve web-site additions via a modified approved field and (2) change the v (no CVSS) - [CVE-2008-4147](https://cve.now/CVE-2008-4147.md): Cross-site scripting (XSS) vulnerability in the Mailsave module 5.x before 5.x-3.3 and 6.x before 6.x-1.3, a module for Drupal, allows remot (no CVSS) - [CVE-2008-4148](https://cve.now/CVE-2008-4148.md): SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attacker (no CVSS) - [CVE-2008-4149](https://cve.now/CVE-2008-4149.md): Cross-site scripting (XSS) vulnerability in the Greg Holsclaw Link to Us module 5.x before 5.x-1.1 for Drupal allows remote authenticated us (no CVSS) - [CVE-2008-4150](https://cve.now/CVE-2008-4150.md): SQL injection vulnerability in picture\_category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id (no CVSS) - [CVE-2008-4151](https://cve.now/CVE-2008-4151.md): Directory traversal vulnerability in collect.php in CYASK 3.x allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2008-4152](https://cve.now/CVE-2008-4152.md): Cross-site scripting (XSS) vulnerability in the Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, allows remote au (no CVSS) - [CVE-2008-4153](https://cve.now/CVE-2008-4153.md): The Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, does not perform access checks for a node before displaying (no CVSS) - [CVE-2008-4131](https://cve.now/CVE-2008-4131.md): Multiple unspecified vulnerabilities in Sun Solaris 8 through 10 allow local users to gain privileges via vectors related to handling of tag (no CVSS) - [CVE-2008-4132](https://cve.now/CVE-2008-4132.md): Stack-based buffer overflow in the VSFlexGrid.VSFlexGridL ActiveX control in ComponentOne VSFlexGrid 7.0.1.151 and 8.0.20072.239 allows remo (no CVSS) - [CVE-2008-4133](https://cve.now/CVE-2008-4133.md): The web proxy service on the D-Link DIR-100 with firmware 1.12 and earlier does not properly filter web requests with large URLs, which allo (no CVSS) - [CVE-2008-4134](https://cve.now/CVE-2008-4134.md): PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other versions before 0.05, a (no CVSS) - [CVE-2008-4135](https://cve.now/CVE-2008-4135.md): Symbian OS S60 3rd edition on the Nokia E90 Communicator 07.40.1.2 Ra-6 and Nseries N82 allows remote attackers to cause a denial of service (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-09-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.