# CVEs published 2008-09-23

17 CVEs were published on September 23, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4187](https://cve.now/CVE-2008-4187.md): Directory traversal vulnerability in index.php in ProActive CMS allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-4188](https://cve.now/CVE-2008-4188.md): Unspecified vulnerability in the TYPO3 Secure Directory (kw\_secdir) extension before 1.0.2 allows remote attackers to execute arbitrary code (no CVSS)
- [CVE-2008-3661](https://cve.now/CVE-2008-3661.md): Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sen (no CVSS)
- [CVE-2008-4174](https://cve.now/CVE-2008-4174.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dynamic MP3 Lister 2.0.1 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-4175](https://cve.now/CVE-2008-4175.md): Multiple SQL injection vulnerabilities in Link Bid Script 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) ucat para (no CVSS)
- [CVE-2008-4176](https://cve.now/CVE-2008-4176.md): SQL injection vulnerability in izle.asp in FoT Video scripti 1.1 beta allows remote attackers to execute arbitrary SQL commands via the oyun (no CVSS)
- [CVE-2008-4177](https://cve.now/CVE-2008-4177.md): SQL injection vulnerability in search.php in Pre Real Estate Listings allows remote attackers to execute arbitrary SQL commands via the c pa (no CVSS)
- [CVE-2008-4178](https://cve.now/CVE-2008-4178.md): SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Bui (no CVSS)
- [CVE-2008-4179](https://cve.now/CVE-2008-4179.md): Multiple cross-site scripting (XSS) vulnerabilities in NooMS 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) p (no CVSS)
- [CVE-2008-4180](https://cve.now/CVE-2008-4180.md): Unspecified vulnerability in db.php in NooMS 1.1 allows remote attackers to conduct brute force attacks against passwords via a username in (no CVSS)
- [CVE-2008-4181](https://cve.now/CVE-2008-4181.md): Directory traversal vulnerability in includes/xml.php in the Netenberg Fantastico De Luxe module before 2.10.4 r19 for cPanel, when cPanel P (no CVSS)
- [CVE-2008-4182](https://cve.now/CVE-2008-4182.md): Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possib (no CVSS)
- [CVE-2008-4183](https://cve.now/CVE-2008-4183.md): IntegraMOD 1.4.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS)
- [CVE-2008-4184](https://cve.now/CVE-2008-4184.md): Cross-site scripting (XSS) vulnerability in index.php in webCMS Portal Edition allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-4185](https://cve.now/CVE-2008-4185.md): SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id param (no CVSS)
- [CVE-2008-4186](https://cve.now/CVE-2008-4186.md): SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id\_doc p (no CVSS)
- [CVE-2008-3519](https://cve.now/CVE-2008-3519.md): The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 befo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.