# CVEs published 2008-09-24 31 CVEs were published on September 24, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-0016](https://cve.now/CVE-2008-0016.md): Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote a (no CVSS) - [CVE-2008-3835](https://cve.now/CVE-2008-3835.md): The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 a (no CVSS) - [CVE-2008-3836](https://cve.now/CVE-2008-3836.md): feedWriter in Mozilla Firefox before 2.0.0.17 allows remote attackers to execute scripts with chrome privileges via vectors related to feed (no CVSS) - [CVE-2008-3837](https://cve.now/CVE-2008-3837.md): Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window dur (no CVSS) - [CVE-2008-4058](https://cve.now/CVE-2008-4058.md): The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 al (no CVSS) - [CVE-2008-4059](https://cve.now/CVE-2008-4059.md): The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code (no CVSS) - [CVE-2008-4060](https://cve.now/CVE-2008-4060.md): Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cre (no CVSS) - [CVE-2008-4061](https://cve.now/CVE-2008-4061.md): Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey (no CVSS) - [CVE-2008-4062](https://cve.now/CVE-2008-4062.md): Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey bef (no CVSS) - [CVE-2008-4063](https://cve.now/CVE-2008-4063.md): Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corrupt (no CVSS) - [CVE-2008-4064](https://cve.now/CVE-2008-4064.md): Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corrupt (no CVSS) - [CVE-2008-4065](https://cve.now/CVE-2008-4065.md): Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to byp (no CVSS) - [CVE-2008-4066](https://cve.now/CVE-2008-4066.md): Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechan (no CVSS) - [CVE-2008-4067](https://cve.now/CVE-2008-4067.md): Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before (no CVSS) - [CVE-2008-4068](https://cve.now/CVE-2008-4068.md): Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before (no CVSS) - [CVE-2008-4069](https://cve.now/CVE-2008-4069.md): The XBM decoder in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to read uninitialized memory, and pos (no CVSS) - [CVE-2008-3098](https://cve.now/CVE-2008-3098.md): Cross-site scripting (XSS) vulnerability in admin/usercheck.php in fuzzylime (cms) before 3.03 allows remote attackers to inject arbitrary w (no CVSS) - [CVE-2008-3663](https://cve.now/CVE-2008-3663.md): Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http r (no CVSS) - [CVE-2008-4202](https://cve.now/CVE-2008-4202.md): SQL injection vulnerability in index.php in Gonafish LinksCaffePRO 4.5 allows remote attackers to execute arbitrary SQL commands via the idd (no CVSS) - [CVE-2008-4203](https://cve.now/CVE-2008-4203.md): SQL injection vulnerability in cn\_users.php in CzarNews 1.20 and earlier allows remote attackers to execute arbitrary SQL commands via a rec (no CVSS) - [CVE-2008-4204](https://cve.now/CVE-2008-4204.md): SQL injection vulnerability in city.asp in SoftAcid Hotel Reservation System (HRS) allows remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2008-4205](https://cve.now/CVE-2008-4205.md): SQL injection vulnerability in search.php Attachmax Dolphin 2.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS) - [CVE-2008-4206](https://cve.now/CVE-2008-4206.md): PHP remote file inclusion vulnerability in config.php in Attachmax Dolphin 2.1.0 and earlier, when register\_globals is enabled, allows remot (no CVSS) - [CVE-2008-4207](https://cve.now/CVE-2008-4207.md): Attachmax Dolphin 2.1.0 and earlier does not properly protect info.php in the main folder, which allows remote attackers to obtain sensitive (no CVSS) - [CVE-2008-4208](https://cve.now/CVE-2008-4208.md): Unspecified vulnerability in OSADS Alliance Database before 2.1 has unknown impact and attack vectors, possibly related to includes/function (no CVSS) - [CVE-2008-3102](https://cve.now/CVE-2008-3102.md): Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can caus (no CVSS) - [CVE-2008-4190](https://cve.now/CVE-2008-4190.md): The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execut (no CVSS) - [CVE-2008-4191](https://cve.now/CVE-2008-4191.md): extract-table.pl in Emacspeak 26 and 28 allows local users to overwrite arbitrary files via a symlink attack on the extract-table.csv tempor (no CVSS) - [CVE-2008-4193](https://cve.now/CVE-2008-4193.md): Stack-based buffer overflow in SecurityGateway.dll in Alt-N Technologies SecurityGateway 1.0.1 allows remote attackers to execute arbitrary (no CVSS) - [CVE-2008-4194](https://cve.now/CVE-2008-4194.md): The p\_exec\_query function in src/dns\_query.c in pdnsd before 1.2.7-par allows remote attackers to cause a denial of service (daemon crash) v (no CVSS) - [CVE-2008-4201](https://cve.now/CVE-2008-4201.md): Heap-based buffer overflow in the decodeMP4file function (frontend/main.c) in FAAD2 2.6.1 and earlier allows remote attackers to cause a den (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-09-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.