# CVEs published 2008-09-27

16 CVEs were published on September 27, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-3528](https://cve.now/CVE-2008-3528.md): The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does (no CVSS)
- [CVE-2008-4070](https://cve.now/CVE-2008-4070.md): Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2008-4119](https://cve.now/CVE-2008-4119.md): Multiple cross-site scripting (XSS) vulnerabilities in CA Service Desk 11.2 and CMDB 11.0 through 11.2 allow remote attackers to inject arbi (no CVSS)
- [CVE-2008-4195](https://cve.now/CVE-2008-4195.md): Opera before 9.52 does not properly restrict the ability of a framed web page to change the address associated with a different frame, which (no CVSS)
- [CVE-2008-4196](https://cve.now/CVE-2008-4196.md): Cross-site scripting (XSS) vulnerability in Opera before 9.52 allows remote attackers to inject arbitrary web script or HTML via unspecified (no CVSS)
- [CVE-2008-4197](https://cve.now/CVE-2008-4197.md): Opera before 9.52 on Windows, Linux, FreeBSD, and Solaris, when processing custom shortcut and menu commands, can produce argument strings t (no CVSS)
- [CVE-2008-4198](https://cve.now/CVE-2008-4198.md): Opera before 9.52, when rendering an http page that has loaded an https page into a frame, displays a padlock icon and offers a security inf (no CVSS)
- [CVE-2008-4199](https://cve.now/CVE-2008-4199.md): Opera before 9.52 does not prevent use of links from web pages to feed source files on the local disk, which might allow remote attackers to (no CVSS)
- [CVE-2008-4200](https://cve.now/CVE-2008-4200.md): Opera before 9.52 does not ensure that the address field of a news feed represents the feed's actual URL, which allows remote attackers to c (no CVSS)
- [CVE-2008-4292](https://cve.now/CVE-2008-4292.md): Opera before 9.52 does not check the CRL override upon encountering a certificate that lacks a CRL, which has unknown impact and attack vect (no CVSS)
- [CVE-2008-4293](https://cve.now/CVE-2008-4293.md): Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol handler, allows remote attackers to cause a denial (no CVSS)
- [CVE-2008-4294](https://cve.now/CVE-2008-4294.md): IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to h (no CVSS)
- [CVE-2008-4295](https://cve.now/CVE-2008-4295.md): Microsoft Windows Mobile 6.0 on HTC Wiza 200 and HTC MDA 8125 devices does not properly handle the first attempt to establish a Bluetooth co (no CVSS)
- [CVE-2008-4296](https://cve.now/CVE-2008-4296.md): The Cisco Linksys WRT350N with firmware 1.0.3.7 has "admin" as its default password for the "admin" account, which makes it easier for remot (no CVSS)
- [CVE-2008-4297](https://cve.now/CVE-2008-4297.md): Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to r (no CVSS)
- [CVE-2008-4298](https://cve.now/CVE-2008-4298.md): Memory leak in the http\_request\_parse function in request.c in lighttpd before 1.4.20 allows remote attackers to cause a denial of service ( (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.