# CVEs published 2008-09-30

41 CVEs were published on September 30, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4361](https://cve.now/CVE-2008-4361.md): Directory traversal vulnerability in PowerPortal 2.0.13 allows remote attackers to list and possibly read arbitrary files via a .. (no CVSS)
- [CVE-2008-4362](https://cve.now/CVE-2008-4362.md): The Virtual Token driver (vdlptokn.sys) 1.0.2.43 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) via a craf (no CVSS)
- [CVE-2008-4363](https://cve.now/CVE-2008-4363.md): DLMFENC.sys 1.0.0.28 in DESlock+ 3.2.7 allows local users to cause a denial of service (system crash) or potentially execute arbitrary code (no CVSS)
- [CVE-2008-4364](https://cve.now/CVE-2008-4364.md): SQL injection vulnerability in default.aspx in ParsaGostar ParsaWeb CMS allows remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2008-4365](https://cve.now/CVE-2008-4365.md): Cross-site scripting (XSS) vulnerability in search.php in Siteman 1.1.11 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-4366](https://cve.now/CVE-2008-4366.md): Unrestricted file upload vulnerability in the image upload component in Camera Life 2.6.2b4 allows remote authenticated users to execute arb (no CVSS)
- [CVE-2008-4345](https://cve.now/CVE-2008-4345.md): SQL injection vulnerability in download.php in WebPortal CMS 0.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-4346](https://cve.now/CVE-2008-4346.md): Directory traversal vulnerability in TalkBack 2.3.6 and 2.3.6.4 allows remote attackers to include and execute arbitrary local files via a . (no CVSS)
- [CVE-2008-4347](https://cve.now/CVE-2008-4347.md): SQL injection vulnerability in newskom.php in Powie pNews 2.03 allows remote attackers to execute arbitrary SQL commands via the newsid para (no CVSS)
- [CVE-2008-4348](https://cve.now/CVE-2008-4348.md): SQL injection vulnerability in photo.php in PHPortfolio, possibly 1.3, allows remote attackers to execute arbitrary SQL commands via the id (no CVSS)
- [CVE-2008-4349](https://cve.now/CVE-2008-4349.md): Multiple cross-site scripting (XSS) vulnerabilities in news.php in s0nic Paranews 3.4 allow remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-4350](https://cve.now/CVE-2008-4350.md): SQL injection vulnerability in main.php in vbLOGIX Tutorial Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-4351](https://cve.now/CVE-2008-4351.md): Directory traversal vulnerability in index.php in phpSmartCom 0.2 allows remote attackers to include and execute arbitrary files via a .. (no CVSS)
- [CVE-2008-4352](https://cve.now/CVE-2008-4352.md): SQL injection vulnerability in inc/pages/viewprofile.php in phpSmartCom 0.2 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-4353](https://cve.now/CVE-2008-4353.md): SQL injection vulnerability in link.php in Linkarity allows remote attackers to execute arbitrary SQL commands via the cat\_id parameter. (no CVSS)
- [CVE-2008-4354](https://cve.now/CVE-2008-4354.md): SQL injection vulnerability in the products module in NetArt Media iBoutique 4.0 allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2008-4355](https://cve.now/CVE-2008-4355.md): SQL injection vulnerability in showprofil.php in Powie PSCRIPT Forum (aka PHP Forum or pForum) 1.30 and earlier allows remote attackers to e (no CVSS)
- [CVE-2008-4356](https://cve.now/CVE-2008-4356.md): Multiple SQL injection vulnerabilities in Kasseler CMS 1.1.0 and 1.2.0 allow remote attackers to execute arbitrary SQL commands via (1) the (no CVSS)
- [CVE-2008-4357](https://cve.now/CVE-2008-4357.md): SQL injection vulnerability in linkto.php in Powie pLink 2.07 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2008-4358](https://cve.now/CVE-2008-4358.md): Unspecified vulnerability in class/theme.class.php in SPAW Editor PHP Edition before 2.0.8.1 has unknown impact and attack vectors, probably (no CVSS)
- [CVE-2008-4094](https://cve.now/CVE-2008-4094.md): Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :l (no CVSS, activerecord)
- [CVE-2008-4328](https://cve.now/CVE-2008-4328.md): SQL injection vulnerability in site\_search.php in EasyRealtorPRO 2008 allows remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2008-4329](https://cve.now/CVE-2008-4329.md): PHP remote file inclusion vulnerability in cms/system/openengine.php in openEngine 2.0 beta4 and earlier allows remote attackers to execute (no CVSS)
- [CVE-2008-4330](https://cve.now/CVE-2008-4330.md): Directory traversal vulnerability in index.php in LanSuite 3.3.2 allows remote attackers to include and execute arbitrary local files via a (no CVSS)
- [CVE-2008-4331](https://cve.now/CVE-2008-4331.md): Directory traversal vulnerability in library/pagefunctions.inc.php in phpOCS 0.1 beta3 and earlier allows remote attackers to include and ex (no CVSS)
- [CVE-2008-4332](https://cve.now/CVE-2008-4332.md): SQL injection vulnerability in the showjavatopic function in func.php in PHP infoBoard V.7 Plus allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-4333](https://cve.now/CVE-2008-4333.md): Cross-site scripting (XSS) vulnerability in PHP infoBoard V.7 Plus allows remote attackers to inject arbitrary web script or HTML via the is (no CVSS)
- [CVE-2008-4334](https://cve.now/CVE-2008-4334.md): PHP infoBoard V.7 Plus allows remote attackers to bypass authentication and gain administrative access by setting the infouser cookie to 1. (no CVSS)
- [CVE-2008-4335](https://cve.now/CVE-2008-4335.md): SQL injection vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-4336](https://cve.now/CVE-2008-4336.md): Cross-site scripting (XSS) vulnerability in album.php in Atomic Photo Album (APA) 1.1.0pre4 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-4337](https://cve.now/CVE-2008-4337.md): Cross-site scripting (XSS) vulnerability in Bitweaver 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the URL param (no CVSS)
- [CVE-2008-4338](https://cve.now/CVE-2008-4338.md): SQL injection vulnerability in the brilliant\_gallery\_checklist\_save function in the bgchecklist/save script in Brilliant Gallery 5.x and 6.x (no CVSS)
- [CVE-2008-4339](https://cve.now/CVE-2008-4339.md): Unspecified vulnerability in the Java Administration GUI (jnbSA) in Symantec Veritas NetBackup Server and NetBackup Enterprise Server 5.1 be (no CVSS)
- [CVE-2008-4340](https://cve.now/CVE-2008-4340.md): Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers to cause a denial of service (memory consumption) via an HTML document conta (no CVSS)
- [CVE-2008-4341](https://cve.now/CVE-2008-4341.md): add.php in MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication and gain administrative access by setting a cookie with (no CVSS)
- [CVE-2008-4342](https://cve.now/CVE-2008-4342.md): NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier, as used in CDBurnerXP 4.2.1. (no CVSS)
- [CVE-2008-4343](https://cve.now/CVE-2008-4343.md): The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create, overwrite, and (no CVSS)
- [CVE-2008-4344](https://cve.now/CVE-2008-4344.md): SQL injection vulnerability in cat.php in 6rbScript allows remote attackers to execute arbitrary SQL commands via the CatID parameter. (no CVSS)
- [CVE-2008-4325](https://cve.now/CVE-2008-4325.md): lib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP request for the Content-Type header in the HTTP response, which al (no CVSS)
- [CVE-2008-4326](https://cve.now/CVE-2008-4326.md): The PMA\_escapeJsString function in libraries/js\_escape.lib.php in phpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote (no CVSS)
- [CVE-2008-4327](https://cve.now/CVE-2008-4327.md): gdiplus.dll in GDI+ in Microsoft Windows XP SP3 does not properly handle crafted .ico files, which allows remote attackers to cause a denial (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.