# CVEs published 2008-10-03

35 CVEs were published on October 3, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4383](https://cve.now/CVE-2008-4383.md): Stack-based buffer overflow in the Agranet-Emweb embedded management web server in Alcatel OmniSwitch OS7000, OS6600, OS6800, OS6850, and OS (no CVSS)
- [CVE-2008-4423](https://cve.now/CVE-2008-4423.md): SQL injection vulnerability in index.php in Ovidentia 6.6.5 allows remote attackers to execute arbitrary SQL commands via the item parameter (no CVSS)
- [CVE-2008-4424](https://cve.now/CVE-2008-4424.md): Cross-site scripting (XSS) vulnerability in index.php in Domain Group Network GooCMS 1.02 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2008-4425](https://cve.now/CVE-2008-4425.md): Directory traversal vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote attackers to delete arb (no CVSS)
- [CVE-2008-4426](https://cve.now/CVE-2008-4426.md): Cross-site scripting (XSS) vulnerability in events.php in Phlatline's Personal Information Manager (pPIM) 1.0 allows remote attackers to inj (no CVSS)
- [CVE-2008-4427](https://cve.now/CVE-2008-4427.md): changepassword.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier does not require administrative authentication, which (no CVSS)
- [CVE-2008-4428](https://cve.now/CVE-2008-4428.md): Unrestricted file upload vulnerability in upload.php in Phlatline's Personal Information Manager (pPIM) 1.0 and earlier allows remote attack (no CVSS)
- [CVE-2008-4429](https://cve.now/CVE-2008-4429.md): Unspecified vulnerability in SOURCENEXT Virus Security ZERO 9.5.0173 and earlier and Virus Security 9.5.0173 and earlier allows remote attac (no CVSS)
- [CVE-2008-4431](https://cve.now/CVE-2008-4431.md): SQL injection vulnerability in index.php in IceBB 1.0-rc9.3 and earlier allows remote attackers to execute arbitrary SQL commands via the sk (no CVSS)
- [CVE-2008-4432](https://cve.now/CVE-2008-4432.md): Cross-site scripting (XSS) vulnerability in search.php in the RMSOFT MiniShop module 1.0 for Xoops allows remote attackers to inject arbitra (no CVSS)
- [CVE-2008-4433](https://cve.now/CVE-2008-4433.md): SQL injection vulnerability in search.php in the RMSOFT MiniShop module 1.0 for Xoops might allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-4434](https://cve.now/CVE-2008-4434.md): Stack-based buffer overflow in (1) uTorrent 1.7.7 build 8179 and earlier and (2) BitTorrent 6.0.3 build 8642 and earlier allows remote attac (no CVSS)
- [CVE-2008-4435](https://cve.now/CVE-2008-4435.md): Multiple cross-site scripting (XSS) vulnerabilities in the RMSOFT Downloads Plus (rmdp) module 1.5 and 1.7 for Xoops allow remote attackers (no CVSS)
- [CVE-2008-4436](https://cve.now/CVE-2008-4436.md): SQL injection vulnerability in bblog\_plugins/builtin.help.php in bBlog 0.7.6 allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-4437](https://cve.now/CVE-2008-4437.md): Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach\_path is enabled, allows rem (no CVSS)
- [CVE-2008-4438](https://cve.now/CVE-2008-4438.md): Cross-site scripting (XSS) vulnerability in search.php in Datafeed Studio 1.6.2 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-4439](https://cve.now/CVE-2008-4439.md): PHP remote file inclusion vulnerability in admin/bin/patch.php in MartinWood Datafeed Studio before 1.6.3 allows remote attackers to execute (no CVSS)
- [CVE-2008-4440](https://cve.now/CVE-2008-4440.md): The to-upgrade plugin in feta 1.4.16 allows local users to overwrite arbitrary files via a symlink on the (1) /tmp/feta.install.$USER and (2 (no CVSS)
- [CVE-2008-3832](https://cve.now/CVE-2008-3832.md): A certain Fedora patch for the utrace subsystem in the Linux kernel before 2.6.26.5-28 on Fedora 8, and before 2.6.26.5-45 on Fedora 9, allo (no CVSS)
- [CVE-2008-3833](https://cve.now/CVE-2008-3833.md): The generic\_file\_splice\_write function in fs/splice.c in the Linux kernel before 2.6.19 does not properly strip setuid and setgid bits when (no CVSS)
- [CVE-2008-4359](https://cve.now/CVE-2008-4359.md): lighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect and (2) url.rewrite configuration settings before performing URL de (no CVSS)
- [CVE-2008-4360](https://cve.now/CVE-2008-4360.md): mod\_userdir in lighttpd before 1.4.20, when a case-insensitive operating system or filesystem is used, performs case-sensitive comparisons o (no CVSS)
- [CVE-2008-4405](https://cve.now/CVE-2008-4405.md): xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest (no CVSS)
- [CVE-2008-4406](https://cve.now/CVE-2008-4406.md): A certain Debian patch to the run scripts for sabre (aka xsabre) 0.2.4b allows local users to delete or overwrite arbitrary files via a syml (no CVSS)
- [CVE-2008-4407](https://cve.now/CVE-2008-4407.md): XRunSabre in sabre (aka xsabre) 0.2.4b relies on the ability to create /tmp/sabre.log, which allows local users to cause a denial of service (no CVSS)
- [CVE-2008-4408](https://cve.now/CVE-2008-4408.md): Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.1, 1.12.0, and possibly other versions before 1.13.2 allows remote attackers to i (no CVSS)
- [CVE-2008-4409](https://cve.now/CVE-2008-4409.md): libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to (no CVSS)
- [CVE-2008-4410](https://cve.now/CVE-2008-4410.md): The vmi\_write\_ldt\_entry function in arch/x86/kernel/vmi\_32.c in the Virtual Machine Interface (VMI) in the Linux kernel 2.6.26.5 invokes wri (no CVSS)
- [CVE-2008-2236](https://cve.now/CVE-2008-2236.md): Cross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before 2.1.2 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-2439](https://cve.now/CVE-2008-2439.md): Directory traversal vulnerability in the UpdateAgent function in TmListen.exe in the OfficeScanNT Listener service in the client in Trend Mi (no CVSS)
- [CVE-2008-2476](https://cve.now/CVE-2008-2476.md): The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 F (no CVSS)
- [CVE-2008-3825](https://cve.now/CVE-2008-3825.md): pam\_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the existing\_ticket option is enabled, uses incorrect privileges when (no CVSS)
- [CVE-2008-4402](https://cve.now/CVE-2008-4402.md): Multiple buffer overflows in CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build (no CVSS)
- [CVE-2008-4403](https://cve.now/CVE-2008-4403.md): The CGI modules in the server in Trend Micro OfficeScan 8.0 SP1 before build 2439 and 8.0 SP1 Patch 1 before build 3087 allow remote attacke (no CVSS)
- [CVE-2008-4404](https://cve.now/CVE-2008-4404.md): The IPv6 Neighbor Discovery Protocol (NDP) implementation on IBM zSeries servers does not validate the origin of Neighbor Discovery messages (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.