# CVEs published 2008-10-08

27 CVEs were published on October 8, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4494](https://cve.now/CVE-2008-4494.md): SQL injection vulnerability in completed-advance.php in TorrentTrader Classic 1.08 and 1.04 and earlier allows remote attackers to execute a (no CVSS)
- [CVE-2008-4495](https://cve.now/CVE-2008-4495.md): SQL injection vulnerability in view\_cat.php in PHP Auto Dealer 2.7 allows remote attackers to execute arbitrary SQL commands via the v\_cat p (no CVSS)
- [CVE-2008-4496](https://cve.now/CVE-2008-4496.md): SQL injection vulnerability in view\_cat.php in PHP Realtor 1.5 allows remote attackers to execute arbitrary SQL commands via the v\_cat param (no CVSS)
- [CVE-2008-4497](https://cve.now/CVE-2008-4497.md): SQL injection vulnerability in event\_detail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-4498](https://cve.now/CVE-2008-4498.md): SQL injection vulnerability in searchresults.php in PHP Autos 2.9.1 allows remote attackers to execute arbitrary SQL commands via the catid (no CVSS)
- [CVE-2008-4499](https://cve.now/CVE-2008-4499.md): Multiple directory traversal vulnerabilities in PHP Web Explorer 0.99b and earlier allow remote attackers to include and execute arbitrary l (no CVSS)
- [CVE-2008-4500](https://cve.now/CVE-2008-4500.md): Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of service (CPU consumption) via a crafte (no CVSS)
- [CVE-2008-4501](https://cve.now/CVE-2008-4501.md): Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to o (no CVSS)
- [CVE-2008-4502](https://cve.now/CVE-2008-4502.md): Multiple PHP remote file inclusion vulnerabilities in DataFeedFile (DFF) PHP Framework API allow remote attackers to execute arbitrary PHP c (no CVSS)
- [CVE-2008-3814](https://cve.now/CVE-2008-3814.md): Unspecified vulnerability in Cisco Unity 4.x before 4.2(1)ES161, 5.x before 5.0(1)ES53, and 7.x before 7.0(2)ES8, when using anonymous authe (no CVSS)
- [CVE-2008-3826](https://cve.now/CVE-2008-3826.md): Unspecified vulnerability in Condor before 7.0.5 allows attackers to execute jobs as other users via unknown vectors. (no CVSS)
- [CVE-2008-3828](https://cve.now/CVE-2008-3828.md): Stack-based buffer overflow in the condor\_ schedd daemon in Condor before 7.0.5 allows attackers to cause a denial of service (crash) and po (no CVSS)
- [CVE-2008-3829](https://cve.now/CVE-2008-3829.md): Unspecified vulnerability in the condor\_ schedd daemon in Condor before 7.0.5 allows attackers to cause a denial of service (crash) via unkn (no CVSS)
- [CVE-2008-3830](https://cve.now/CVE-2008-3830.md): Condor before 7.0.5 does not properly handle when the configuration specifies overlapping netmasks in allow or deny rules, which causes the (no CVSS)
- [CVE-2008-4493](https://cve.now/CVE-2008-4493.md): Microsoft PicturePusher ActiveX control (PipPPush.DLL 7.00.0709), as used in Microsoft Digital Image 2006 Starter Edition, allows remote att (no CVSS)
- [CVE-2008-4491](https://cve.now/CVE-2008-4491.md): Apple Mail.app 3.5 on Mac OS X, when "Store draft messages on the server" is enabled, stores draft copies of S/MIME email in plaintext on th (no CVSS)
- [CVE-2008-4492](https://cve.now/CVE-2008-4492.md): SQL injection vulnerability in referrals.php in YourOwnBux 4.0 allows remote attackers to execute arbitrary SQL commands via the usNick cook (no CVSS)
- [CVE-2008-4481](https://cve.now/CVE-2008-4481.md): Cross-site scripting (XSS) vulnerability in Redmine 0.7.2 and earlier allows remote attackers to inject arbitrary web script or HTML via uns (no CVSS)
- [CVE-2008-4482](https://cve.now/CVE-2008-4482.md): The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service (stack consumption and crash) via (no CVSS)
- [CVE-2008-4483](https://cve.now/CVE-2008-4483.md): Directory traversal vulnerability in index.php in Crux Gallery 1.32 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers (no CVSS)
- [CVE-2008-4484](https://cve.now/CVE-2008-4484.md): main.php in Crux Gallery 1.32 and earlier allows remote attackers to gain administrative access by setting the name parameter to "users," as (no CVSS)
- [CVE-2008-4485](https://cve.now/CVE-2008-4485.md): Cross-site scripting (XSS) vulnerability in the ICAP patience page in Blue Coat Security Gateway OS (SGOS) 4.2 before 4.2.9, 5.2 before 5.2. (no CVSS)
- [CVE-2008-4486](https://cve.now/CVE-2008-4486.md): Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote attackers to include and (no CVSS)
- [CVE-2008-4487](https://cve.now/CVE-2008-4487.md): SQL injection vulnerability in ap-save.php in Atarone CMS 1.2.0 allows remote attackers to execute arbitrary SQL commands via the (1) site\_n (no CVSS)
- [CVE-2008-4488](https://cve.now/CVE-2008-4488.md): Cross-site scripting (XSS) vulnerability in ap-pages.php in Atarone CMS 1.2.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-4489](https://cve.now/CVE-2008-4489.md): Directory traversal vulnerability in ap-save.php in Atarone CMS 1.2.0 allows remote attackers to include and execute arbitrary local files v (no CVSS)
- [CVE-2008-4490](https://cve.now/CVE-2008-4490.md): Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magic\_quotes\_gpc is disabled, allows remote attacke (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.