# CVEs published 2008-10-15

42 CVEs were published on October 15, 2008: 0 critical, 1 high. Days are UTC.

- [CVE-2008-4583](https://cve.now/CVE-2008-4583.md): Insecure method vulnerability in the Chilkat FTP 2.0 ActiveX component (ChilkatCert.dll) allows remote attackers to overwrite arbitrary file (no CVSS)
- [CVE-2008-4584](https://cve.now/CVE-2008-4584.md): Insecure method vulnerability in Chilkat Mail 7.8 ActiveX control (ChilkatCert.dll) allows remote attackers to overwrite arbitrary files via (no CVSS)
- [CVE-2008-4585](https://cve.now/CVE-2008-4585.md): Belong Software Site Builder 0.1 beta allows remote attackers to bypass intended access restrictions and perform administrative actions via (no CVSS)
- [CVE-2008-4586](https://cve.now/CVE-2008-4586.md): Insecure method vulnerability in the MVSNCLientWebAgent61.WebAgent.1 ActiveX control (isusweb.dll 6.1.100.61372) in Macrovision FLEXnet Conn (no CVSS)
- [CVE-2008-4587](https://cve.now/CVE-2008-4587.md): Insecure method vulnerability in the MSVNClientDownloadManager61Lib.DownloadManager.1 ActiveX control (ISDM.exe 6.1.100.61372) in Macrovisio (no CVSS)
- [CVE-2008-4588](https://cve.now/CVE-2008-4588.md): Stack-based buffer overflow in the FTP server in Etype Eserv 3.x, possibly 3.26, allows remote attackers to cause a denial of service (daemo (no CVSS)
- [CVE-2008-4589](https://cve.now/CVE-2008-4589.md): Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows lo (no CVSS)
- [CVE-2008-4577](https://cve.now/CVE-2008-4577.md): The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass (no CVSS)
- [CVE-2008-4578](https://cve.now/CVE-2008-4578.md): The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized (no CVSS)
- [CVE-2008-4579](https://cve.now/CVE-2008-4579.md): The (1) fence\_apc and (2) fence\_apc\_snmp programs, as used in (a) fence 2.02.00-r1 and possibly (b) cman, when running in verbose mode, allo (no CVSS)
- [CVE-2008-4580](https://cve.now/CVE-2008-4580.md): fence\_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence\_ (no CVSS)
- [CVE-2008-4581](https://cve.now/CVE-2008-4581.md): The Editor in IBM ENOVIA SmarTeam 5 before release 18 SP5, and release 19 before SP01, allows remote authenticated users to bypass intended (no CVSS)
- [CVE-2008-4582](https://cve.now/CVE-2008-4582.md): Mozilla Firefox 3.0.1 through 3.0.3, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13, when running on Windows, do not properly (no CVSS)
- [CVE-2008-4553](https://cve.now/CVE-2008-4553.md): qemu-make-debian-root in qemu 0.9.1-5 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on temporary (no CVSS)
- [CVE-2008-4554](https://cve.now/CVE-2008-4554.md): The do\_splice\_from function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the O\_APPEND flag se (no CVSS)
- [CVE-2008-4575](https://cve.now/CVE-2008-4575.md): Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2008-4576](https://cve.now/CVE-2008-4576.md): sctp in Linux kernel before 2.6.25.18 allows remote attackers to cause a denial of service (OOPS) via an INIT-ACK that states the peer does (no CVSS)
- [CVE-2008-4569](https://cve.now/CVE-2008-4569.md): SQL injection vulnerability in xlacomments.asp in XIGLA Software Absolute Poll Manager XE 4.1 allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2008-4570](https://cve.now/CVE-2008-4570.md): SQL injection vulnerability in index.php in Real Estate Classifieds allows remote attackers to execute arbitrary SQL commands via the cat pa (no CVSS)
- [CVE-2008-4571](https://cve.now/CVE-2008-4571.md): Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web scri (no CVSS, plone)
- [CVE-2008-4572](https://cve.now/CVE-2008-4572.md): GuildFTPd 0.999.14, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary (no CVSS)
- [CVE-2008-4573](https://cve.now/CVE-2008-4573.md): SQL injection vulnerability in kategori.asp in MunzurSoft Wep Portal W3 allows remote attackers to execute arbitrary SQL commands via the ka (no CVSS)
- [CVE-2008-4574](https://cve.now/CVE-2008-4574.md): SQL injection vulnerability in default.asp in Ayco Okul Portali allows remote attackers to execute arbitrary SQL commands via the linkid par (no CVSS)
- [CVE-2008-1446](https://cve.now/CVE-2008-1446.md): Integer overflow in the Internet Printing Protocol (IPP) ISAPI extension in Microsoft Internet Information Services (IIS) 5.0 through 7.0 on (no CVSS)
- [CVE-2008-2250](https://cve.now/CVE-2008-2250.md): The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly val (no CVSS)
- [CVE-2008-2251](https://cve.now/CVE-2008-2251.md): Double free vulnerability in the kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Serv (no CVSS)
- [CVE-2008-2252](https://cve.now/CVE-2008-2252.md): The kernel in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 does not properly val (no CVSS)
- [CVE-2008-3464](https://cve.now/CVE-2008-3464.md): afd.sys in the Ancillary Function Driver (AFD) component in Microsoft Windows XP SP2 and SP3 and Windows Server 2003 SP1 and SP2 does not pr (no CVSS)
- [CVE-2008-3466](https://cve.now/CVE-2008-3466.md): Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote atta (no CVSS)
- [CVE-2008-3471](https://cve.now/CVE-2008-3471.md): Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Of (no CVSS)
- [CVE-2008-3472](https://cve.now/CVE-2008-3472.md): Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att (no CVSS)
- [CVE-2008-3473](https://cve.now/CVE-2008-3473.md): Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att (no CVSS)
- [CVE-2008-3474](https://cve.now/CVE-2008-3474.md): Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote att (CVSS 6.5)
- [CVE-2008-3475](https://cve.now/CVE-2008-3475.md): Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been ( (no CVSS)
- [CVE-2008-3476](https://cve.now/CVE-2008-3476.md): Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remo (no CVSS)
- [CVE-2008-3477](https://cve.now/CVE-2008-3477.md): Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Off (no CVSS)
- [CVE-2008-3479](https://cve.now/CVE-2008-3479.md): Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers (no CVSS)
- [CVE-2008-4019](https://cve.now/CVE-2008-4019.md): Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 20 (no CVSS)
- [CVE-2008-4020](https://cve.now/CVE-2008-4020.md): Cross-site scripting (XSS) vulnerability in Microsoft Office XP SP3 allows remote attackers to inject arbitrary web script or HTML via a doc (no CVSS)
- [CVE-2008-4023](https://cve.now/CVE-2008-4023.md): Active Directory in Microsoft Windows 2000 SP4 does not properly allocate memory for (1) LDAP and (2) LDAPS requests, which allows remote at (no CVSS)
- [CVE-2008-4036](https://cve.now/CVE-2008-4036.md): Integer overflow in Memory Manager in Microsoft Windows XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows (CVSS 8.4)
- [CVE-2008-4038](https://cve.now/CVE-2008-4038.md): Buffer underflow in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.