# CVEs published 2008-10-17

17 CVEs were published on October 17, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4599](https://cve.now/CVE-2008-4599.md): SQL injection vulnerability in category.php in Mosaic Commerce allows remote attackers to execute arbitrary SQL commands via the cid paramet (no CVSS)
- [CVE-2008-4600](https://cve.now/CVE-2008-4600.md): configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain administrative acces (no CVSS)
- [CVE-2008-4601](https://cve.now/CVE-2008-4601.md): Cross-site scripting (XSS) vulnerability in the login feature in Habari CMS 0.5.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-4602](https://cve.now/CVE-2008-4602.md): Directory traversal vulnerability in index.php in Post Affiliate Pro 2.0 allows remote authenticated users to read and possibly execute arbi (no CVSS)
- [CVE-2008-4603](https://cve.now/CVE-2008-4603.md): SQL injection vulnerability in search.php in iGaming CMS 2.0 Alpha 1 allows remote attackers to execute arbitrary SQL commands via the keywo (no CVSS)
- [CVE-2008-4604](https://cve.now/CVE-2008-4604.md): SQL injection vulnerability in index.php in Easy CafeEngine 1.1 allows remote attackers to execute arbitrary SQL commands via the itemid par (no CVSS)
- [CVE-2008-4605](https://cve.now/CVE-2008-4605.md): SQL injection vulnerability in CafeEngine allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) dish.php and (no CVSS)
- [CVE-2008-4606](https://cve.now/CVE-2008-4606.md): Multiple SQL injection vulnerabilities in IP Reg 0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) locati (no CVSS)
- [CVE-2008-4595](https://cve.now/CVE-2008-4595.md): Multiple unspecified vulnerabilities in Slaytanic Scripts Content Plus 2.1.1 have unknown impact and remote attack vectors. (no CVSS)
- [CVE-2008-4596](https://cve.now/CVE-2008-4596.md): Cross-site scripting (XSS) vulnerability in Shindig-Integrator 5.x, a module for Drupal, allows remote authenticated users to inject arbitra (no CVSS)
- [CVE-2008-4597](https://cve.now/CVE-2008-4597.md): Shindig-Integrator 5.x, a module for Drupal, does not properly restrict generated page access, which allows remote attackers to gain privile (no CVSS)
- [CVE-2008-4598](https://cve.now/CVE-2008-4598.md): Unspecified vulnerability in Shindig-Integrator 5.x, a module for Drupal, has unspecified impact and remote attack vectors related to "numer (no CVSS)
- [CVE-2008-4412](https://cve.now/CVE-2008-4412.md): Unspecified vulnerability in HP Systems Insight Manager (SIM) before 5.2 Update 2 (C.05.02.02.00) allows remote attackers to obtain sensitiv (no CVSS)
- [CVE-2008-4593](https://cve.now/CVE-2008-4593.md): Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS Preview is disabled, allows physically proximate attacke (no CVSS)
- [CVE-2008-4594](https://cve.now/CVE-2008-4594.md): Unspecified vulnerability in the SNMPv3 component in Linksys WAP4400N firmware 1.2.14 on the Marvell Semiconductor 88W8361P-BEM1 chipset has (no CVSS)
- [CVE-2008-4401](https://cve.now/CVE-2008-4401.md): ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse (no CVSS)
- [CVE-2008-4473](https://cve.now/CVE-2008-4473.md): Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.