# CVEs published 2008-10-20

13 CVEs were published on October 20, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4618](https://cve.now/CVE-2008-4618.md): The Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.27 does not properly handle a protocol violati (no CVSS)
- [CVE-2008-4619](https://cve.now/CVE-2008-4619.md): The RPC subsystem in Sun Solaris 9 allows remote attackers to cause a denial of service (daemon crash) via a crafted request to procedure 8 (no CVSS)
- [CVE-2008-4617](https://cve.now/CVE-2008-4617.md): SQL injection vulnerability in the actualite module 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2008-4611](https://cve.now/CVE-2008-4611.md): SQL injection vulnerability in index.php in PHP Arsivimiz Php Ziyaretci Defteri allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2008-4612](https://cve.now/CVE-2008-4612.md): Cross-site scripting (XSS) vulnerability in PortalApp 4.0 allows remote attackers to inject arbitrary web script or HTML via the keywords pa (no CVSS)
- [CVE-2008-4613](https://cve.now/CVE-2008-4613.md): SQL injection vulnerability in forums.asp in PortalApp 4.0 allows remote attackers to execute arbitrary SQL commands via the sortby paramete (no CVSS)
- [CVE-2008-4614](https://cve.now/CVE-2008-4614.md): PortalApp 4.0 does not require authentication for (1) forums.asp and (2) content.asp, which allows remote attackers to create and delete for (no CVSS)
- [CVE-2008-4615](https://cve.now/CVE-2008-4615.md): Unspecified vulnerability in i\_utils.asp in PortalApp before 4.01a has unknown impact and attack vectors. (no CVSS)
- [CVE-2008-4616](https://cve.now/CVE-2008-4616.md): The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to cal (no CVSS)
- [CVE-2007-6718](https://cve.now/CVE-2007-6718.md): MPlayer, possibly 1.0rc1, allows remote attackers to cause a denial of service (SIGSEGV and application crash) via (1) a malformed MP3 file, (no CVSS)
- [CVE-2008-3831](https://cve.now/CVE-2008-3831.md): The i915 driver in (1) drivers/char/drm/i915\_dma.c in the Linux kernel 2.6.24 on Debian GNU/Linux and (2) sys/dev/pci/drm/i915\_drv.c in Open (no CVSS)
- [CVE-2008-4609](https://cve.now/CVE-2008-4609.md): The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operatin (no CVSS)
- [CVE-2008-4610](https://cve.now/CVE-2008-4610.md): MPlayer allows remote attackers to cause a denial of service (application crash) via (1) a malformed AAC file, as demonstrated by lol-vlc.aa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.