# CVEs published 2008-10-22

34 CVEs were published on October 22, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4699](https://cve.now/CVE-2008-4699.md): Insecure method vulnerability in the ActiveX control (PAWWeb11.ocx) in Peachtree Accounting 2004 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-4700](https://cve.now/CVE-2008-4700.md): SQL injection vulnerability in admin.php in Libera CMS 1.12 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to execu (no CVSS)
- [CVE-2008-4701](https://cve.now/CVE-2008-4701.md): SQL injection vulnerability in admin.php in Libera CMS 1.12, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-4702](https://cve.now/CVE-2008-4702.md): Multiple directory traversal vulnerabilities in PhpWebGallery 1.3.4 allow remote attackers to include and execute arbitrary local files via (no CVSS)
- [CVE-2008-4677](https://cve.now/CVE-2008-4677.md): autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores crede (no CVSS)
- [CVE-2008-4678](https://cve.now/CVE-2008-4678.md): The HTTP\_Request\_Parser method in the HTTP Transport component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 allows remote (no CVSS)
- [CVE-2008-4679](https://cve.now/CVE-2008-4679.md): The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.31 and 6.1 before 6.1.0.19, when Certificat (no CVSS)
- [CVE-2008-4680](https://cve.now/CVE-2008-4680.md): packet-usb.c in the USB dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application crash (no CVSS)
- [CVE-2008-4681](https://cve.now/CVE-2008-4681.md): Unspecified vulnerability in the Bluetooth RFCOMM dissector in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2008-4682](https://cve.now/CVE-2008-4682.md): wtap.c in Wireshark 0.99.7 through 1.0.3 allows remote attackers to cause a denial of service (application abort) via a malformed Tamos Comm (no CVSS)
- [CVE-2008-4683](https://cve.now/CVE-2008-4683.md): The dissect\_btacl function in packet-bthci\_acl.c in the Bluetooth ACL dissector in Wireshark 0.99.2 through 1.0.3 allows remote attackers to (no CVSS)
- [CVE-2008-4684](https://cve.now/CVE-2008-4684.md): packet-frame in Wireshark 0.99.2 through 1.0.3 does not properly handle exceptions thrown by post dissectors, which allows remote attackers (no CVSS)
- [CVE-2008-4685](https://cve.now/CVE-2008-4685.md): Use-after-free vulnerability in the dissect\_q931\_cause\_ie function in packet-q931.c in the Q.931 dissector in Wireshark 0.10.3 through 1.0.3 (no CVSS)
- [CVE-2008-4686](https://cve.now/CVE-2008-4686.md): Multiple integer overflows in ty.c in the TY demux plugin (aka the TiVo demuxer) in VideoLAN VLC media player, probably 0.9.4, might allow r (no CVSS)
- [CVE-2008-4687](https://cve.now/CVE-2008-4687.md): manage\_proj\_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP (no CVSS)
- [CVE-2008-4688](https://cve.now/CVE-2008-4688.md): core/string\_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source (no CVSS)
- [CVE-2008-4689](https://cve.now/CVE-2008-4689.md): Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions. (no CVSS)
- [CVE-2008-4690](https://cve.now/CVE-2008-4690.md): lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbi (no CVSS)
- [CVE-2008-4691](https://cve.now/CVE-2008-4691.md): Unspecified vulnerability in the SQLNLS\_UNPADDEDCHARLEN function in the New Compiler (aka Starburst derived compiler) component in the serve (no CVSS)
- [CVE-2008-4692](https://cve.now/CVE-2008-4692.md): The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain (no CVSS)
- [CVE-2008-4693](https://cve.now/CVE-2008-4693.md): The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows (no CVSS)
- [CVE-2008-4665](https://cve.now/CVE-2008-4665.md): SQL injection vulnerability in PG Matchmaking allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) news\_rea (no CVSS)
- [CVE-2008-4666](https://cve.now/CVE-2008-4666.md): SQL injection vulnerability in webboard.php in Ultimate Webboard 3.00 allows remote attackers to execute arbitrary SQL commands via the Cate (no CVSS)
- [CVE-2008-4667](https://cve.now/CVE-2008-4667.md): Directory traversal vulnerability in rss.php in ArabCMS 2.0 beta 1 allows remote attackers to include and execute arbitrary local files via (no CVSS)
- [CVE-2008-4668](https://cve.now/CVE-2008-4668.md): Directory traversal vulnerability in the Image Browser (com\_imagebrowser) 0.1.5 component for Joomla! allows remote attackers to include and (no CVSS)
- [CVE-2008-4669](https://cve.now/CVE-2008-4669.md): Cross-site scripting (XSS) vulnerability in search.php in Dan Fletcher Recipe Script allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-4670](https://cve.now/CVE-2008-4670.md): Cross-site scripting (XSS) vulnerability in search.php in Ed Pudol Clickbank Portal allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2008-4671](https://cve.now/CVE-2008-4671.md): Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2008-4672](https://cve.now/CVE-2008-4672.md): Cross-site scripting (XSS) vulnerability in search\_results.php in buymyscripts Lyrics Script allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-4673](https://cve.now/CVE-2008-4673.md): PHP remote file inclusion vulnerability in panel/common/theme/default/header\_setup.php in WebBiscuits Software Events Calendar 1.1 allows re (no CVSS)
- [CVE-2008-4674](https://cve.now/CVE-2008-4674.md): SQL injection vulnerability in realestate-index.php in Conkurent Real Estate Manager 1.01 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2008-4675](https://cve.now/CVE-2008-4675.md): SQL injection vulnerability in index.php in PHPcounter 1.3.2 and earlier allows remote attackers to execute arbitrary SQL commands via the n (no CVSS)
- [CVE-2008-4676](https://cve.now/CVE-2008-4676.md): Unspecified vulnerability in Citrix XenApp (formerly Presentation Server) 4.5 Feature Pack 1 and earlier, Presentation Server 4.0, and Acces (no CVSS)
- [CVE-2008-4664](https://cve.now/CVE-2008-4664.md): Heap-based buffer overflow in QvodInsert.QvodCtrl.1 ActiveX control (QvodInsert.dll) in QVOD Player before 2.1.5 build 0053 allows remote at (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.