# CVEs published 2008-10-29

17 CVEs were published on October 29, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4787](https://cve.now/CVE-2008-4787.md): Visual truncation vulnerability in Microsoft Internet Explorer 6 allows remote attackers to spoof the address bar via a URL with a hostname (no CVSS)
- [CVE-2008-4788](https://cve.now/CVE-2008-4788.md): Microsoft Internet Explorer 6 omits high-bit URL-encoded characters when displaying the address bar, which allows remote attackers to spoof (no CVSS)
- [CVE-2008-4789](https://cve.now/CVE-2008-4789.md): The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access (no CVSS)
- [CVE-2008-4790](https://cve.now/CVE-2008-4790.md): The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files at (no CVSS)
- [CVE-2008-4791](https://cve.now/CVE-2008-4791.md): The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules an (no CVSS)
- [CVE-2008-4792](https://cve.now/CVE-2008-4792.md): The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Dr (no CVSS)
- [CVE-2008-4793](https://cve.now/CVE-2008-4793.md): The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknow (no CVSS, drupal/drupal)
- [CVE-2008-4777](https://cve.now/CVE-2008-4777.md): SQL injection vulnerability in the Showroom Joomlearn LMS (com\_lms) component for Joomla! and Mambo allows remote attackers to execute arbit (no CVSS)
- [CVE-2008-4778](https://cve.now/CVE-2008-4778.md): SQL injection vulnerability in the gallery module in Koobi CMS 4.3.0 allows remote attackers to execute arbitrary SQL commands via the galid (no CVSS)
- [CVE-2008-4779](https://cve.now/CVE-2008-4779.md): Stack-based buffer overflow in TUGzip 3.5.0.0 allows remote attackers to denial of service (crash) or execute arbitrary code via a long file (no CVSS)
- [CVE-2008-4780](https://cve.now/CVE-2008-4780.md): Directory traversal vulnerability in admin/centre.php in MyForum 1.3, when register\_globals is enabled, allows remote attackers to include a (no CVSS)
- [CVE-2008-4781](https://cve.now/CVE-2008-4781.md): Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary local files via a . (no CVSS)
- [CVE-2008-4782](https://cve.now/CVE-2008-4782.md): SQL injection vulnerability in public/code/cp\_polls\_results.php in All In One Control Panel (AIOCP) 1.4 allows remote attackers to execute a (no CVSS)
- [CVE-2008-4783](https://cve.now/CVE-2008-4783.md): tlAds 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the tlAds\_login cookie to "admin." (no CVSS)
- [CVE-2008-4784](https://cve.now/CVE-2008-4784.md): aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflog\_auth\_a cookie to "A" or "O" (no CVSS)
- [CVE-2008-4785](https://cve.now/CVE-2008-4785.md): SQL injection vulnerability in newuser.php in the alternate\_profiles plugin, possibly 0.2, for e107 allows remote attackers to execute arbit (no CVSS)
- [CVE-2008-4786](https://cve.now/CVE-2008-4786.md): SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.