# CVEs published 2008-10-31

28 CVEs were published on October 31, 2008: 0 critical, 1 high. Days are UTC.

- [CVE-2008-4874](https://cve.now/CVE-2008-4874.md): The web component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 has a back door "service" account with "serv (no CVSS)
- [CVE-2008-4875](https://cve.now/CVE-2008-4875.md): Directory traversal vulnerability in the web server in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1.0.4.80 allows rem (no CVSS)
- [CVE-2008-4876](https://cve.now/CVE-2008-4876.md): Cross-site scripting (XSS) vulnerability in the web server component in Philips Electronics VOIP841 DECT Phone with firmware 1.0.4.50 and 1. (no CVSS)
- [CVE-2008-4877](https://cve.now/CVE-2008-4877.md): SQL injection vulnerability in admin.php in WebCards 1.3, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2008-4878](https://cve.now/CVE-2008-4878.md): Unrestricted file upload vulnerability in the "Add Image Macro" feature in WebCards 1.3 allows remote authenticated administrators to execut (no CVSS)
- [CVE-2008-4863](https://cve.now/CVE-2008-4863.md): Untrusted search path vulnerability in BPY\_interface in Blender 2.46 allows local users to execute arbitrary code via a Trojan horse Python (no CVSS)
- [CVE-2008-4864](https://cve.now/CVE-2008-4864.md): Multiple integer overflows in imageop.c in the imageop module in Python 1.5.2 through 2.5.1 allow context-dependent attackers to break out o (no CVSS)
- [CVE-2008-4865](https://cve.now/CVE-2008-4865.md): Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc (no CVSS)
- [CVE-2008-4866](https://cve.now/CVE-2008-4866.md): Multiple buffer overflows in libavformat/utils.c in FFmpeg 0.4.9 before r14715, as used by MPlayer, allow context-dependent attackers to hav (no CVSS)
- [CVE-2008-4867](https://cve.now/CVE-2008-4867.md): Buffer overflow in libavcodec/dca.c in FFmpeg 0.4.9 before r14917, as used by MPlayer, allows context-dependent attackers to have an unknown (no CVSS)
- [CVE-2008-4868](https://cve.now/CVE-2008-4868.md): Unspecified vulnerability in the avcodec\_close function in libavcodec/utils.c in FFmpeg 0.4.9 before r14787, as used by MPlayer, has unknown (no CVSS)
- [CVE-2008-4869](https://cve.now/CVE-2008-4869.md): FFmpeg 0.4.9, as used by MPlayer, allows context-dependent attackers to cause a denial of service (memory consumption) via unknown vectors, (no CVSS)
- [CVE-2008-4870](https://cve.now/CVE-2008-4870.md): dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows loca (no CVSS)
- [CVE-2008-4871](https://cve.now/CVE-2008-4871.md): Cross-site scripting (XSS) vulnerability in My Little Forum 1.75 and 2.0 Beta 23 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-4872](https://cve.now/CVE-2008-4872.md): Cross-site scripting (XSS) vulnerability in bidhistory.php in iTechBids Gold 5.0 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-4873](https://cve.now/CVE-2008-4873.md): board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a (no CVSS)
- [CVE-2008-4309](https://cve.now/CVE-2008-4309.md): Integer overflow in the netsnmp\_create\_subtree\_cache function in agent/snmp\_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and (CVSS 7.5)
- [CVE-2007-6432](https://cve.now/CVE-2007-6432.md): Stack-based buffer overflow in AldFs32.dll in Adobe PageMaker 7.0.1 and 7.0.2 allows user-assisted remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2008-4805](https://cve.now/CVE-2008-4805.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-4806](https://cve.now/CVE-2008-4806.md): Multiple SQL injection vulnerabilities in IBM Lotus Connections 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2008-4807](https://cve.now/CVE-2008-4807.md): IBM Lotus Connections 2.x before 2.0.1 stores the password for the administrative user in the trace.log file, which allows local users to ob (no CVSS)
- [CVE-2008-4808](https://cve.now/CVE-2008-4808.md): IBM Lotus Connections 2.x before 2.0.1 allows attackers to discover passwords via unspecified vectors. (no CVSS)
- [CVE-2008-4809](https://cve.now/CVE-2008-4809.md): Multiple unspecified vulnerabilities in the Profiles search pages in IBM Lotus Connections 2.x before 2.0.1 have unknown impact and attack v (no CVSS)
- [CVE-2008-4810](https://cve.now/CVE-2008-4810.md): The \_expand\_quoted\_text function in libs/Smarty\_Compiler.class.php in Smarty 2.6.20 before r2797 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-4811](https://cve.now/CVE-2008-4811.md): The \_expand\_quoted\_text function in libs/Smarty\_Compiler.class.php in Smarty 2.6.20 r2797 and earlier allows remote attackers to execute arb (no CVSS)
- [CVE-2008-4802](https://cve.now/CVE-2008-4802.md): Cross-site scripting (XSS) vulnerability in complete.php in Simple PHP Scripts blog 0.3 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2008-4803](https://cve.now/CVE-2008-4803.md): Cross-site scripting (XSS) vulnerability in index.php in Simple PHP Scripts gallery 0.1, 0.3, and 0.4 allows remote attackers to inject arbi (no CVSS)
- [CVE-2008-4804](https://cve.now/CVE-2008-4804.md): SQL injection vulnerability in the Gallery module 1.3 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the aid par (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-10-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.