# CVEs published 2008-11-21 26 CVEs were published on November 21, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-5190](https://cve.now/CVE-2008-5190.md): SQL injection vulnerability in index.php in eSHOP100 allows remote attackers to execute arbitrary SQL commands via the SUB parameter. (no CVSS) - [CVE-2008-5191](https://cve.now/CVE-2008-5191.md): Multiple SQL injection vulnerabilities in SePortal 2.4 allow remote attackers to execute arbitrary SQL commands via the (1) poll\_id paramete (no CVSS) - [CVE-2008-5192](https://cve.now/CVE-2008-5192.md): SQL injection vulnerability in forum.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2008-5193](https://cve.now/CVE-2008-5193.md): Cross-site scripting (XSS) vulnerability in search.asp in W1L3D4 Philboard 1.14 and 1.2 allows remote attackers to inject arbitrary web scri (no CVSS) - [CVE-2008-5194](https://cve.now/CVE-2008-5194.md): SQL injection vulnerability in checkavail.php in SoftVisions Software Online Booking Manager (obm) 2.2 allows remote attackers to execute ar (no CVSS) - [CVE-2008-5195](https://cve.now/CVE-2008-5195.md): Multiple SQL injection vulnerabilities in SebracCMS (sbcms) 0.4 allow remote attackers to execute arbitrary SQL commands via (1) the recid p (no CVSS) - [CVE-2008-5196](https://cve.now/CVE-2008-5196.md): SQL injection vulnerability in kroax.php in the Kroax (the\_kroax) 4.42 and earlier module for PHP-Fusion allows remote attackers to execute (no CVSS) - [CVE-2008-5197](https://cve.now/CVE-2008-5197.md): SQL injection vulnerability in classifieds.php in PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the lid parameter (no CVSS) - [CVE-2008-5198](https://cve.now/CVE-2008-5198.md): SQL injection vulnerability in memberlist.php in Acmlmboard 1.A2 allows remote attackers to execute arbitrary SQL commands via the pow param (no CVSS) - [CVE-2008-5199](https://cve.now/CVE-2008-5199.md): PHP remote file inclusion vulnerability in include.php in PHPOutsourcing IdeaBox (aka IdeBox) 1.1 allows remote attackers to execute arbitra (no CVSS) - [CVE-2008-5200](https://cve.now/CVE-2008-5200.md): SQL injection vulnerability in the Xe webtv (com\_xewebtv) component for Joomla! allows remote attackers to execute arbitrary SQL commands vi (no CVSS) - [CVE-2008-5201](https://cve.now/CVE-2008-5201.md): Directory traversal vulnerability in index.php in OTManager CMS 24a allows remote attackers to include and execute arbitrary local files via (no CVSS) - [CVE-2008-5202](https://cve.now/CVE-2008-5202.md): Cross-site scripting (XSS) vulnerability in index.php in OTManager CMS 24a allows remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2008-5203](https://cve.now/CVE-2008-5203.md): Cross-site scripting (XSS) vulnerability in external\_vote.php in PowerAward 1.1.0 RC1 allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2008-5204](https://cve.now/CVE-2008-5204.md): Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register\_globals is enabled, allow remote attackers to include an (no CVSS) - [CVE-2008-5205](https://cve.now/CVE-2008-5205.md): Cross-site scripting (XSS) vulnerability in edit.php in wellyblog allows remote attackers to inject arbitrary web script or HTML via the art (no CVSS) - [CVE-2008-5206](https://cve.now/CVE-2008-5206.md): PHP remote file inclusion vulnerability in modules/mod\_mainmenu.php in MosXML 1 Alpha allows remote attackers to execute arbitrary PHP code (no CVSS) - [CVE-2008-5207](https://cve.now/CVE-2008-5207.md): Multiple directory traversal vulnerabilities in Jonascms 1.2 allow remote attackers to include and execute arbitrary local files via a .. (no CVSS) - [CVE-2008-5189](https://cve.now/CVE-2008-5189.md): CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respons (no CVSS, rails) - [CVE-2008-5182](https://cve.now/CVE-2008-5182.md): The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to ra (no CVSS) - [CVE-2008-5183](https://cve.now/CVE-2008-5183.md): cupsd in CUPS 1.3.9 and earlier allows local users, and possibly remote attackers, to cause a denial of service (daemon crash) by adding a l (no CVSS) - [CVE-2008-5184](https://cve.now/CVE-2008-5184.md): The web interface (cgi-bin/admin.c) in CUPS before 1.3.8 uses the guest username when a user is not logged on to the web server, which makes (no CVSS) - [CVE-2008-5185](https://cve.now/CVE-2008-5185.md): The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via a (no CVSS) - [CVE-2008-5186](https://cve.now/CVE-2008-5186.md): The set\_language\_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct fil (no CVSS) - [CVE-2008-5187](https://cve.now/CVE-2008-5187.md): The load function in the XPM loader for imlib2 1.4.2, and possibly other versions, allows attackers to cause a denial of service (crash) and (no CVSS) - [CVE-2008-5188](https://cve.now/CVE-2008-5188.md): The (1) ecryptfs-setup-private, (2) ecryptfs-setup-confidential, and (3) ecryptfs-setup-pam-wrapped.sh scripts in ecryptfs-utils 45 through (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-11-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.