# CVEs published 2008-12-03

17 CVEs were published on December 3, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-5320](https://cve.now/CVE-2008-5320.md): SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-5321](https://cve.now/CVE-2008-5321.md): SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5322](https://cve.now/CVE-2008-5322.md): Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinf (no CVSS)
- [CVE-2008-5323](https://cve.now/CVE-2008-5323.md): Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2008-5080](https://cve.now/CVE-2008-5080.md): awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripti (no CVSS)
- [CVE-2008-5318](https://cve.now/CVE-2008-5318.md): Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to "size of user-provided input," a different (no CVSS)
- [CVE-2008-5319](https://cve.now/CVE-2008-5319.md): Unspecified vulnerability in Tikiwiki before 2.2 has unknown impact and attack vectors related to tiki-error.php, a different issue than CVE (no CVSS)
- [CVE-2008-3057](https://cve.now/CVE-2008-3057.md): Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, whic (no CVSS)
- [CVE-2008-3058](https://cve.now/CVE-2008-3058.md): Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arb (no CVSS)
- [CVE-2008-3059](https://cve.now/CVE-2008-3059.md): member/settings\_account.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in (no CVSS)
- [CVE-2008-5276](https://cve.now/CVE-2008-5276.md): Integer overflow in the ReadRealIndex function in real.c in the Real demuxer plugin in VideoLAN VLC media player 0.9.0 through 0.9.7 allows (no CVSS)
- [CVE-2008-5312](https://cve.now/CVE-2008-5312.md): mailscanner 4.55.10 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain (no CVSS)
- [CVE-2008-5313](https://cve.now/CVE-2008-5313.md): mailscanner 4.68.8 and other versions before 4.74.16-1 might allow local users to overwrite arbitrary files via a symlink attack on certain (no CVSS)
- [CVE-2008-5314](https://cve.now/CVE-2008-5314.md): Stack consumption vulnerability in libclamav/special.c in ClamAV before 0.94.2 allows remote attackers to cause a denial of service (daemon (no CVSS)
- [CVE-2008-5315](https://cve.now/CVE-2008-5315.md): Directory traversal vulnerability in the web interface in Apple iPhone Configuration Web Utility 1.0 on Windows allows remote attackers to r (no CVSS)
- [CVE-2008-5316](https://cve.now/CVE-2008-5316.md): Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in Little cms color engine (aka lcms) before 1.16 allows attackers to ha (no CVSS)
- [CVE-2008-5317](https://cve.now/CVE-2008-5317.md): Integer signedness error in the cmsAllocGamma function in src/cmsgamma.c in Little cms color engine (aka lcms) before 1.17 allows attackers (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.