# CVEs published 2008-12-15 26 CVEs were published on December 15, 2008: 0 critical, 0 high. Days are UTC. - [CVE-2008-5559](https://cve.now/CVE-2008-5559.md): SQL injection vulnerability in sendcard.cfm in PostEcards allows remote attackers to execute arbitrary SQL commands via the cid parameter. (no CVSS) - [CVE-2008-5560](https://cve.now/CVE-2008-5560.md): PostEcards stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the d (no CVSS) - [CVE-2008-5561](https://cve.now/CVE-2008-5561.md): SQL injection vulnerability in Netref 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) fiche\_produc (no CVSS) - [CVE-2008-5562](https://cve.now/CVE-2008-5562.md): ASPPortal stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the da (no CVSS) - [CVE-2008-5563](https://cve.now/CVE-2008-5563.md): Aruba Mobility Controller 2.4.8.x-FIPS, 2.5.x, 3.1.x, 3.2.x, 3.3.1.x, and 3.3.2.x allows remote attackers to cause a denial of service (devi (no CVSS) - [CVE-2008-5564](https://cve.now/CVE-2008-5564.md): Unspecified vulnerability in the media server in Orb Networks Orb before 2.01.0025 allows remote attackers to cause a denial of service (dae (no CVSS) - [CVE-2008-5565](https://cve.now/CVE-2008-5565.md): Cross-site request forgery (CSRF) vulnerability in admin/settings.php in DL PayCart 1.34 and earlier allows remote attackers to change the a (no CVSS) - [CVE-2008-5566](https://cve.now/CVE-2008-5566.md): Cross-site scripting (XSS) vulnerability in index.php in Triangle Solutions PHP Multiple Newsletters 2.7 allows remote attackers to inject a (no CVSS) - [CVE-2008-5567](https://cve.now/CVE-2008-5567.md): Cross-site request forgery (CSRF) vulnerability in admin/ad\_settings.php in Bonza Cart 1.10 and earlier allows remote attackers to change th (no CVSS) - [CVE-2008-5568](https://cve.now/CVE-2008-5568.md): Cross-site request forgery (CSRF) vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the ad (no CVSS) - [CVE-2008-5569](https://cve.now/CVE-2008-5569.md): Multiple cross-site scripting (XSS) vulnerabilities in PHPepperShop 1.4 allow remote attackers to inject arbitrary web script or HTML via th (no CVSS) - [CVE-2008-5570](https://cve.now/CVE-2008-5570.md): Directory traversal vulnerability in index.php in PHP Multiple Newsletters 2.7, when magic\_quotes\_gpc is disabled, allows remote attackers t (no CVSS) - [CVE-2008-5571](https://cve.now/CVE-2008-5571.md): SQL injection vulnerability in admin/login.asp in Professional Download Assistant 0.1 allows remote attackers to execute arbitrary SQL comma (no CVSS) - [CVE-2008-5572](https://cve.now/CVE-2008-5572.md): Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, which allows remote at (no CVSS) - [CVE-2008-5573](https://cve.now/CVE-2008-5573.md): SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) Passw (no CVSS) - [CVE-2008-5574](https://cve.now/CVE-2008-5574.md): SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL commands via the u param (no CVSS) - [CVE-2008-5575](https://cve.now/CVE-2008-5575.md): Session fixation vulnerability in Pro Clan Manager 0.4.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID (no CVSS) - [CVE-2008-5576](https://cve.now/CVE-2008-5576.md): admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a (no CVSS) - [CVE-2008-5577](https://cve.now/CVE-2008-5577.md): PHP remote file inclusion vulnerability in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to execute arbitrary PHP (no CVSS) - [CVE-2008-5578](https://cve.now/CVE-2008-5578.md): Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL co (no CVSS) - [CVE-2008-5579](https://cve.now/CVE-2008-5579.md): Absolute path traversal vulnerability in mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to read arbitrary files via (no CVSS) - [CVE-2008-5580](https://cve.now/CVE-2008-5580.md): mini-pub.php/front-end/cat.php in mini-pub 0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the sFileNa (no CVSS) - [CVE-2008-5581](https://cve.now/CVE-2008-5581.md): PHP remote file inclusion vulnerability in mini-pub.php/front-end/img.php in mini-pub 0.3 allows remote attackers to execute arbitrary PHP c (no CVSS) - [CVE-2008-5582](https://cve.now/CVE-2008-5582.md): SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2008-5583](https://cve.now/CVE-2008-5583.md): Cross-site request forgery (CSRF) vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an (no CVSS) - [CVE-2008-5584](https://cve.now/CVE-2008-5584.md): Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2008-12-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.