# CVEs published 2008-12-17

72 CVEs were published on December 17, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-5500](https://cve.now/CVE-2008-5500.md): The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1 (no CVSS)
- [CVE-2008-5501](https://cve.now/CVE-2008-5501.md): The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attack (no CVSS)
- [CVE-2008-5502](https://cve.now/CVE-2008-5502.md): The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attack (no CVSS)
- [CVE-2008-5503](https://cve.now/CVE-2008-5503.md): The loadBindingDocument function in Mozilla Firefox 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 do (no CVSS)
- [CVE-2008-5504](https://cve.now/CVE-2008-5504.md): Mozilla Firefox 2.x before 2.0.0.19 allows remote attackers to run arbitrary JavaScript with chrome privileges via vectors related to the fe (no CVSS)
- [CVE-2008-5505](https://cve.now/CVE-2008-5505.md): Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy restrictions by using the persist attribute in an XUL el (no CVSS)
- [CVE-2008-5506](https://cve.now/CVE-2008-5506.md): Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote att (no CVSS)
- [CVE-2008-5507](https://cve.now/CVE-2008-5507.md): Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote atta (no CVSS)
- [CVE-2008-5508](https://cve.now/CVE-2008-5508.md): Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly (no CVSS)
- [CVE-2008-5510](https://cve.now/CVE-2008-5510.md): The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 (no CVSS)
- [CVE-2008-5511](https://cve.now/CVE-2008-5511.md): Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote att (no CVSS)
- [CVE-2008-5512](https://cve.now/CVE-2008-5512.md): Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMo (no CVSS)
- [CVE-2008-5513](https://cve.now/CVE-2008-5513.md): Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers (no CVSS)
- [CVE-2008-5656](https://cve.now/CVE-2008-5656.md): Cross-site scripting (XSS) vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remo (no CVSS, typo3/cms-felogin)
- [CVE-2008-5657](https://cve.now/CVE-2008-5657.md): CRLF injection vulnerability in Quassel Core before 0.3.0.3 allows remote attackers to spoof IRC messages as other users via a crafted CTCP (no CVSS)
- [CVE-2008-5658](https://cve.now/CVE-2008-5658.md): Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write (no CVSS)
- [CVE-2008-5659](https://cve.now/CVE-2008-5659.md): The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and earlier uses a predictable seed based on the system time, which makes it e (no CVSS)
- [CVE-2008-5660](https://cve.now/CVE-2008-5660.md): Format string vulnerability in the vinagre\_utils\_show\_error function (src/vinagre-utils.c) in Vinagre 0.5.x before 0.5.2 and 2.x before 2.24 (no CVSS)
- [CVE-2008-5661](https://cve.now/CVE-2008-5661.md): The IPv4 Forwarding feature in Sun Solaris 10 and OpenSolaris snv\_47 through snv\_82, with certain patches installed, allows remote attackers (no CVSS)
- [CVE-2008-5662](https://cve.now/CVE-2008-5662.md): Multiple buffer overflows in Sun Java Wireless Toolkit (WTK) for CLDC 2.5.2 and earlier allow downloaded programs to execute arbitrary code (no CVSS)
- [CVE-2008-5643](https://cve.now/CVE-2008-5643.md): SQL injection vulnerability in the Books (com\_books) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5644](https://cve.now/CVE-2008-5644.md): Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script or (no CVSS, typo3/cms-backend)
- [CVE-2008-5645](https://cve.now/CVE-2008-5645.md): Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2008-5646](https://cve.now/CVE-2008-5646.md): Unspecified vulnerability in Trac before 0.11.2 allows attackers to cause a denial of service via unknown attack vectors related to "certain (no CVSS, trac)
- [CVE-2008-5647](https://cve.now/CVE-2008-5647.md): Unspecified vulnerability in the HTML sanitizer filter in Trac before 0.11.2 allows attackers to conduct phishing attacks via unknown attack (no CVSS, trac)
- [CVE-2008-5648](https://cve.now/CVE-2008-5648.md): SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-5649](https://cve.now/CVE-2008-5649.md): SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-5650](https://cve.now/CVE-2008-5650.md): SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-5651](https://cve.now/CVE-2008-5651.md): SQL injection vulnerability in plugins/bookmarker/bookmarker\_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute a (no CVSS)
- [CVE-2008-5652](https://cve.now/CVE-2008-5652.md): SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-5653](https://cve.now/CVE-2008-5653.md): SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2008-5654](https://cve.now/CVE-2008-5654.md): SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-5655](https://cve.now/CVE-2008-5655.md): Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) d (no CVSS)
- [CVE-2008-5558](https://cve.now/CVE-2008-5558.md): Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remo (no CVSS)
- [CVE-2008-5624](https://cve.now/CVE-2008-5624.md): PHP 5 before 5.2.7 does not properly initialize the page\_uid and page\_gid global variables for use by the SAPI php\_getuid function, which al (no CVSS)
- [CVE-2008-5625](https://cve.now/CVE-2008-5625.md): PHP 5 before 5.2.7 does not enforce the error\_log safe\_mode restrictions when safe\_mode is enabled through a php\_admin\_flag setting in httpd (no CVSS)
- [CVE-2008-5626](https://cve.now/CVE-2008-5626.md): XM Easy Personal FTP Server 5.6.0 allows remote authenticated users to cause a denial of service via a crafted argument to the NLST command, (no CVSS)
- [CVE-2008-5627](https://cve.now/CVE-2008-5627.md): SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username (no CVSS)
- [CVE-2008-5628](https://cve.now/CVE-2008-5628.md): SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term paramete (no CVSS)
- [CVE-2008-5629](https://cve.now/CVE-2008-5629.md): SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id param (no CVSS)
- [CVE-2008-5630](https://cve.now/CVE-2008-5630.md): SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-5631](https://cve.now/CVE-2008-5631.md): SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL commands via the (1) userem (no CVSS)
- [CVE-2008-5632](https://cve.now/CVE-2008-5632.md): SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2008-5633](https://cve.now/CVE-2008-5633.md): SQL injection vulnerability in register.asp in ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) usernam (no CVSS)
- [CVE-2008-5634](https://cve.now/CVE-2008-5634.md): SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2008-5635](https://cve.now/CVE-2008-5635.md): SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) us (no CVSS)
- [CVE-2008-5636](https://cve.now/CVE-2008-5636.md): SQL injection vulnerability in cate.php in Lito Lite CMS, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2008-5637](https://cve.now/CVE-2008-5637.md): SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter. (no CVSS)
- [CVE-2008-5638](https://cve.now/CVE-2008-5638.md): Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL commands via the (1) Pro (no CVSS)
- [CVE-2008-5639](https://cve.now/CVE-2008-5639.md): Directory traversal vulnerability in index.php in TxtBlog 1.0 Alpha allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-5640](https://cve.now/CVE-2008-5640.md): SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL commands via the ItemID pa (no CVSS)
- [CVE-2008-5641](https://cve.now/CVE-2008-5641.md): SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2008-5642](https://cve.now/CVE-2008-5642.md): Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-5081](https://cve.now/CVE-2008-5081.md): The originates\_from\_local\_legacy\_unicast\_socket function (avahi-core/server.c) in avahi-daemon in Avahi before 0.6.24 allows remote attacker (no CVSS)
- [CVE-2008-5617](https://cve.now/CVE-2008-5617.md): The ACL handling in rsyslog 3.12.1 to 3.20.0, 4.1.0, and 4.1.1 does not follow $AllowedSender directive, which allows remote attackers to by (no CVSS)
- [CVE-2008-5618](https://cve.now/CVE-2008-5618.md): imudp in rsyslog 4.x before 4.1.2, 3.21 before 3.21.9 beta, and 3.20 before 3.20.2 generates a message even when it is sent by an unauthoriz (no CVSS)
- [CVE-2008-5619](https://cve.now/CVE-2008-5619.md): html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2 (no CVSS, phpmailer/phpmailer)
- [CVE-2008-5620](https://cve.now/CVE-2008-5620.md): RoundCube Webmail (roundcubemail) before 0.2-beta allows remote attackers to cause a denial of service (memory consumption) via crafted size (no CVSS)
- [CVE-2008-5621](https://cve.now/CVE-2008-5621.md): Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perfo (no CVSS)
- [CVE-2008-4217](https://cve.now/CVE-2008-4217.md): Integer signedness error in BOM in Apple Mac OS X before 10.5.6 allows remote attackers to execute arbitrary code via the headers in a craft (no CVSS)
- [CVE-2008-4218](https://cve.now/CVE-2008-4218.md): Multiple integer overflows in the kernel in Apple Mac OS X before 10.5.6 on Intel platforms allow local users to gain privileges via a craft (no CVSS)
- [CVE-2008-4219](https://cve.now/CVE-2008-4219.md): The kernel in Apple Mac OS X before 10.5.6 allows local users to cause a denial of service (infinite loop and system halt) by running an app (no CVSS)
- [CVE-2008-4220](https://cve.now/CVE-2008-4220.md): Integer overflow in the inet\_net\_pton API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to execute arbitra (no CVSS)
- [CVE-2008-4221](https://cve.now/CVE-2008-4221.md): The strptime API in Libsystem in Apple Mac OS X before 10.5.6 allows context-dependent attackers to cause a denial of service (memory corrup (no CVSS)
- [CVE-2008-4222](https://cve.now/CVE-2008-4222.md): natd in network\_cmds in Apple Mac OS X before 10.5.6, when Internet Sharing is enabled, allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2008-4223](https://cve.now/CVE-2008-4223.md): Podcast Producer in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to bypass authentication and gain administrative access via un (no CVSS)
- [CVE-2008-4224](https://cve.now/CVE-2008-4224.md): UDF in Apple Mac OS X before 10.5.6 allows user-assisted attackers to cause a denial of service (system crash) via a malformed UDF volume in (no CVSS)
- [CVE-2008-4234](https://cve.now/CVE-2008-4234.md): Incomplete blacklist vulnerability in the Quarantine feature in CoreTypes in Apple Mac OS X 10.5 before 10.5.6 allows user-assisted remote a (no CVSS)
- [CVE-2008-4236](https://cve.now/CVE-2008-4236.md): Apple Type Services (ATS) in Apple Mac OS X 10.5 before 10.5.6 allows remote attackers to cause a denial of service (infinite loop) via a cr (no CVSS)
- [CVE-2008-4237](https://cve.now/CVE-2008-4237.md): Managed Client in Apple Mac OS X before 10.5.6 sometimes misidentifies a system when installing per-host configuration settings, which allow (no CVSS)
- [CVE-2008-5609](https://cve.now/CVE-2008-5609.md): SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-5616](https://cve.now/CVE-2008-5616.md): Stack-based buffer overflow in the demux\_open\_vqf function in libmpdemux/demux\_vqf.c in MPlayer 1.0 rc2 before r28150 allows remote attacker (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.