# CVEs published 2008-12-19

26 CVEs were published on December 19, 2008: 0 critical, 0 high. Days are UTC.

- [CVE-2008-5692](https://cve.now/CVE-2008-5692.md): Ipswitch WS\_FTP Server Manager before 6.1.1, and possibly other Ipswitch products, allows remote attackers to bypass authentication and read (no CVSS)
- [CVE-2008-5693](https://cve.now/CVE-2008-5693.md): Ipswitch WS\_FTP Server Manager 6.1.0.0 and earlier, and possibly other Ipswitch products, might allow remote attackers to read the contents (no CVSS)
- [CVE-2008-5694](https://cve.now/CVE-2008-5694.md): PHP remote file inclusion vulnerability in lib/jpgraph/jpgraph\_errhandler.inc.php in Sandbox 1.4.1 might allow remote attackers to execute a (no CVSS)
- [CVE-2008-5695](https://cve.now/CVE-2008-5695.md): wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, (no CVSS)
- [CVE-2008-5696](https://cve.now/CVE-2008-5696.md): Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the Apac (no CVSS)
- [CVE-2008-0971](https://cve.now/CVE-2008-0971.md): Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Barracuda Spam Firewall (BSF) before 3.5.12.007, Message Archiver before (no CVSS)
- [CVE-2008-1094](https://cve.now/CVE-2008-1094.md): SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 allows remote authentic (no CVSS)
- [CVE-2008-4122](https://cve.now/CVE-2008-4122.md): Joomla! 1.5.8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture (no CVSS)
- [CVE-2008-5078](https://cve.now/CVE-2008-5078.md): Multiple buffer overflows in the (1) recognize\_eps\_file function (src/psgen.c) and (2) tilde\_subst function (src/util.c) in GNU enscript 1.6 (no CVSS)
- [CVE-2008-5086](https://cve.now/CVE-2008-5086.md): Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended acces (no CVSS)
- [CVE-2008-5249](https://cve.now/CVE-2008-5249.md): Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2008-5250](https://cve.now/CVE-2008-5250.md): Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer (no CVSS)
- [CVE-2008-5252](https://cve.now/CVE-2008-5252.md): Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1 (no CVSS)
- [CVE-2008-5684](https://cve.now/CVE-2008-5684.md): Unspecified vulnerability in the X Inter Client Exchange library (aka libICE) in Sun Solaris 8 through 10 and OpenSolaris before snv\_85 allo (no CVSS)
- [CVE-2008-5685](https://cve.now/CVE-2008-5685.md): Sun ScApp firmware 5.18.x, 5.19.x, and 5.20.0 through 5.20.10 on Sun Fire and Netra platforms allows remote attackers to access the System C (no CVSS)
- [CVE-2008-5686](https://cve.now/CVE-2008-5686.md): IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that (no CVSS)
- [CVE-2008-5687](https://cve.now/CVE-2008-5687.md): MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might a (no CVSS)
- [CVE-2008-5688](https://cve.now/CVE-2008-5688.md): MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installa (no CVSS)
- [CVE-2008-5689](https://cve.now/CVE-2008-5689.md): tun in IP Tunnel in Solaris 10 and OpenSolaris snv\_01 through snv\_76 allows local users to cause a denial of service (panic) and possibly ex (no CVSS)
- [CVE-2008-5690](https://cve.now/CVE-2008-5690.md): The Kerberos credential renewal feature in Sun Solaris 8, 9, and 10, and OpenSolaris build snv\_01 through snv\_104, allows local users to cau (no CVSS)
- [CVE-2008-5691](https://cve.now/CVE-2008-5691.md): Heap-based buffer overflow in the Phoenician Casino FlashAX ActiveX control 1.0.0.7 allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2008-5679](https://cve.now/CVE-2008-5679.md): The HTML parsing engine in Opera before 9.63 allows remote attackers to execute arbitrary code via crafted web pages that trigger an invalid (no CVSS)
- [CVE-2008-5680](https://cve.now/CVE-2008-5680.md): Multiple buffer overflows in Opera before 9.63 might allow (1) remote attackers to execute arbitrary code via a crafted text area, or allow (no CVSS)
- [CVE-2008-5681](https://cve.now/CVE-2008-5681.md): Opera before 9.63 does not block unspecified "scripted URLs" during the feed preview, which allows remote attackers to read existing subscri (no CVSS)
- [CVE-2008-5682](https://cve.now/CVE-2008-5682.md): Cross-site scripting (XSS) vulnerability in Opera before 9.63 allows remote attackers to inject arbitrary web script or HTML via built-in XS (no CVSS)
- [CVE-2008-5683](https://cve.now/CVE-2008-5683.md): Unspecified vulnerability in Opera before 9.63 allows remote attackers to "reveal random data" via unknown vectors. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.