CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2008

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2008-5736 264 1 +Priv 2008-12-26 2019-08-02
7.2
 None Local Low Not required Complete Complete Complete
Multiple unspecified vulnerabilities in FreeBSD 6 before 6.4-STABLE, 6.3 before 6.3-RELEASE-p7, 6.4 before 6.4-RELEASE-p1, 7.0 before 7.0-RELEASE-p7, 7.1 before 7.1-RC2, and 7 before 7.1-PRERELEASE allow local users to gain privileges via unknown attack vectors related to function pointers that are "not properly initialized" for (1) netgraph sockets and (2) bluetooth sockets.
2 CVE-2008-5689 399 1 DoS Exec Code 2008-12-19 2018-10-11
7.2
 None Local Low Not required Complete Complete Complete
tun in IP Tunnel in Solaris 10 and OpenSolaris snv_01 through snv_76 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted SIOCGTUNPARAM IOCTL request, which triggers a NULL pointer dereference.
3 CVE-2008-5595 89 1 Exec Code Sql 2008-12-16 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter.
4 CVE-2008-5585 94 1 Exec Code File Inclusion 2008-12-16 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in lcxBBportal 0.1 Alpha 2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter to (1) portal/includes/portal_block.php and (2) includes/acp/acp_lcxbbportal.php.
5 CVE-2008-5323 79 1 XSS 2008-12-03 2017-09-28
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in Wysi Wiki Wyg 1.0 allows remote attackers to inject arbitrary web script or HTML via the s parameter.
6 CVE-2008-5322 200 1 +Info 2008-12-03 2017-09-28
7.8
 None Remote Low Not required Complete None None
Wysi Wiki Wyg 1.0 allows remote attackers to obtain system information via an invalid categup parameter to index.php, which calls the phpinfo function.
7 CVE-2008-5281 119 1 Exec Code Overflow 2008-11-28 2008-12-01
10.0
 Admin Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in Titan FTP Server 6.05 build 550 allows remote attackers to execute arbitrary code via a long DELE command.
8 CVE-2008-5232 119 2 Exec Code Overflow 2008-11-25 2018-10-30
9.3
 Admin Remote Medium Not required Complete Complete Complete
Buffer overflow in the CallHTMLHelp method in the Microsoft Windows Media Services ActiveX control in nskey.dll 4.1.00.3917 in Windows Media Services on Microsoft Windows NT and 2000, and Avaya Media and Message Application servers, allows remote attackers to execute arbitrary code via a long argument. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
9 CVE-2008-5180 399 1 DoS 2008-11-20 2017-09-28
5.0
 None Remote Low Not required None None Partial
Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service (memory consumption) via a large number of SIP INVITE requests, which trigger the creation of many sessions.
10 CVE-2008-5072 1 DoS 2008-11-14 2017-09-28
4.3
 None Remote Medium Not required None None Partial
vsfilter.dll in K-Lite Mega Codec Pack 3.5.7.0 allows remote attackers to cause a denial of service (application crash) via a malformed FLV file.
11 CVE-2008-5063 94 1 Exec Code File Inclusion 2008-11-13 2017-09-28
10.0
 None Remote Low Not required Complete Complete Complete
PHP remote file inclusion vulnerability in Admin/ADM_Pagina.php in OTManager 2.4 allows remote attackers to execute arbitrary PHP code via a URL in the Tipo parameter.
12 CVE-2008-5053 94 1 Exec Code File Inclusion 2008-11-13 2017-09-28
10.0
 None Remote Low Not required Complete Complete Complete
PHP remote file inclusion vulnerability in admin.rssreader.php in the Simple RSS Reader (com_rssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
13 CVE-2008-4927 20 1 DoS 2008-11-04 2008-11-05
4.3
 None Remote Medium Not required None None Partial
Microsoft Windows Media Player (WMP) 9.0 through 11 allows user-assisted attackers to cause a denial of service (application crash) via a malformed (1) MIDI or (2) DAT file, related to "MThd Header Parsing." NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
14 CVE-2008-4897 89 1 Exec Code Sql 2008-11-03 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in fichiers/add_url.php in Logz podcast CMS 1.3.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the art parameter.
15 CVE-2008-4765 89 1 Exec Code Sql 2008-10-27 2017-09-28
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in pollBooth.php in osCommerce Poll Booth Add-On 2.0 allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results operation. NOTE: this issue was disclosed by an unreliable researcher, so it might be incorrect.
16 CVE-2008-4751 79 1 XSS 2008-10-27 2018-10-11
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in iPei Guestbook 2.0 allows remote attackers to inject arbitrary web script or HTML via the pg parameter, a different vector than CVE-2005-4597.
17 CVE-2008-4649 287 1 2008-10-21 2017-08-07
7.5
 User Remote Low Not required Partial Partial Partial
Session fixation vulnerability in Elxis CMS 2008.1 revision 2204 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
18 CVE-2008-4648 79 1 XSS 2008-10-21 2017-08-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in Elxis CMS 2008.1 revision 2204 allows remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO or the (2) option, (3) Itemid, (4) id, (5) task, (6) bid, and (7) contact_id parameters. NOTE: the error might be located in modules/mod_language.php, and index.php might be the interaction point.
19 CVE-2008-4558 399 1 Exec Code 2008-10-14 2018-10-11
6.8
 User Remote Medium Not required Partial Partial Partial
Array index error in VLC media player 0.9.2 allows remote attackers to overwrite arbitrary memory and execute arbitrary code via an XSPF playlist file with a negative identifier tag, which passes a signed comparison.
20 CVE-2008-4448 352 1 CSRF 2008-10-06 2017-08-07
6.8
 User Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to perform unauthorized actions as an administrator, including file deletion and creation, via a link or IMG tag to the (1) overkill, (2) futils, or (3) edit actions.
21 CVE-2008-4447 79 1 XSS 2008-10-06 2017-08-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via (1) the fn parameter during a dload action, (2) the mask parameter during a search action, and (3) the tab parameter during a sysinfo action.
22 CVE-2008-4396 119 1 Exec Code Overflow 2008-10-02 2017-08-07
9.3
 Admin Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in Safer Networking FileAlyzer 1.6.0.0 and 1.6.0.4 beta, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via an executable with malformed version data.
23 CVE-2008-4348 89 1 Exec Code Sql 2008-09-30 2017-08-07
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in photo.php in PHPortfolio, possibly 1.3, allows remote attackers to execute arbitrary SQL commands via the id parameter.
24 CVE-2008-4344 89 1 Exec Code Sql 2008-09-30 2017-08-07
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cat.php in 6rbScript allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
25 CVE-2008-4182 79 1 XSS 2008-09-23 2017-08-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in imp/test.php in Horde Turba Contact Manager H3 2.2.1 and other versions before 2.3.1, and possibly other Horde Project products, allows remote attackers to inject arbitrary web script or HTML via the User field in an IMAP session.
26 CVE-2008-4178 89 1 Exec Code Sql 2008-09-23 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in tr.php in DownlineGoldmine Special Category Addon, Downline Builder Pro, New Addon, and Downline Goldmine Builder allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.
27 CVE-2008-4174 79 1 XSS 2008-09-23 2017-08-07
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dynamic MP3 Lister 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) currentpath, (2) invert, (3) search, and (4) sort parameters.
28 CVE-2008-4172 89 1 Exec Code Sql 2008-09-22 2017-08-07
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in page.php in Cars & Vehicle (aka Cars-Vehicle Script) allows remote attackers to execute arbitrary SQL commands via the lnkid parameter.
29 CVE-2008-4157 89 1 Exec Code Sql 2008-09-22 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 1.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter, a different vector than CVE-2007-3610. NOTE: it was later reported that 1.2.3 is also affected.
30 CVE-2008-4142 89 1 Exec Code Sql 2008-09-24 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in article.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the es_id parameter.
31 CVE-2008-4141 94 1 Exec Code File Inclusion 2008-09-24 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in x10Media x10 Automatic MP3 Script 1.5.5 allow remote attackers to execute arbitrary PHP code via a URL in the web_root parameter to (1) includes/function_core.php and (2) templates/layout_lyrics.php.
32 CVE-2008-4037 287 2 Exec Code 2008-11-12 2018-10-30
9.3
 Admin Remote Medium Not required Complete Complete Complete
Microsoft Windows 2000 Gold through SP4, XP Gold through SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote SMB servers to execute arbitrary code on a client machine by replaying the NTLM credentials of a client user, as demonstrated by backrush, aka "SMB Credential Reflection Vulnerability." NOTE: some reliable sources report that this vulnerability exists because of an insufficient fix for CVE-2000-0834.
33 CVE-2008-3957 20 1 2008-09-10 2017-08-07
9.3
 None Remote Medium Not required Complete Complete Complete
The Microsoft Windows Image Acquisition Logger ActiveX control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument to the Save method. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
34 CVE-2008-3942 89 1 Exec Code Sql 2008-09-05 2017-08-07
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in landsee.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
35 CVE-2008-3922 94 1 Exec Code 2008-09-04 2018-10-11
9.3
 Admin Remote Medium Not required Complete Complete Complete
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
36 CVE-2008-3788 89 1 Exec Code Sql 2008-08-26 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PICTURESPRO Photo Cart 3.9, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) qtitle, (2) qid, and (3) qyear parameters to (a) search.php, and the (4) email and (5) password parameters to (b) _login.php.
37 CVE-2008-3774 89 1 Exec Code Sql 2008-08-22 2017-08-07
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Simasy CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
38 CVE-2008-3765 89 1 Exec Code Sql 2008-08-21 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in code.php in Quick Poll Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
39 CVE-2008-3756 89 1 Exec Code Sql 2008-08-21 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in tr.php in YourFreeWorld Viral Marketing Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
40 CVE-2008-3755 89 1 Exec Code Sql 2008-08-21 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary SQL commands via the category parameter.
41 CVE-2008-3751 89 1 Exec Code Sql 2008-08-21 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in tr.php in YourFreeWorld Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
42 CVE-2008-3750 89 1 Exec Code Sql 2008-08-21 2017-09-28
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in tr.php in YourFreeWorld URL Rotator Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
43 CVE-2008-3735 79 1 XSS 2008-08-20 2017-08-07
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.php in PHPizabi before 848 Core HotFix Pack 3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a blogs.search action.
44 CVE-2008-3723 22 1 Dir. Trav. 2008-08-20 2017-08-07
6.3
 None Remote Medium Single system Complete None None
Directory traversal vulnerability in index.php in PHPizabi 0.848b C1 HFP3 allows remote authenticated administrators to read arbitrary files via (1) a .. (dot dot), (2) a URL, or possibly (3) a full pathname in the id parameter in an admin.templates.edittemplate action. NOTE: some of these details are obtained from third party information.
45 CVE-2008-3710 22 1 Exec Code Dir. Trav. 2008-08-19 2017-08-07
5.1
 User Remote High Not required Partial Partial Partial
Multiple directory traversal vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) script_path parameter to (a) options.php and the (2) lang_code parameter to (b) copy_vip.php and (c) process_edit_board.php in adminopts/. NOTE: some of these vectors might not be vulnerabilities under proper installation.
46 CVE-2008-3709 79 1 XSS 2008-08-19 2017-08-07
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to inject arbitrary web script or HTML via the (1) lOptionsOptions, (2) lNavAdminOptions, or (3) lNavReturn parameter to options.php; or the (4) lNavReturn parameter to subscribe.php.
47 CVE-2008-3707 94 1 Exec Code File Inclusion 2008-08-19 2017-08-07
7.5
 User Remote Low Not required Partial Partial Partial
Multiple PHP remote file inclusion vulnerabilities in CyBoards PHP Lite 1.21 allow remote attackers to execute arbitrary PHP code via a URL in the script_path parameter to (1) flat_read.php, (2) post.php, (3) process_post.php, (4) process_search.php, (5) forum.php, (6) process_subscribe.php, (7) read.php, (8) search.php, (9) subscribe.php in path/; and (10) add_ban.php, (11) add_ban_form.php, (12) add_board.php, (13) add_vip.php, (14) add_vip_form.php, (15) copy_ban.php, (16) copy_vip.php, (17) delete_ban.php, (18) delete_board.php, (19) delete_messages.php, (20) delete_vip.php, (21) edit_ban.php, (22) edit_board.php, (23) edit_vip.php, (24) index.php, (25) lock_messages.php, (26) login.php, (27) modify_ban_list.php, (28) modify_vip_list.php, (29) move_messages.php, (30) process_add_board.php, (31) process_ban.php, (32) process_delete_ban.php, (33) process_delete_board.php, (34) process_delete_messages.php, (35) process_delete_vip.php, (36) process_edit_board.php, (37) process_lock_messages.php, (38) process_login.php, (39) process_move_messages.php, (40) process_sticky_messages.php, (41) process_vip.php, and (42) sticky_messages.php in path/adminopts. NOTE: the include/common.php vector is covered by CVE-2006-2871. NOTE: some of these vectors might not be vulnerabilities under proper installation.
48 CVE-2008-3648 94 1 Exec Code 2008-08-12 2017-08-07
9.3
 None Remote Medium Not required Complete Complete Complete
nslookup.exe in Microsoft Windows XP SP2 allows user-assisted remote attackers to execute arbitrary code, as demonstrated by an attempted DNS zone transfer, and as exploited in the wild in August 2008.
49 CVE-2008-3430 119 1 Exec Code Overflow 2008-07-31 2017-08-07
9.3
 None Remote Medium Not required Complete Complete Complete
Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3, allows remote attackers to execute arbitrary code via a large argument supplied to the BGColor method. NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.
50 CVE-2008-3408 119 1 Exec Code Overflow 2008-07-31 2017-09-28
6.8
 User Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in CoolPlayer 2.18, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a crafted m3u file.
Total number of vulnerabilities : 68   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.