# CVEs published 2009-04-03 25 CVEs were published on April 3, 2009: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2008-6583](https://cve.now/CVE-2008-6583.md): Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary… (no CVSS) - [CVE-2008-6584](https://cve.now/CVE-2008-6584.md): html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an… (no CVSS) - [CVE-2008-6585](https://cve.now/CVE-2008-6585.md): Cross-site request forgery (CSRF) vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication… (no CVSS) - [CVE-2008-6586](https://cve.now/CVE-2008-6586.md): Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attackers to (1) hijack… (no CVSS) - [CVE-2008-6587](https://cve.now/CVE-2008-6587.md): Cross-site request forgery (CSRF) vulnerability in index.tmpl in Vuze (formerly Azureus HTML WebUI), probably 0.7.6, allows remote… (no CVSS) - [CVE-2008-6588](https://cve.now/CVE-2008-6588.md): Aztech ADSL2/2+ 4-port router has a default "isp" account with a default "isp" password, which allows remote attackers to obtain access if… (no CVSS) - [CVE-2008-6589](https://cve.now/CVE-2008-6589.md): Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version… (no CVSS) - [CVE-2008-6590](https://cve.now/CVE-2008-6590.md): Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2… (no CVSS) - [CVE-2008-6591](https://cve.now/CVE-2008-6591.md): LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files… (no CVSS) - [CVE-2008-6592](https://cve.now/CVE-2008-6592.md): thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to… (no CVSS) - [CVE-2008-6593](https://cve.now/CVE-2008-6593.md): SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject… (no CVSS) - [CVE-2008-6594](https://cve.now/CVE-2008-6594.md): SQL injection vulnerability in the cm\_rdfexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via… (no CVSS) - [CVE-2008-6595](https://cve.now/CVE-2008-6595.md): SQL injection vulnerability in the pmk\_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via… (no CVSS) - [CVE-2008-6596](https://cve.now/CVE-2008-6596.md): SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash… (no CVSS) - [CVE-2008-6597](https://cve.now/CVE-2008-6597.md): Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web… (no CVSS) - [CVE-2008-6598](https://cve.now/CVE-2008-6598.md): Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic." (no CVSS) - [CVE-2008-6599](https://cve.now/CVE-2008-6599.md): cookiecheck.php in CookieCheck 1.0 stores tmp/cc\_sessions under the web root with insufficient access control, which allows remote… (no CVSS) - [CVE-2008-6600](https://cve.now/CVE-2008-6600.md): Cross-site scripting (XSS) vulnerability in the search feature in XMLPortal 3.0 allows remote attackers to inject arbitrary web script or… (no CVSS) - [CVE-2008-6601](https://cve.now/CVE-2008-6601.md): Unspecified vulnerability in Epona 1.5rc3 allows remote attackers to obtain the real IP address of users via unknown vectors. (no CVSS) - [CVE-2008-6602](https://cve.now/CVE-2008-6602.md): Unspecified vulnerability in Download Center Lite before 2.1 has unknown impact and attack vectors related to "A minor security fix." (no CVSS) - [CVE-2008-6603](https://cve.now/CVE-2008-6603.md): MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl\_hierarchic is set to True, which might allow remote attackers to… (no CVSS, moin) - [CVE-2009-0556](https://cve.now/CVE-2009-0556.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to ex (CVSS 8.8, KEV) - [CVE-2009-1239](https://cve.now/CVE-2009-1239.md): IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN… (no CVSS) - [CVE-2009-1240](https://cve.now/CVE-2009-1240.md): Unspecified vulnerability in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network… (no CVSS) - [CVE-2009-1241](https://cve.now/CVE-2009-1241.md): Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive. (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2009-04-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.