# CVEs published 2009-05-11

27 CVEs were published on May 11, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6803](https://cve.now/CVE-2008-6803.md): SQL injection vulnerability in diziler.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the… (no CVSS)
- [CVE-2008-6804](https://cve.now/CVE-2008-6804.md): Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the… (no CVSS)
- [CVE-2008-6805](https://cve.now/CVE-2008-6805.md): Multiple SQL injection vulnerabilities in Mic\_Blog 0.0.3, when magic\_quotes\_gpc is disabled, allow remote attackers to execute arbitrary… (no CVSS)
- [CVE-2009-1612](https://cve.now/CVE-2009-1612.md): Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to… (no CVSS)
- [CVE-2009-1613](https://cve.now/CVE-2009-1613.md): Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic\_quotes\_gpc is disabled, allow remote attackers to execute… (no CVSS)
- [CVE-2009-1614](https://cve.now/CVE-2009-1614.md): Multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)
- [CVE-2009-1615](https://cve.now/CVE-2009-1615.md): Unrestricted file upload vulnerability in Leap CMS 0.1.4 allows remote attackers to execute arbitrary code by uploading a file with an… (no CVSS)
- [CVE-2009-1616](https://cve.now/CVE-2009-1616.md): Cross-site scripting (XSS) vulnerability in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.22 allows remote attackers to… (no CVSS)
- [CVE-2009-1604](https://cve.now/CVE-2009-1604.md): Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown… (no CVSS)
- [CVE-2009-1605](https://cve.now/CVE-2009-1605.md): Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf\_function.c in MuPDF in the mupdf-20090223-win32 package, as… (CVSS 5.4)
- [CVE-2009-1606](https://cve.now/CVE-2009-1606.md): Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow… (no CVSS)
- [CVE-2009-1607](https://cve.now/CVE-2009-1607.md): Cross-site scripting (XSS) vulnerability in the administrator panel in phpForm.net LinkBase 2.0 allows remote attackers to inject… (no CVSS)
- [CVE-2009-1608](https://cve.now/CVE-2009-1608.md): Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute… (no CVSS)
- [CVE-2009-1609](https://cve.now/CVE-2009-1609.md): Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by… (no CVSS)
- [CVE-2009-1610](https://cve.now/CVE-2009-1610.md): admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator password and gain… (no CVSS)
- [CVE-2009-1611](https://cve.now/CVE-2009-1611.md): Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 257 reply to… (no CVSS)
- [CVE-2009-1603](https://cve.now/CVE-2009-1603.md): src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with… (no CVSS)
- [CVE-2009-0194](https://cve.now/CVE-2009-0194.md): The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl\_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator… (no CVSS)
- [CVE-2009-1194](https://cve.now/CVE-2009-1194.md): Integer overflow in the pango\_glyph\_string\_set\_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent… (no CVSS)
- [CVE-2009-1597](https://cve.now/CVE-2009-1597.md): Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in… (no CVSS)
- [CVE-2009-1598](https://cve.now/CVE-2009-1598.md): Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in… (no CVSS)
- [CVE-2009-1599](https://cve.now/CVE-2009-1599.md): Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline… (no CVSS)
- [CVE-2009-1600](https://cve.now/CVE-2009-1600.md): Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an… (no CVSS)
- [CVE-2009-1601](https://cve.now/CVE-2009-1601.md): The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current… (no CVSS)
- [CVE-2009-1602](https://cve.now/CVE-2009-1602.md): Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU… (no CVSS)
- [CVE-2009-1595](https://cve.now/CVE-2009-1595.md): The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to… (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2009-1596](https://cve.now/CVE-2009-1596.md): Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2009-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.