# CVEs published 2009-01-05

12 CVEs were published on January 5, 2009: 1 critical, 0 high. Days are UTC.

- [CVE-2004-2761](https://cve.now/CVE-2004-2761.md): The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attac (CVSS 9.8)
- [CVE-2008-5842](https://cve.now/CVE-2008-5842.md): Multiple cross-site scripting (XSS) vulnerabilities in Fujitsu-Siemens WebTransactions 7.0, 7.1, and possibly other versions allow remote at (no CVSS)
- [CVE-2008-5843](https://cve.now/CVE-2008-5843.md): Multiple untrusted search path vulnerabilities in pdfjam allow local users to gain privileges via a Trojan horse program in (1) the current (no CVSS)
- [CVE-2008-5844](https://cve.now/CVE-2008-5844.md): PHP 5.2.7 contains an incorrect change to the FILTER\_UNSAFE\_RAW functionality, and unintentionally disables magic\_quotes\_gpc regardless of t (no CVSS)
- [CVE-2008-5845](https://cve.now/CVE-2008-5845.md): Multiple cross-site scripting (XSS) vulnerabilities in Six Apart Movable Type (MT) before 4.23 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-5846](https://cve.now/CVE-2008-5846.md): Six Apart Movable Type (MT) before 4.23 allows remote authenticated users with create permission for posts to bypass intended access restric (no CVSS)
- [CVE-2008-5847](https://cve.now/CVE-2008-5847.md): Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sens (no CVSS)
- [CVE-2009-0022](https://cve.now/CVE-2009-0022.md): Samba 3.2.0 through 3.2.6, when registry shares are enabled, allows remote authenticated users to access the root filesystem via a crafted c (no CVSS)
- [CVE-2008-5838](https://cve.now/CVE-2008-5838.md): SQL injection vulnerability in search\_results.php in E-Php Scripts E-Shop (aka E-Php Shopping Cart) Shopping Cart Script allows remote attac (no CVSS)
- [CVE-2008-5839](https://cve.now/CVE-2008-5839.md): Buffer overflow in Foxmail 6.5 allows remote attackers to execute arbitrary code via a long mailto URI in the HREF attribute of an A element (no CVSS)
- [CVE-2008-5840](https://cve.now/CVE-2008-5840.md): PHP iCalendar 2.24 and earlier allows remote attackers to bypass authentication by setting the phpicalendar and phpicalendar\_login cookies t (no CVSS)
- [CVE-2008-5841](https://cve.now/CVE-2008-5841.md): Multiple SQL injection vulnerabilities in iGaming 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the browse pa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.