# CVEs published 2009-01-06

17 CVEs were published on January 6, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-5848](https://cve.now/CVE-2008-5848.md): The Advantech ADAM-6000 module has 00000000 as its default password, which makes it easier for remote attackers to obtain access through an (no CVSS)
- [CVE-2008-5849](https://cve.now/CVE-2008-5849.md): Check Point VPN-1 R55, R65, and other versions, when Port Address Translation (PAT) is used, allows remote attackers to discover intranet IP (no CVSS)
- [CVE-2008-5851](https://cve.now/CVE-2008-5851.md): SQL injection vulnerability in index.php in My PHP Baseball Stats (MyPBS) allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5852](https://cve.now/CVE-2008-5852.md): Emefa Guestbook 3.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl (no CVSS)
- [CVE-2008-5853](https://cve.now/CVE-2008-5853.md): Chilek Content Management System (aka ChiCoMaS) 2.0.4 and earlier stores sensitive information under the web root with insufficient access c (no CVSS)
- [CVE-2008-5854](https://cve.now/CVE-2008-5854.md): Multiple cross-site scripting (XSS) vulnerabilities in login.php in myPHPscripts Login Session 2.0 allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2008-5855](https://cve.now/CVE-2008-5855.md): myPHPscripts Login Session 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attacke (no CVSS)
- [CVE-2008-5856](https://cve.now/CVE-2008-5856.md): Directory traversal vulnerability in scripts/export.php in ClaSS before 0.8.61 allows remote attackers to read arbitrary files via directory (no CVSS)
- [CVE-2008-5857](https://cve.now/CVE-2008-5857.md): The DropDocuments plugin in KnowledgeTree before 3.5.4a allows remote authenticated users to gain administrative privileges via a certain se (no CVSS)
- [CVE-2008-5858](https://cve.now/CVE-2008-5858.md): Multiple cross-site scripting (XSS) vulnerabilities in KnowledgeTree before 3.5.4a allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-5859](https://cve.now/CVE-2008-5859.md): SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register\_globals is enabled and magic\_quotes\_gpc is disa (no CVSS)
- [CVE-2008-5860](https://cve.now/CVE-2008-5860.md): Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register\_globals is enabled and magic\_q (no CVSS)
- [CVE-2008-5861](https://cve.now/CVE-2008-5861.md): Directory traversal vulnerability in source.php in FreeLyrics 1.0 allows remote attackers to read arbitrary files via directory traversal se (no CVSS)
- [CVE-2008-5862](https://cve.now/CVE-2008-5862.md): Directory traversal vulnerability in webcamXP 5.3.2.375 and 5.3.2.410 build 2132 allows remote attackers to read arbitrary files via a ..%2F (no CVSS)
- [CVE-2008-5863](https://cve.now/CVE-2008-5863.md): SQL injection vulnerability in locator.php in the Userlocator module 3.0 for Woltlab Burning Board (wBB) allows remote attackers to execute (no CVSS)
- [CVE-2008-5864](https://cve.now/CVE-2008-5864.md): SQL injection vulnerability in the Top Hotel (com\_tophotelmodule) component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 for (no CVSS)
- [CVE-2008-5865](https://cve.now/CVE-2008-5865.md): SQL injection vulnerability in the com\_hbssearch component 1.0 in the Hotel Booking Reservation System (aka HBS) 1.0.0 for Joomla! allows re (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.