# CVEs published 2009-01-21

38 CVEs were published on January 21, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-3864](https://cve.now/CVE-2008-3864.md): The ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Mic (no CVSS)
- [CVE-2008-3865](https://cve.now/CVE-2008-3865.md): Multiple heap-based buffer overflows in the ApiThread function in the firewall service (aka TmPfw.exe) in Trend Micro Network Security Compo (no CVSS)
- [CVE-2008-3866](https://cve.now/CVE-2008-3866.md): The Trend Micro Personal Firewall service (aka TmPfw.exe) in Trend Micro Network Security Component (NSC) modules, as used in Trend Micro Of (no CVSS)
- [CVE-2009-0001](https://cve.now/CVE-2009-0001.md): Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and (no CVSS)
- [CVE-2009-0002](https://cve.now/CVE-2009-0002.md): Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and (no CVSS)
- [CVE-2009-0003](https://cve.now/CVE-2009-0003.md): Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and (no CVSS)
- [CVE-2009-0004](https://cve.now/CVE-2009-0004.md): Buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly ex (no CVSS)
- [CVE-2009-0005](https://cve.now/CVE-2009-0005.md): Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and p (no CVSS)
- [CVE-2009-0006](https://cve.now/CVE-2009-0006.md): Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and po (no CVSS)
- [CVE-2009-0007](https://cve.now/CVE-2009-0007.md): Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and (no CVSS)
- [CVE-2009-0026](https://cve.now/CVE-2009-0026.md): Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script (no CVSS, org.apache.jackrabbit:jackrabbit)
- [CVE-2009-0030](https://cve.now/CVE-2009-0030.md): A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated user (no CVSS)
- [CVE-2009-0243](https://cve.now/CVE-2009-0243.md): Microsoft Windows does not properly enforce the Autorun and NoDriveTypeAutoRun registry values, which allows physically proximate attackers (no CVSS)
- [CVE-2009-0244](https://cve.now/CVE-2009-0244.md): Directory traversal vulnerability in the OBEX FTP Service in the Microsoft Bluetooth stack in Windows Mobile 6 Professional, and probably Wi (no CVSS)
- [CVE-2008-5921](https://cve.now/CVE-2008-5921.md): SQL injection vulnerability in albums.php in Umer Inc Songs Portal allows remote attackers to execute arbitrary SQL commands via the id para (no CVSS)
- [CVE-2008-5922](https://cve.now/CVE-2008-5922.md): Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Cant Find A Gaming CMS (CFAGCMS) 1 allow remote attackers (no CVSS)
- [CVE-2008-5923](https://cve.now/CVE-2008-5923.md): SQL injection vulnerability in default.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands the cat para (no CVSS)
- [CVE-2008-5924](https://cve.now/CVE-2008-5924.md): SQL injection vulnerability in diary\_viewC.asp in ASP-DEv XM Events Diary allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5925](https://cve.now/CVE-2008-5925.md): ASP-DEv XM Events Diary stores sensitive information under the web root with insufficient access control, which allows remote attackers to d (no CVSS)
- [CVE-2008-5926](https://cve.now/CVE-2008-5926.md): Multiple SQL injection vulnerabilities in login.asp in ASP-DEv Internal E-Mail System allow remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-5927](https://cve.now/CVE-2008-5927.md): Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPNews 0.0.6 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-5928](https://cve.now/CVE-2008-5928.md): SQL injection vulnerability in redir.php in Free Links Directory Script (FLDS) 1.2a allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-5929](https://cve.now/CVE-2008-5929.md): VP-ASP Shopping Cart 6.50 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2008-5930](https://cve.now/CVE-2008-5930.md): SQL injection vulnerability in admin/blog\_comments.asp in The Net Guys ASPired2Blog allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-5931](https://cve.now/CVE-2008-5931.md): The Net Guys ASPired2Blog stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2008-5932](https://cve.now/CVE-2008-5932.md): CodeAvalanche FreeForum stores sensitive information under the web root with insufficient access control, which allows remote attackers to d (no CVSS)
- [CVE-2008-5933](https://cve.now/CVE-2008-5933.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in CMS ISWEB 3.0 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-5934](https://cve.now/CVE-2008-5934.md): SQL injection vulnerability in index.php in CMS ISWEB 3.0 allows remote attackers to execute arbitrary SQL commands via the id\_sezione param (no CVSS)
- [CVE-2008-5935](https://cve.now/CVE-2008-5935.md): Facto stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databa (no CVSS)
- [CVE-2009-0241](https://cve.now/CVE-2009-0241.md): Stack-based buffer overflow in the process\_path function in gmetad/server.c in Ganglia 3.1.1 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2008-5916](https://cve.now/CVE-2008-5916.md): gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other (no CVSS)
- [CVE-2008-5917](https://cve.now/CVE-2008-5917.md): Cross-site scripting (XSS) vulnerability in the XSS filter (framework/Text\_Filter/Filter/xss.php) in Horde Application Framework 3.2.2 and 3 (no CVSS)
- [CVE-2008-5918](https://cve.now/CVE-2008-5918.md): Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php in WebSVN 2.0 and earlier allows remote attack (no CVSS)
- [CVE-2008-5919](https://cve.now/CVE-2008-5919.md): Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to overwr (no CVSS)
- [CVE-2008-5920](https://cve.now/CVE-2008-5920.md): The create\_anchors function in utils.inc in WebSVN 1.x allows remote attackers to execute arbitrary PHP code via a crafted username that is (no CVSS)
- [CVE-2009-0031](https://cve.now/CVE-2009-0031.md): Memory leak in the keyctl\_join\_session\_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users t (no CVSS)
- [CVE-2009-0240](https://cve.now/CVE-2009-0240.md): listing.php in WebSVN 2.0 and possibly 1.7 beta, when using an SVN authz file, allows remote authenticated users to read changelogs or diffs (no CVSS)
- [CVE-2009-0219](https://cve.now/CVE-2009-0219.md): The PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry P (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.