# CVEs published 2009-01-22

31 CVEs were published on January 22, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0255](https://cve.now/CVE-2009-0255.md): The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with (no CVSS)
- [CVE-2009-0256](https://cve.now/CVE-2009-0256.md): Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allo (no CVSS, typo3/cms)
- [CVE-2009-0257](https://cve.now/CVE-2009-0257.md): Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allow remote (no CVSS)
- [CVE-2009-0258](https://cve.now/CVE-2009-0258.md): The Indexed Search Engine (indexed\_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allow (no CVSS, typo3/cms)
- [CVE-2009-0259](https://cve.now/CVE-2009-0259.md): The Word processor in OpenOffice.org 1.1.2 through 1.1.5 allows remote attackers to cause a denial of service (crash) and possibly execute a (no CVSS)
- [CVE-2008-2384](https://cve.now/CVE-2008-2384.md): SQL injection vulnerability in mod\_auth\_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, (no CVSS)
- [CVE-2008-3820](https://cve.now/CVE-2008-3820.md): Cisco Security Manager 3.1 and 3.2 before 3.2.2, when Cisco IPS Event Viewer (IEV) is used, exposes TCP ports used by the MySQL daemon and I (no CVSS)
- [CVE-2009-0008](https://cve.now/CVE-2009-0008.md): Unspecified vulnerability in Apple QuickTime MPEG-2 Playback Component before 7.60.92.0 on Windows allows remote attackers to cause a denial (no CVSS)
- [CVE-2009-0057](https://cve.now/CVE-2009-0057.md): The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager 5.x before 5.1(3e) and 6.x before 6.1(3) all (no CVSS)
- [CVE-2009-0253](https://cve.now/CVE-2009-0253.md): Mozilla Firefox 3.0.5 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted elem (no CVSS)
- [CVE-2009-0254](https://cve.now/CVE-2009-0254.md): Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Flexible Image Tra (no CVSS)
- [CVE-2009-0246](https://cve.now/CVE-2009-0246.md): Stack-based buffer overflow in easyHDR PRO 1.60.2 allows user-assisted attackers to execute arbitrary code via an invalid Radiance RGBE (aka (no CVSS)
- [CVE-2009-0247](https://cve.now/CVE-2009-0247.md): The server for 53KF Web IM 2009 Home, Professional, and Enterprise editions relies on client-side protection mechanisms against cross-site s (no CVSS)
- [CVE-2009-0248](https://cve.now/CVE-2009-0248.md): Cross-site scripting (XSS) vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-0249](https://cve.now/CVE-2009-0249.md): Katy Whitton RankEm stores sensitive information under the web root with insufficient access control, which allows remote attackers to downl (no CVSS)
- [CVE-2009-0250](https://cve.now/CVE-2009-0250.md): Ryneezy phoSheezy 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow (no CVSS)
- [CVE-2009-0251](https://cve.now/CVE-2009-0251.md): Static code injection vulnerability in admin.php in Ryneezy phoSheezy 0.2 allows remote authenticated administrators to inject arbitrary PHP (no CVSS)
- [CVE-2009-0252](https://cve.now/CVE-2009-0252.md): Multiple SQL injection vulnerabilities in default.asp in Enthrallweb eReservations allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-5938](https://cve.now/CVE-2008-5938.md): PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magic\_quotes\_gp (no CVSS)
- [CVE-2008-5939](https://cve.now/CVE-2008-5939.md): Cross-site scripting (XSS) vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-5940](https://cve.now/CVE-2008-5940.md): SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to execute (no CVSS)
- [CVE-2008-5941](https://cve.now/CVE-2008-5941.md): Cross-site request forgery (CSRF) vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as oth (no CVSS)
- [CVE-2008-5942](https://cve.now/CVE-2008-5942.md): Multiple cross-site scripting (XSS) vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-5943](https://cve.now/CVE-2008-5943.md): Multiple directory traversal vulnerabilities in NavBoard 16 (2.6.0) allow remote attackers to include and execute arbitrary local files via (no CVSS)
- [CVE-2008-5944](https://cve.now/CVE-2008-5944.md): Cross-site scripting (XSS) vulnerability in modules.php in NavBoard 16 (2.6.0) allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-5945](https://cve.now/CVE-2008-5945.md): Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. (no CVSS)
- [CVE-2008-5946](https://cve.now/CVE-2008-5946.md): SQL injection vulnerability in readmore.php in PHP-Fusion 4.01 allows remote attackers to execute arbitrary SQL commands via the news\_id par (no CVSS)
- [CVE-2008-5947](https://cve.now/CVE-2008-5947.md): PHP remote file inclusion vulnerability in include/class\_yapbbcooker.php in YapBB 1.2.Beta 2 allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2008-5936](https://cve.now/CVE-2008-5936.md): front-end/edit.php in mini-pub 0.3 and earlier allows remote attackers to read files and obtain PHP source code via a filename in the sFileN (no CVSS)
- [CVE-2008-5937](https://cve.now/CVE-2008-5937.md): AyeView 2.20 allows user-assisted attackers to cause a denial of service (memory consumption or application crash) via a bitmap (aka .bmp) f (no CVSS)
- [CVE-2009-0245](https://cve.now/CVE-2009-0245.md): Cross-site scripting (XSS) vulnerability in Usagi Project MyNETS 1.2.0.1 and earlier allows remote attackers to inject arbitrary web script (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-01-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.