# CVEs published 2009-01-27

44 CVEs were published on January 27, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2007-2795](https://cve.now/CVE-2007-2795.md): Multiple buffer overflows in Ipswitch IMail before 2006.21 allow remote attackers or authenticated users to execute arbitrary code via (1) t (no CVSS)
- [CVE-2008-5982](https://cve.now/CVE-2008-5982.md): Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers (no CVSS)
- [CVE-2009-0311](https://cve.now/CVE-2009-0311.md): The Backbone service (ftbackbone.exe) in EMC AutoStart before 5.3 SP2 allows remote attackers to execute arbitrary code via a packet with a (no CVSS)
- [CVE-2009-0032](https://cve.now/CVE-2009-0032.md): CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to (no CVSS)
- [CVE-2009-0291](https://cve.now/CVE-2009-0291.md): Directory traversal vulnerability in fc.php in OpenX 2.6.3 allows remote attackers to include and execute arbitrary files via a .. (no CVSS)
- [CVE-2009-0292](https://cve.now/CVE-2009-0292.md): SQL injection vulnerability in show\_cat2.php in SHOP-INET 4 allows remote attackers to execute arbitrary SQL commands via the grid parameter (no CVSS)
- [CVE-2009-0293](https://cve.now/CVE-2009-0293.md): SQL injection vulnerability in profile\_view.php in Wazzum Dating Software, possibly 2.0, allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2009-0294](https://cve.now/CVE-2009-0294.md): Multiple PHP remote file inclusion vulnerabilities in WB News 2.0.1, when register\_globals is enabled, allow remote attackers to execute arb (no CVSS)
- [CVE-2009-0295](https://cve.now/CVE-2009-0295.md): SQL injection vulnerability in index.php in Information Technology Light Poll Information (ITLPoll) 2.7 Stable 2, when magic\_quotes\_gpc is d (no CVSS)
- [CVE-2009-0296](https://cve.now/CVE-2009-0296.md): SQL injection vulnerability in shop\_display\_products.php in Script Toko Online 5.01 allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2009-0297](https://cve.now/CVE-2009-0297.md): SQL injection vulnerability in login\_check.asp in ClickAuction allows remote attackers to execute arbitrary SQL commands via the (1) txtEmai (no CVSS)
- [CVE-2009-0298](https://cve.now/CVE-2009-0298.md): Heap-based buffer overflow in MW6 Technologies Barcode ActiveX control (Barcode.MW6Barcode.1, Barcode.dll) 3.0.0.1 allows remote attackers t (no CVSS)
- [CVE-2009-0299](https://cve.now/CVE-2009-0299.md): SQL injection vulnerability in index.php in Groone GLinks 2.1 allows remote attackers to execute arbitrary SQL commands via the cat paramete (no CVSS)
- [CVE-2009-0301](https://cve.now/CVE-2009-0301.md): Multiple insecure method vulnerabilities in the FlexCell.Grid ActiveX control (FlexCell.ocx) in FlexCell Grid Control 5.6.9 allow remote att (no CVSS)
- [CVE-2009-0302](https://cve.now/CVE-2009-0302.md): SQL injection vulnerability in the Downloads module for PHP-Nuke 8.0 8.1.0.3.5b and earlier allows remote authenticated users to execute arb (no CVSS)
- [CVE-2009-0303](https://cve.now/CVE-2009-0303.md): Cross-site scripting (XSS) vulnerability in Web Help Desk before 9.1.18 allows remote attackers to inject arbitrary web script or HTML via v (no CVSS)
- [CVE-2009-0304](https://cve.now/CVE-2009-0304.md): The kernel in Sun Solaris 10 and 11 snv\_101b, and OpenSolaris before snv\_108, allows remote attackers to cause a denial of service (system c (no CVSS)
- [CVE-2009-0288](https://cve.now/CVE-2009-0288.md): Directory traversal vulnerability in k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to read arbitrary files outside the (no CVSS)
- [CVE-2009-0289](https://cve.now/CVE-2009-0289.md): k23productions TFTPUtil GUI 1.2.0 and 1.3.0 allows remote attackers to cause a denial of service (service crash) via a long filename in a cr (no CVSS)
- [CVE-2009-0290](https://cve.now/CVE-2009-0290.md): Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files (no CVSS)
- [CVE-2009-0279](https://cve.now/CVE-2009-0279.md): SQL injection vulnerability in comentar.php in Pardal CMS 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2009-0280](https://cve.now/CVE-2009-0280.md): Asp Project Management 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the crypt cookie to 1. (no CVSS)
- [CVE-2009-0281](https://cve.now/CVE-2009-0281.md): SQL injection vulnerability in login.aspx in WarHound Walking Club allows remote attackers to execute arbitrary SQL commands via the (1) use (no CVSS)
- [CVE-2009-0282](https://cve.now/CVE-2009-0282.md): Integer overflow in Ralink Technology USB wireless adapter (RT73) 3.08 for Windows, and other wireless card drivers including rt2400, rt2500 (no CVSS)
- [CVE-2009-0283](https://cve.now/CVE-2009-0283.md): Cross-site scripting (XSS) vulnerability in err.asp in Oblog allows remote attackers to inject arbitrary web script or HTML via the message (no CVSS)
- [CVE-2009-0284](https://cve.now/CVE-2009-0284.md): SQL injection vulnerability in category.php in Flax Article Manager 1.1 allows remote attackers to execute arbitrary SQL commands via the ca (no CVSS)
- [CVE-2009-0285](https://cve.now/CVE-2009-0285.md): Cross-site scripting (XSS) vulnerability in error.asp in BBSXP 5.13 and earlier allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2009-0286](https://cve.now/CVE-2009-0286.md): Directory traversal vulnerability in upgrade/index.php in OpenGoo 1.1, when register\_globals is enabled and magic\_quotes\_gpc is disabled, al (no CVSS)
- [CVE-2009-0287](https://cve.now/CVE-2009-0287.md): SQL injection vulnerability in lib/patUser.php in KEEP Toolkit before 2.5.1 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2009-0277](https://cve.now/CVE-2009-0277.md): Unspecified vulnerability in the kernel in OpenSolaris snv\_100 through snv\_102 on the Sun UltraSPARC T2 and T2+ sun4v platforms allows local (no CVSS)
- [CVE-2009-0278](https://cve.now/CVE-2009-0278.md): Sun Java System Application Server (AS) 8.1 and 8.2 allows remote attackers to read the Web Application configuration files in the (1) WEB-I (no CVSS)
- [CVE-2008-5969](https://cve.now/CVE-2008-5969.md): SQL injection vulnerability in popupproduct.php in Sunbyte e-Flower allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2008-5970](https://cve.now/CVE-2008-5970.md): SQL injection vulnerability in profile\_social.php in i-Net Solution Orkut Clone allows remote authenticated users to execute arbitrary SQL c (no CVSS)
- [CVE-2008-5971](https://cve.now/CVE-2008-5971.md): Cross-site scripting (XSS) vulnerability in profile\_social.php in i-Net Solution Orkut Clone allows remote authenticated users to inject arb (no CVSS)
- [CVE-2008-5972](https://cve.now/CVE-2008-5972.md): SQL injection vulnerability in default.asp in Active Business Directory 2 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5973](https://cve.now/CVE-2008-5973.md): SQL injection vulnerability in login.aspx in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the password (no CVSS)
- [CVE-2008-5974](https://cve.now/CVE-2008-5974.md): Multiple SQL injection vulnerabilities in login.aspx in Active Price Comparison 4.0 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-5975](https://cve.now/CVE-2008-5975.md): SQL injection vulnerability in links.asp in Active Price Comparison 4.0 allows remote attackers to execute arbitrary SQL commands via the li (no CVSS)
- [CVE-2008-5976](https://cve.now/CVE-2008-5976.md): Multiple cross-site scripting (XSS) vulnerabilities in siteadmin/forgot.php in PHP JOBWEBSITE PRO allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2008-5977](https://cve.now/CVE-2008-5977.md): SQL injection vulnerability in siteadmin/forgot.php in PHP JOBWEBSITE PRO allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5978](https://cve.now/CVE-2008-5978.md): Multiple SQL injection vulnerabilities in Ocean12 Mailing List Manager Gold allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-5979](https://cve.now/CVE-2008-5979.md): Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Mailing List Manager Gold allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-5980](https://cve.now/CVE-2008-5980.md): Ocean12 Mailing List Manager Gold stores sensitive data under the web root with insufficient access control, which allows remote attackers t (no CVSS)
- [CVE-2008-5981](https://cve.now/CVE-2008-5981.md): PacPoll 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a da (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-01-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.