# CVEs published 2009-02-03

51 CVEs were published on February 3, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0413](https://cve.now/CVE-2009-0413.md): Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2009-0414](https://cve.now/CVE-2009-0414.md): Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap corruption. (no CVSS)
- [CVE-2009-0415](https://cve.now/CVE-2009-0415.md): Untrusted search path vulnerability in trickle 1.07 allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in t (no CVSS)
- [CVE-2009-0416](https://cve.now/CVE-2009-0416.md): The SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for Manageability (SBLIM) sblim-sfcb 1.3.2 allows (no CVSS)
- [CVE-2009-0412](https://cve.now/CVE-2009-0412.md): The ProcessLogin function in class.auth.php in Interspire Shopping Cart (ISC) 4.0.1 Ultimate edition allows remote attackers to bypass authe (no CVSS)
- [CVE-2008-4914](https://cve.now/CVE-2008-4914.md): Unspecified vulnerability in VMware ESXi 3.5 before ESXe350-200901401-I-SG and ESX 3.5 before ESX350-200901401-SG allows local administrator (no CVSS)
- [CVE-2009-0183](https://cve.now/CVE-2009-0183.md): Stack-based buffer overflow in Remote Control Server in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allows remote attackers (no CVSS)
- [CVE-2009-0184](https://cve.now/CVE-2009-0184.md): Multiple buffer overflows in the torrent parsing implementation in Free Download Manager (FDM) 2.5 Build 758 and 3.0 Build 844 allow remote (no CVSS)
- [CVE-2009-0274](https://cve.now/CVE-2009-0274.md): Unspecified vulnerability in WebAccess in Novell GroupWise 6.5, 7.0, 7.01, 7.02x, 7.03, 7.03HP1a, and 8.0 might allow remote attackers to ob (no CVSS)
- [CVE-2009-0276](https://cve.now/CVE-2009-0276.md): Cross-domain vulnerability in the V8 JavaScript engine in Google Chrome before 1.0.154.46 allows remote attackers to bypass the Same Origin (no CVSS)
- [CVE-2009-0399](https://cve.now/CVE-2009-0399.md): Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. (no CVSS)
- [CVE-2009-0400](https://cve.now/CVE-2009-0400.md): SQL injection vulnerability in blog.php in SocialEngine 3.06 trial allows remote attackers to execute arbitrary SQL commands via the categor (no CVSS)
- [CVE-2009-0401](https://cve.now/CVE-2009-0401.md): SQL injection vulnerability in browsecats.php in E-Php CMS allows remote attackers to execute arbitrary SQL commands via the cid parameter. (no CVSS)
- [CVE-2009-0402](https://cve.now/CVE-2009-0402.md): SQL injection vulnerability in client/new\_account.php in Domain Technologie Control (DTC) before 0.29.16 allows remote attackers to execute (no CVSS)
- [CVE-2009-0403](https://cve.now/CVE-2009-0403.md): SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2009-0404](https://cve.now/CVE-2009-0404.md): Multiple cross-site scripting (XSS) vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary we (no CVSS)
- [CVE-2009-0405](https://cve.now/CVE-2009-0405.md): SQL injection vulnerability in articles.php in smartSite CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the var param (no CVSS)
- [CVE-2009-0406](https://cve.now/CVE-2009-0406.md): SQL injection vulnerability in index.php in Community CMS 0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-0407](https://cve.now/CVE-2009-0407.md): SQL injection vulnerability in admin/login.php in PHP-CMS Project 1 allows remote attackers to execute arbitrary SQL commands via the userna (no CVSS)
- [CVE-2009-0408](https://cve.now/CVE-2009-0408.md): Cross-site request forgery (CSRF) vulnerability in osCommerce 2.2 RC 2a allows remote attackers to hijack the authentication of administrato (no CVSS)
- [CVE-2009-0409](https://cve.now/CVE-2009-0409.md): SQL injection vulnerability in offline\_auth.php in Max.Blog 1.0.6 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to (no CVSS)
- [CVE-2009-0410](https://cve.now/CVE-2009-0410.md): Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA) in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 al (no CVSS)
- [CVE-2009-0411](https://cve.now/CVE-2009-0411.md): Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response hea (no CVSS)
- [CVE-2008-6025](https://cve.now/CVE-2008-6025.md): Directory traversal vulnerability in scr/form.php in openElec 3.01 and earlier allows remote attackers to include and execute arbitrary loca (no CVSS)
- [CVE-2008-6026](https://cve.now/CVE-2008-6026.md): SQL injection vulnerability in tienda.php in BlueCUBE CMS allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2008-6027](https://cve.now/CVE-2008-6027.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in BLUEPAGE CMS 2.5 and earlier allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2008-6028](https://cve.now/CVE-2008-6028.md): SQL injection vulnerability in list.php in University of Queensland Library Fez 1.3 and 2.0 RC1 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-6029](https://cve.now/CVE-2008-6029.md): SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to exec (no CVSS)
- [CVE-2008-6030](https://cve.now/CVE-2008-6030.md): Multiple SQL injection vulnerabilities in NetArtMedia Jobs Portal 1.3 allow remote attackers to execute arbitrary SQL commands via (1) the j (no CVSS)
- [CVE-2008-6031](https://cve.now/CVE-2008-6031.md): SQL injection vulnerability in vote.php in WSN Links 2.22 and 2.23 allows remote attackers to execute arbitrary SQL commands via the id para (no CVSS)
- [CVE-2008-6032](https://cve.now/CVE-2008-6032.md): SQL injection vulnerability in comments.php in WSN Links Free 4.0.34P allows remote attackers to execute arbitrary SQL commands via the id p (no CVSS)
- [CVE-2008-6033](https://cve.now/CVE-2008-6033.md): SQL injection vulnerability in comments.php in WSN Links 2.20 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2008-6034](https://cve.now/CVE-2008-6034.md): Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-6035](https://cve.now/CVE-2008-6035.md): Cross-site scripting (XSS) vulnerability in dispatch.php in Achievo 1.3.2-STABLE allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-6036](https://cve.now/CVE-2008-6036.md): PHP remote file inclusion vulnerability in main.inc.php in BaseBuilder 2.0.1 and earlier allows remote attackers to execute arbitrary PHP co (no CVSS)
- [CVE-2008-6037](https://cve.now/CVE-2008-6037.md): SQL injection vulnerability in view.php in AvailScript Article Script allows remote attackers to execute arbitrary SQL commands via the v pa (no CVSS)
- [CVE-2008-6038](https://cve.now/CVE-2008-6038.md): SQL injection vulnerability in index.php in MapCal 0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an (no CVSS)
- [CVE-2008-6039](https://cve.now/CVE-2008-6039.md): Session fixation vulnerability in BLUEPAGE CMS 2.5 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID param (no CVSS)
- [CVE-2008-6040](https://cve.now/CVE-2008-6040.md): SQL injection vulnerability in index.php in Arcadem Pro 2.700 through 2.802 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-6041](https://cve.now/CVE-2008-6041.md): Multiple cross-site scripting (XSS) vulnerabilities in Index.asp in Dataspade 1.0 allow remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-6042](https://cve.now/CVE-2008-6042.md): SQL injection vulnerability in the re\_search module in NetArtMedia Real Estate Portal 2.0 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2008-6043](https://cve.now/CVE-2008-6043.md): Multiple SQL injection vulnerabilities in PHP Pro Bid (PPB) 6.04 allow remote attackers to execute arbitrary SQL commands via the (1) order\_ (no CVSS)
- [CVE-2008-6044](https://cve.now/CVE-2008-6044.md): Cross-site scripting (XSS) vulnerability in advanced\_search\_result.php in xt:Commerce 3.0.4 and earlier allows remote attackers to inject ar (no CVSS)
- [CVE-2008-6045](https://cve.now/CVE-2008-6045.md): Session fixation vulnerability in shopping\_cart.php in xt:Commerce 3.0.4 and earlier allows remote attackers to hijack web sessions by setti (no CVSS)
- [CVE-2009-0397](https://cve.now/CVE-2009-0397.md): Heap-based buffer overflow in the qtdemux\_parse\_samples function in gst/qtdemux/qtdemux.c in GStreamer Good Plug-ins (aka gst-plugins-good) (no CVSS, gstreamer-plugins)
- [CVE-2009-0398](https://cve.now/CVE-2009-0398.md): Array index error in the gst\_qtp\_trak\_handler function in gst/qtdemux/qtdemux.c in GStreamer Plug-ins (aka gstreamer-plugins) 0.6.0 allows r (no CVSS)
- [CVE-2009-0392](https://cve.now/CVE-2009-0392.md): Directory traversal vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to read arbitrary files v (no CVSS)
- [CVE-2009-0393](https://cve.now/CVE-2009-0393.md): Cross-site scripting (XSS) vulnerability in sysconf.cgi in Motorola Wimax modem CPEi300 allows remote authenticated users to inject arbitrar (no CVSS)
- [CVE-2009-0394](https://cve.now/CVE-2009-0394.md): SQL injection vulnerability in login.php in Pre Lecture Exercises (PLEs) CMS 1.0 beta 4.2 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2009-0395](https://cve.now/CVE-2009-0395.md): SQL injection vulnerability in the login feature in NetArt Media Car Portal 1.0 allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2009-0396](https://cve.now/CVE-2009-0396.md): The Sony Ericsson W910i, W660i, K618i, K610i, Z610i, K810i, K660i, W880i, and K530i phones allow remote attackers to cause a denial of servi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.