# CVEs published 2009-02-05

40 CVEs were published on February 5, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0441](https://cve.now/CVE-2009-0441.md): PHP remote file inclusion vulnerability in skin\_shop/standard/2\_view\_body/body\_default.php in TECHNOTE 7.2, when register\_globals is enabled (no CVSS)
- [CVE-2009-0442](https://cve.now/CVE-2009-0442.md): Directory traversal vulnerability in bbcode.php in PHPbbBook 1.3 and 1.3h allows remote attackers to include and execute arbitrary local fil (no CVSS)
- [CVE-2009-0443](https://cve.now/CVE-2009-0443.md): Stack-based buffer overflow in Elecard AVC HD PLAYER 5.5.90116 allows remote attackers to execute arbitrary code via an M3U file containing (no CVSS)
- [CVE-2009-0444](https://cve.now/CVE-2009-0444.md): Multiple PHP remote file inclusion vulnerabilities in GRBoard 1.8, when register\_globals is enabled and magic\_quotes\_gpc is disabled, allow (no CVSS)
- [CVE-2009-0445](https://cve.now/CVE-2009-0445.md): SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL commands via the exhi (no CVSS)
- [CVE-2009-0446](https://cve.now/CVE-2009-0446.md): SQL injection vulnerability in photo.php in WEBalbum 2.4b allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2009-0447](https://cve.now/CVE-2009-0447.md): Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via (1) (no CVSS)
- [CVE-2009-0448](https://cve.now/CVE-2009-0448.md): Directory traversal vulnerability in admin/modules/aa/preview.php in Syntax Desktop 2.7 allows remote attackers to include and execute arbit (no CVSS)
- [CVE-2009-0449](https://cve.now/CVE-2009-0449.md): Buffer overflow in klim5.sys in Kaspersky Anti-Virus for Workstations 6.0 and Anti-Virus 2008 allows local users to gain privileges via an I (no CVSS)
- [CVE-2009-0450](https://cve.now/CVE-2009-0450.md): Stack-based buffer overflow in BlazeVideo HDTV Player 3.5 and earlier allows remote attackers to execute arbitrary code via a long string in (no CVSS)
- [CVE-2009-0451](https://cve.now/CVE-2009-0451.md): SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Admin name field to the (no CVSS)
- [CVE-2009-0452](https://cve.now/CVE-2009-0452.md): Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic\_quotes\_gpc is disabled, allow remote attacker (no CVSS)
- [CVE-2009-0453](https://cve.now/CVE-2009-0453.md): Online Grades 3.2.4 allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo (no CVSS)
- [CVE-2009-0454](https://cve.now/CVE-2009-0454.md): Multiple SQL injection vulnerabilities in DMXReady Online Notebook Manager 1.1 allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6065](https://cve.now/CVE-2008-6065.md): Oracle Database Server 10.1, 10.2, and 11g grants directory WRITE permissions for arbitrary pathnames that are aliased in a CREATE OR REPLAC (no CVSS)
- [CVE-2008-6066](https://cve.now/CVE-2008-6066.md): Multiple PHP remote file inclusion vulnerabilities in Meet#Web 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the roo (no CVSS)
- [CVE-2008-6060](https://cve.now/CVE-2008-6060.md): Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by InfoSoft FusionCharts allows re (no CVSS)
- [CVE-2008-6061](https://cve.now/CVE-2008-6061.md): Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) controller files created by Techsmith Camtasia S (no CVSS)
- [CVE-2008-6062](https://cve.now/CVE-2008-6062.md): Cross-site scripting (XSS) vulnerability in ActionScript in arbitrary Shockwave Flash (SWF) files created by Adobe Dreamweaver, when the Ins (no CVSS)
- [CVE-2008-6063](https://cve.now/CVE-2008-6063.md): Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" ope (no CVSS)
- [CVE-2008-6064](https://cve.now/CVE-2008-6064.md): Multiple SQL injection vulnerabilities in DomPHP 0.81 allow remote attackers to execute arbitrary SQL commands via the cat parameter to agen (no CVSS)
- [CVE-2008-4419](https://cve.now/CVE-2008-4419.md): Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet (no CVSS)
- [CVE-2008-6058](https://cve.now/CVE-2008-6058.md): Syslserve 1.058 and earlier, and probably 1.059, allows remote attackers to cause a denial of service (hang) via a crafted UDP Syslog packet (no CVSS)
- [CVE-2008-6059](https://cve.now/CVE-2008-6059.md): xml/XMLHttpRequest.cpp in WebCore in WebKit before r38566 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set (no CVSS)
- [CVE-2009-0058](https://cve.now/CVE-2009-0058.md): The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LA (no CVSS)
- [CVE-2009-0059](https://cve.now/CVE-2009-0059.md): The Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalyst 3750 Integrated Wireless LA (no CVSS)
- [CVE-2009-0061](https://cve.now/CVE-2009-0061.md): Unspecified vulnerability in the Wireless LAN Controller (WLC) TSEC driver in the Cisco 4400 WLC, Cisco Catalyst 6500 and 7600 Wireless Serv (no CVSS)
- [CVE-2009-0062](https://cve.now/CVE-2009-0062.md): Unspecified vulnerability in the Cisco Wireless LAN Controller (WLC), Cisco Catalyst 6500 Wireless Services Module (WiSM), and Cisco Catalys (no CVSS)
- [CVE-2009-0420](https://cve.now/CVE-2009-0420.md): SQL injection vulnerability in the RD-Autos (com\_rdautos) 1.5.5 Stable component for Joomla! allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2009-0421](https://cve.now/CVE-2009-0421.md): SQL injection vulnerability in the Eventing (com\_eventing) 1.6.x component for Joomla! allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2009-0422](https://cve.now/CVE-2009-0422.md): Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register\_globals is disabled, allows remote (no CVSS)
- [CVE-2009-0423](https://cve.now/CVE-2009-0423.md): Directory traversal vulnerability in index.php in Php Photo Album (PHPPA) 0.8 BETA allows remote attackers to include and execute arbitrary (no CVSS)
- [CVE-2009-0424](https://cve.now/CVE-2009-0424.md): Cross-site scripting (XSS) vulnerability in sign1.php in AN Guestbook (ANG) before 0.7.7 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2009-0425](https://cve.now/CVE-2009-0425.md): SQL injection vulnerability in index.php in Blue Eye CMS 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-0426](https://cve.now/CVE-2009-0426.md): SQL injection vulnerability in CategoryManager/upload\_image\_category.asp in DMXReady Classified Listings Manager 1.1 and earlier allows remo (no CVSS)
- [CVE-2009-0427](https://cve.now/CVE-2009-0427.md): SQL injection vulnerability in CategoryManager/upload\_image\_category.asp in DMXReady Member Directory Manager 1.1 and earlier allows remote (no CVSS)
- [CVE-2009-0428](https://cve.now/CVE-2009-0428.md): SQL injection vulnerability in CategoryManager/upload\_image\_category.asp in DMXReady Secure Document Library 1.1 and earlier allows remote a (no CVSS)
- [CVE-2009-0429](https://cve.now/CVE-2009-0429.md): Multiple SQL injection vulnerabilities in Active Bids allow remote attackers to execute arbitrary SQL commands via the (1) search parameter (no CVSS)
- [CVE-2009-0430](https://cve.now/CVE-2009-0430.md): Multiple cross-site scripting (XSS) vulnerabilities in Active Bids allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2009-0431](https://cve.now/CVE-2009-0431.md): SQL injection vulnerability in Default.asp in LinksPro Standard Edition allows remote attackers to execute arbitrary SQL commands via the Or (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.