# CVEs published 2009-02-13

38 CVEs were published on February 13, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6126](https://cve.now/CVE-2008-6126.md): Multiple directory traversal vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-6127](https://cve.now/CVE-2008-6127.md): Multiple cross-site scripting (XSS) vulnerabilities in moziloCMS 1.10.2 and earlier allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-6128](https://cve.now/CVE-2008-6128.md): Session fixation vulnerability in moziloCMS 1.10.2 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID param (no CVSS)
- [CVE-2008-6129](https://cve.now/CVE-2008-6129.md): Directory traversal vulnerability in print.php in moziloWiki 1.0.1 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-6130](https://cve.now/CVE-2008-6130.md): Cross-site scripting (XSS) vulnerability in index.php in moziloWiki 1.0.1 and earlier allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-6131](https://cve.now/CVE-2008-6131.md): Session fixation vulnerability in moziloWiki 1.0.1 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID param (no CVSS)
- [CVE-2008-6132](https://cve.now/CVE-2008-6132.md): Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers (no CVSS)
- [CVE-2008-6133](https://cve.now/CVE-2008-6133.md): SQL injection vulnerability in arsaprint.php in Full PHP Emlak Script allows remote attackers to execute arbitrary SQL commands via the id p (no CVSS)
- [CVE-2009-0216](https://cve.now/CVE-2009-0216.md): GE Fanuc iFIX 5.0 and earlier relies on client-side authentication involving a weakly encrypted local password file, which allows remote att (no CVSS)
- [CVE-2009-0360](https://cve.now/CVE-2009-0360.md): Russ Allbery pam-krb5 before 3.13, when linked against MIT Kerberos, does not properly initialize the Kerberos libraries for setuid use, whi (no CVSS)
- [CVE-2009-0361](https://cve.now/CVE-2009-0361.md): Russ Allbery pam-krb5 before 3.13, as used by libpam-heimdal, su in Solaris 10, and other software, does not properly handle calls to pam\_se (no CVSS)
- [CVE-2009-0503](https://cve.now/CVE-2009-0503.md): IBM WebSphere Message Broker 6.1.x before 6.1.0.2 writes a database connection password to the Event Log and System Log during exception han (no CVSS)
- [CVE-2009-0570](https://cve.now/CVE-2009-0570.md): Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register\_globals is enabled and magic\_quotes\_gpc is disable (no CVSS)
- [CVE-2009-0571](https://cve.now/CVE-2009-0571.md): admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allow (no CVSS)
- [CVE-2009-0572](https://cve.now/CVE-2009-0572.md): PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04, when register\_globa (no CVSS)
- [CVE-2009-0573](https://cve.now/CVE-2009-0573.md): Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-0574](https://cve.now/CVE-2009-0574.md): SQL injection vulnerability in index.php in Easy CafeEngine allows remote attackers to execute arbitrary SQL commands via the catid paramete (no CVSS)
- [CVE-2009-0575](https://cve.now/CVE-2009-0575.md): Cross-site scripting (XSS) vulnerability in the theme\_views\_bulk\_operations\_confirmation function in views\_bulk\_operations.module in Views B (no CVSS)
- [CVE-2009-0576](https://cve.now/CVE-2009-0576.md): Unspecified vulnerability in Sun Java System Directory Server 5.2 p6 and earlier, and Enterprise Edition 5, allows remote attackers to cause (no CVSS)
- [CVE-2008-6124](https://cve.now/CVE-2008-6124.md): SQL injection vulnerability in the hotpot\_delete\_selected\_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1 (no CVSS)
- [CVE-2008-6125](https://cve.now/CVE-2008-6125.md): Unspecified vulnerability in the user editing interface in Moodle 1.5.x, 1.6 before 1.6.6, and 1.7 before 1.7.3 allows remote authenticated (no CVSS)
- [CVE-2009-0362](https://cve.now/CVE-2009-0362.md): filter.d/wuftpd.conf in Fail2ban 0.8.3 uses an incorrect regular expression that allows remote attackers to cause a denial of service (force (no CVSS)
- [CVE-2009-0569](https://cve.now/CVE-2009-0569.md): Buffer overflow in Becky! Internet Mail 2.48.02 and earlier allows remote attackers to execute arbitrary code via a mail message with a craf (no CVSS)
- [CVE-2009-0009](https://cve.now/CVE-2009-0009.md): Unspecified vulnerability in the Pixlet codec in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (app (no CVSS)
- [CVE-2009-0011](https://cve.now/CVE-2009-0011.md): Certificate Assistant in Apple Mac OS X 10.5.6 allows local users to overwrite arbitrary files via unknown vectors related to an "insecure f (no CVSS)
- [CVE-2009-0012](https://cve.now/CVE-2009-0012.md): Heap-based buffer overflow in CoreText in Apple Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via a crafted Unicode stri (no CVSS)
- [CVE-2009-0013](https://cve.now/CVE-2009-0013.md): dscl in DS Tools in Apple Mac OS X 10.4.11 and 10.5.6 requires that passwords must be provided as command line arguments, which allows local (no CVSS)
- [CVE-2009-0014](https://cve.now/CVE-2009-0014.md): Folder Manager in Apple Mac OS X 10.5.6 uses insecure default permissions when recreating a Downloads folder after it has been deleted, whic (no CVSS)
- [CVE-2009-0015](https://cve.now/CVE-2009-0015.md): Unspecified vulnerability in fseventsd in the FSEvents framework in Apple Mac OS X 10.5.6 allows local users to obtain sensitive information (no CVSS)
- [CVE-2009-0017](https://cve.now/CVE-2009-0017.md): csregprinter in the Printing component in Apple Mac OS X 10.4.11 and 10.5.6 does not properly handle error conditions, which allows local us (no CVSS)
- [CVE-2009-0018](https://cve.now/CVE-2009-0018.md): The Remote Apple Events server in Apple Mac OS X 10.4.11 and 10.5.6 does not properly initialize a buffer, which allows remote attackers to (no CVSS)
- [CVE-2009-0019](https://cve.now/CVE-2009-0019.md): Remote Apple Events in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (application termination) or o (no CVSS)
- [CVE-2009-0020](https://cve.now/CVE-2009-0020.md): Unspecified vulnerability in CarbonCore in Apple Mac OS X 10.4.11 and 10.5.6 allows remote attackers to cause a denial of service (applicati (no CVSS)
- [CVE-2009-0137](https://cve.now/CVE-2009-0137.md): Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to (no CVSS)
- [CVE-2009-0138](https://cve.now/CVE-2009-0138.md): servermgrd (Server Manager) in Apple Mac OS X 10.5.6 does not properly validate authentication credentials, which allows remote attackers to (no CVSS)
- [CVE-2009-0139](https://cve.now/CVE-2009-0139.md): Integer overflow in the SMB component in Apple Mac OS X 10.5.6 allows remote SMB servers to cause a denial of service (system shutdown) or e (no CVSS)
- [CVE-2009-0140](https://cve.now/CVE-2009-0140.md): Unspecified vulnerability in the SMB component in Apple Mac OS X 10.4.11 and 10.5.6 allows remote SMB servers to cause a denial of service ( (no CVSS)
- [CVE-2009-0141](https://cve.now/CVE-2009-0141.md): XTerm in Apple Mac OS X 10.4.11 and 10.5.6, when used with luit, creates tty devices with insecure world-writable permissions, which allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.