# CVEs published 2009-02-18

16 CVEs were published on February 18, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0645](https://cve.now/CVE-2009-0645.md): Directory traversal vulnerability in index.php in Jaws 0.8.8 allows remote authenticated users to read arbitrary files via a .. (no CVSS)
- [CVE-2009-0646](https://cve.now/CVE-2009-0646.md): Multiple SQL injection vulnerabilities in 4Site CMS 2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) log (no CVSS)
- [CVE-2005-4878](https://cve.now/CVE-2005-4878.md): Multiple cross-site scripting (XSS) vulnerabilities in (1) acid\_qry\_main.php in Analysis Console for Intrusion Databases (ACID) 0.9.6b20 and (no CVSS)
- [CVE-2009-0644](https://cve.now/CVE-2009-0644.md): The HTTP interface in Swann DVR4-SecuraNet has a certain default administrative username and password, which makes it easier for remote atta (no CVSS)
- [CVE-2008-6162](https://cve.now/CVE-2008-6162.md): Bux.to Clone script allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1 and (no CVSS)
- [CVE-2008-6163](https://cve.now/CVE-2008-6163.md): SQL injection vulnerability in www/delivery/ac.php in OpenX 2.6.1 allows remote attackers to execute arbitrary SQL commands via the bannerid (no CVSS)
- [CVE-2008-6164](https://cve.now/CVE-2008-6164.md): Cross-site scripting (XSS) vulnerability in index.php in DreamCost HostAdmin 3.1.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-0640](https://cve.now/CVE-2009-0640.md): Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2009-0641](https://cve.now/CVE-2009-0641.md): sys\_term.c in telnetd in FreeBSD 7.0-RELEASE and other 7.x versions deletes dangerous environment variables with a method that was valid onl (no CVSS)
- [CVE-2009-0642](https://cve.now/CVE-2009-0642.md): ext/openssl/ossl\_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP\_basic\_verify function, which might allow (no CVSS)
- [CVE-2009-0643](https://cve.now/CVE-2009-0643.md): Static code injection vulnerability in post.php in Simple PHP News 1.0 final allows remote attackers to inject arbitrary PHP code into news. (no CVSS)
- [CVE-2008-6159](https://cve.now/CVE-2008-6159.md): Content Management Made Easy (CMME) 1.19 allows remote attackers to obtain system information via a direct request to info.php, which invoke (no CVSS)
- [CVE-2008-6160](https://cve.now/CVE-2008-6160.md): Semantically-Interconnected Online Communities (SIOC) 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, does not properly impl (no CVSS)
- [CVE-2008-6161](https://cve.now/CVE-2008-6161.md): Cross-site scripting (XSS) vulnerability in WOW Raid Manager (WRM) before 3.5.1 allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2009-0310](https://cve.now/CVE-2009-0310.md): Buffer overflow in SUSE blinux (aka sbl) in SUSE openSUSE 10.3 through 11.0 has unknown impact and attack vectors related to "incoming data (no CVSS)
- [CVE-2009-0639](https://cve.now/CVE-2009-0639.md): PHP remote file inclusion vulnerability in moduli/libri/index.php in phpyabs 0.1.2 allows remote attackers to execute arbitrary PHP code via (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.