# CVEs published 2009-02-20

51 CVEs were published on February 20, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6223](https://cve.now/CVE-2008-6223.md): PHP remote file inclusion vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2008-6224](https://cve.now/CVE-2008-6224.md): Directory traversal vulnerability in visualizza.php in Way Of The Warrior (WOTW) 5.0 and earlier allows remote attackers to read arbitrary f (no CVSS)
- [CVE-2008-6225](https://cve.now/CVE-2008-6225.md): SQL injection vulnerability in info.php in Mole Group Airline Ticket Sale Script allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2008-6226](https://cve.now/CVE-2008-6226.md): SQL injection vulnerability in moreinfo.php in Pre Projects PHP Auto Listings Script, when magic\_quotes\_gpc is disabled, allows remote attac (no CVSS)
- [CVE-2008-6227](https://cve.now/CVE-2008-6227.md): SQL injection vulnerability in buyer\_detail.php in Pre Multi-Vendor Shopping Malls allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-6228](https://cve.now/CVE-2008-6228.md): Pre Multi-Vendor Shopping Malls allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname (no CVSS)
- [CVE-2008-6229](https://cve.now/CVE-2008-6229.md): Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6. (no CVSS)
- [CVE-2008-6230](https://cve.now/CVE-2008-6230.md): SQL injection vulnerability in Tour.php in Pre Projects Pre Podcast Portal allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6231](https://cve.now/CVE-2008-6231.md): Pre Classified Listing PHP allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and (no CVSS)
- [CVE-2008-6232](https://cve.now/CVE-2008-6232.md): Pre Shopping Mall allows remote attackers to bypass authentication and gain administrative access by setting the (1) adminname and the (2) a (no CVSS)
- [CVE-2008-6233](https://cve.now/CVE-2008-6233.md): SQL injection vulnerability in index.php in Five Dollar Scripts Drinks script allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6220](https://cve.now/CVE-2008-6220.md): SQL injection vulnerability in login.php in Simple Document Management System (SDMS) 1.1.5 and 1.1.4, and possibly earlier, allows remote at (no CVSS)
- [CVE-2008-6221](https://cve.now/CVE-2008-6221.md): PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com\_dadamail) component 2.6 for Joomla! allows remo (no CVSS)
- [CVE-2008-6222](https://cve.now/CVE-2008-6222.md): Directory traversal vulnerability in the Pro Desk Support Center (com\_pro\_desk) component 1.0 and 1.2 for Joomla! allows remote attackers to (no CVSS)
- [CVE-2009-0577](https://cve.now/CVE-2009-0577.md): Integer overflow in the WriteProlog function in texttops in CUPS 1.1.17 on Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to exec (no CVSS)
- [CVE-2009-0652](https://cve.now/CVE-2009-0652.md): The Internationalized Domain Names (IDN) blacklist in Mozilla Firefox 3.0.6 and other versions before 3.0.9; Thunderbird before 2.0.0.21; an (no CVSS)
- [CVE-2009-0653](https://cve.now/CVE-2009-0653.md): OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to s (no CVSS)
- [CVE-2009-0654](https://cve.now/CVE-2009-0654.md): Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm tha (no CVSS)
- [CVE-2009-0655](https://cve.now/CVE-2009-0655.md): Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user (no CVSS)
- [CVE-2009-0656](https://cve.now/CVE-2009-0656.md): Asus SmartLogon 1.0.0005 allows physically proximate attackers to bypass "security functions" by presenting an image with a modified viewpoi (no CVSS)
- [CVE-2009-0657](https://cve.now/CVE-2009-0657.md): Toshiba Face Recognition 2.0.2.32 allows physically proximate attackers to obtain notebook access by presenting a large number of images for (no CVSS)
- [CVE-2009-0658](https://cve.now/CVE-2009-0658.md): Buffer overflow in Adobe Reader 9.0 and earlier, and Acrobat 9.0 and earlier, allows remote attackers to execute arbitrary code via a crafte (no CVSS)
- [CVE-2009-0659](https://cve.now/CVE-2009-0659.md): Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 allows remote attackers to have an unknown impact via a STATS l (no CVSS)
- [CVE-2009-0649](https://cve.now/CVE-2009-0649.md): The web browser in Symbian OS on the Nokia N95 cell phone allows remote attackers to cause a denial of service (crash) via JavaScript code t (no CVSS)
- [CVE-2009-0650](https://cve.now/CVE-2009-0650.md): Stack-based buffer overflow in the GetStatsFromLine function in TPTEST 3.1.7 and earlier, and possibly 5.02, allows remote attackers to caus (no CVSS)
- [CVE-2009-0651](https://cve.now/CVE-2009-0651.md): Unspecified vulnerability in the Veritas network daemon (aka vnetd) in Symantec Veritas NetBackup Server / Enterprise Server 5.x, 6.0 before (no CVSS)
- [CVE-2008-6213](https://cve.now/CVE-2008-6213.md): SQL injection vulnerability in mypage.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2008-6214](https://cve.now/CVE-2008-6214.md): SQL injection vulnerability in poll\_results.php in Harlandscripts Pro Traffic One allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-6215](https://cve.now/CVE-2008-6215.md): Cross-site scripting (XSS) vulnerability in cadena\_ofertas\_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote (no CVSS)
- [CVE-2008-6216](https://cve.now/CVE-2008-6216.md): SQL injection vulnerability in cadena\_ofertas\_ext.php in Venalsur Booking Centre Booking System for Hotels Group allows remote attackers to (no CVSS)
- [CVE-2008-6217](https://cve.now/CVE-2008-6217.md): Cross-site scripting (XSS) vulnerability in index.php in Extrakt Framework 0.7 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-6218](https://cve.now/CVE-2008-6218.md): Memory leak in the png\_handle\_tEXt function in pngrutil.c in libpng before 1.2.33 rc02 and 1.4.0 beta36 allows context-dependent attackers t (no CVSS)
- [CVE-2008-6219](https://cve.now/CVE-2008-6219.md): nsrexecd.exe in multiple EMC Networker products including EMC NetWorker Server, Storage Node, and Client 7.3.x and 7.4, 7.4.1, 7.4.2, Client (no CVSS)
- [CVE-2008-6200](https://cve.now/CVE-2008-6200.md): Multiple cross-site scripting (XSS) vulnerabilities in Swiki 1.5 allow remote attackers to inject arbitrary web script or HTML via (1) the q (no CVSS)
- [CVE-2008-6201](https://cve.now/CVE-2008-6201.md): Directory traversal vulnerability in help.php in the eskuel module in KwsPHP 1.3.456, as available before 20080416, allows remote attackers (no CVSS)
- [CVE-2008-6202](https://cve.now/CVE-2008-6202.md): SQL injection vulnerability in CoBaLT 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) urun.asp, (2 (no CVSS)
- [CVE-2008-6203](https://cve.now/CVE-2008-6203.md): SQL injection vulnerability in adminler.asp in CoBaLT 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2008-6204](https://cve.now/CVE-2008-6204.md): Multiple SQL injection vulnerabilities in SuperNET Shop 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS)
- [CVE-2008-6205](https://cve.now/CVE-2008-6205.md): Cross-site scripting (XSS) vulnerability in seeurl.php in Xavier Flahaut URLStreet 1.0 allows remote attackers to inject arbitrary web scrip (no CVSS)
- [CVE-2008-6206](https://cve.now/CVE-2008-6206.md): Multiple PHP remote file inclusion vulnerabilities in RobotStats 0.1 allow remote attackers to execute arbitrary PHP code via a URL in the D (no CVSS)
- [CVE-2008-6207](https://cve.now/CVE-2008-6207.md): Unrestricted file upload vulnerability in form\_upload.php in PHPG Upload 1.0 allows remote authenticated users to execute arbitrary code by (no CVSS)
- [CVE-2008-6208](https://cve.now/CVE-2008-6208.md): Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-6209](https://cve.now/CVE-2008-6209.md): SQL injection vulnerability in view\_product.php in Vastal I-Tech Software Zone allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6210](https://cve.now/CVE-2008-6210.md): SQL injection vulnerability in index.php in dream4 Koobi 4.4 and 5.4 allows remote attackers to execute arbitrary SQL commands via the img\_i (no CVSS)
- [CVE-2008-6211](https://cve.now/CVE-2008-6211.md): Multiple cross-site scripting (XSS) vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-6212](https://cve.now/CVE-2008-6212.md): Cross-site scripting (XSS) vulnerability in admin.php in Php-Stats 0.1.9.1 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2008-6195](https://cve.now/CVE-2008-6195.md): Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remo (no CVSS)
- [CVE-2008-6196](https://cve.now/CVE-2008-6196.md): Multiple PHP remote file inclusion vulnerabilities in Philippe CROCHAT EasySite 2.0 allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2008-6197](https://cve.now/CVE-2008-6197.md): SQL injection vulnerability in index.php in the galerie module for KwsPHP 1.3.456 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-6198](https://cve.now/CVE-2008-6198.md): SQL injection vulnerability in pages.php in Custom Pages 1.0 plugin for MyBulletinBoard (MyBB) allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-6199](https://cve.now/CVE-2008-6199.md): 2532designs 2532|Gigs 1.2.2 and earlier allows remote attackers to trigger a backup and obtain sensitive information via a direct request to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.