# CVEs published 2009-02-26

43 CVEs were published on February 26, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-4308](https://cve.now/CVE-2008-4308.md): The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error con (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2008-6302](https://cve.now/CVE-2008-6302.md): TurnkeyForms Local Classifieds allows remote attackers to bypass authentication and gain administrative access via a direct request to Site\_ (no CVSS)
- [CVE-2008-6303](https://cve.now/CVE-2008-6303.md): SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands via the tourid paramet (no CVSS)
- [CVE-2008-6304](https://cve.now/CVE-2008-6304.md): SQL injection vulnerability in xt:Commerce before 3.0.4 Sp2.1, when magic\_quotes\_gpc is enabled and the SEO URLs are activated, allows remot (no CVSS)
- [CVE-2008-6305](https://cve.now/CVE-2008-6305.md): PHP remote file inclusion vulnerability in init.php in Free Directory Script 1.1.1, when register\_globals is enabled, allows remote attacker (no CVSS)
- [CVE-2008-6306](https://cve.now/CVE-2008-6306.md): Cross-site scripting (XSS) vulnerability in signinform.php in Softbiz Classifieds Script allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-6307](https://cve.now/CVE-2008-6307.md): E-topbiz Link Back Checker 1 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to " (no CVSS)
- [CVE-2009-0208](https://cve.now/CVE-2009-0208.md): Unspecified vulnerability in HP Virtual Rooms Client before 7.0.1, when running on Windows, allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2008-5263](https://cve.now/CVE-2008-5263.md): Multiple stack-based buffer overflows in the mt\_codec::getHdrHead function in kernel/kls\_hdr/fmt\_codec\_hdr.cpp in ksquirrel-libs 0.8.0 allow (no CVSS)
- [CVE-2008-6289](https://cve.now/CVE-2008-6289.md): SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the cityid pa (no CVSS)
- [CVE-2008-6290](https://cve.now/CVE-2008-6290.md): Directory traversal vulnerability in includefile.php in nicLOR Sito, when register\_globals is enabled or magic\_quotes\_gpc is disabled, allow (no CVSS)
- [CVE-2008-6291](https://cve.now/CVE-2008-6291.md): Acc PHP eMail 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the NEWSLETTERLOGIN cookie to " (no CVSS)
- [CVE-2008-6292](https://cve.now/CVE-2008-6292.md): Acc Autos 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) username\_cookie to "admin," (no CVSS)
- [CVE-2008-6293](https://cve.now/CVE-2008-6293.md): admin/Index.php in Acc Real Estate 4.0 allows remote attackers to bypass authentication and gain administrative access by setting the userna (no CVSS)
- [CVE-2008-6294](https://cve.now/CVE-2008-6294.md): admin/Index.php in Acc Statistics 1.1 allows remote attackers to bypass authentication and gain administrative access by setting the usernam (no CVSS)
- [CVE-2008-6295](https://cve.now/CVE-2008-6295.md): Multiple cross-site scripting (XSS) vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-6296](https://cve.now/CVE-2008-6296.md): admin.php in Maran PHP Shop allows remote attackers to bypass authentication and gain administrative access by setting the user cookie to "d (no CVSS)
- [CVE-2008-6297](https://cve.now/CVE-2008-6297.md): Cross-site scripting (XSS) vulnerability in order.php in DHCart allows remote attackers to inject arbitrary web script or HTML via the (1) d (no CVSS)
- [CVE-2008-6298](https://cve.now/CVE-2008-6298.md): Unspecified vulnerability in sISAPILocation before 1.0.2.2 allows remote attackers to bypass intended access restrictions for character enco (no CVSS)
- [CVE-2008-6299](https://cve.now/CVE-2008-6299.md): Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5.7 and earlier allow remote authenticated users with certain privileges to (no CVSS)
- [CVE-2008-6300](https://cve.now/CVE-2008-6300.md): Galatolo WebManager 1.3a allows remote attackers to bypass authentication and gain administrative access by setting the (1) gwm\_user and (2) (no CVSS)
- [CVE-2008-6301](https://cve.now/CVE-2008-6301.md): SQL injection vulnerability in shoutbox\_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-0114](https://cve.now/CVE-2009-0114.md): Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other (no CVSS)
- [CVE-2009-0187](https://cve.now/CVE-2009-0187.md): Stack-based buffer overflow in Orbit Downloader 2.8.2 and 2.8.3, and possibly other versions before 2.8.5, allows remote attackers to execut (no CVSS)
- [CVE-2009-0507](https://cve.now/CVE-2009-0507.md): IBM WebSphere Process Server (WPS) 6.1.2 before 6.1.2.3 and 6.2 before 6.2.0.1 does not properly restrict configuration data during an expor (no CVSS)
- [CVE-2009-0519](https://cve.now/CVE-2009-0519.md): Unspecified vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2009-0520](https://cve.now/CVE-2009-0520.md): Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 does not properly remove references to destroyed objects during Shockwave (no CVSS)
- [CVE-2009-0521](https://cve.now/CVE-2009-0521.md): Untrusted search path vulnerability in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Linux allows local users to obt (no CVSS)
- [CVE-2009-0522](https://cve.now/CVE-2009-0522.md): Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87 on Windows allows remote attackers to trick a user into visiting an arbit (no CVSS)
- [CVE-2009-0523](https://cve.now/CVE-2009-0523.md): Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-0524](https://cve.now/CVE-2009-0524.md): Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 6 and 7, and RoboHelp Server 6 and 7, allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2009-0614](https://cve.now/CVE-2009-0614.md): Unspecified vulnerability in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 befor (no CVSS)
- [CVE-2009-0615](https://cve.now/CVE-2009-0615.md): Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manag (no CVSS)
- [CVE-2009-0616](https://cve.now/CVE-2009-0616.md): Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to ac (no CVSS)
- [CVE-2009-0617](https://cve.now/CVE-2009-0617.md): Cisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which makes it easier for remote attackers to exec (no CVSS)
- [CVE-2009-0618](https://cve.now/CVE-2009-0618.md): Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gai (no CVSS)
- [CVE-2009-0620](https://cve.now/CVE-2009-0620.md): Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) pa (no CVSS)
- [CVE-2009-0621](https://cve.now/CVE-2009-0621.md): Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b (no CVSS)
- [CVE-2009-0622](https://cve.now/CVE-2009-0622.md): Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisc (no CVSS)
- [CVE-2009-0623](https://cve.now/CVE-2009-0623.md): Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.3) and Cisc (no CVSS)
- [CVE-2009-0624](https://cve.now/CVE-2009-0624.md): Unspecified vulnerability in the SNMPv2c implementation in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 R (no CVSS)
- [CVE-2009-0625](https://cve.now/CVE-2009-0625.md): Unspecified vulnerability in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.2) and Cisc (no CVSS)
- [CVE-2009-0742](https://cve.now/CVE-2009-0742.md): The username command in Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers and Cisco ACE 4710 Applicati (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-02-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.