# CVEs published 2009-03-02

50 CVEs were published on March 2, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0368](https://cve.now/CVE-2009-0368.md): OpenSC before 0.11.7 allows physically proximate attackers to bypass intended PIN requirements and read private data objects via a (1) low l (no CVSS)
- [CVE-2009-0750](https://cve.now/CVE-2009-0750.md): SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-0751](https://cve.now/CVE-2009-0751.md): Yaws before 1.80 allows remote attackers to cause a denial of service (memory consumption and crash) via a request with a large number of he (no CVSS)
- [CVE-2009-0749](https://cve.now/CVE-2009-0749.md): Use-after-free vulnerability in the GIFReadNextExtension function in lib/pngxtern/gif/gifread.c in OptiPNG 0.6.2 and earlier allows context- (no CVSS)
- [CVE-2008-6367](https://cve.now/CVE-2008-6367.md): Unrestricted file upload vulnerability in Photos/create\_album.php in Social Groupie allows remote authenticated users to execute arbitrary c (no CVSS)
- [CVE-2008-6368](https://cve.now/CVE-2008-6368.md): SQL injection vulnerability in index.php in Chipmunk Guestbook 1.4m allows remote attackers to execute arbitrary SQL commands via the start (no CVSS)
- [CVE-2008-6369](https://cve.now/CVE-2008-6369.md): SQL injection vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6370](https://cve.now/CVE-2008-6370.md): Cross-site scripting (XSS) vulnerability in default.asp in Ocean12 Contact Manager Pro 1.02 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2008-6371](https://cve.now/CVE-2008-6371.md): SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6372](https://cve.now/CVE-2008-6372.md): SQL injection vulnerability in default.asp in Ocean12 FAQ Manager Pro 1.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6373](https://cve.now/CVE-2008-6373.md): Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive externa (no CVSS)
- [CVE-2008-6374](https://cve.now/CVE-2008-6374.md): CodefixerSoftware MailingListPro Free Edition stores sensitive information under the web root with insufficient access control, which allows (no CVSS)
- [CVE-2008-6375](https://cve.now/CVE-2008-6375.md): JBook stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the databa (no CVSS)
- [CVE-2008-6376](https://cve.now/CVE-2008-6376.md): SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the password (pass parameter) (no CVSS)
- [CVE-2008-6377](https://cve.now/CVE-2008-6377.md): PHP remote file inclusion vulnerability in include/global.php in Multi SEO phpBB 1.1.0 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2008-6378](https://cve.now/CVE-2008-6378.md): SQL injection vulnerability in calendar\_Eventupdate.asp in Calendar Mx Professional 2.0.0 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2008-6379](https://cve.now/CVE-2008-6379.md): SQL injection vulnerability in pics\_pre.asp in Gallery MX 2.0.0 allows remote attackers to execute arbitrary SQL commands via the ID paramet (no CVSS)
- [CVE-2008-6380](https://cve.now/CVE-2008-6380.md): SQL injection vulnerability in default.aspx in Active Web Helpdesk 2.0 allows remote attackers to execute arbitrary SQL commands via the Cat (no CVSS)
- [CVE-2008-6381](https://cve.now/CVE-2008-6381.md): SQL injection vulnerability in modules/adresses/viewcat.php in bcoos 1.0.13, and possibly earlier, allows remote authenticated users with Ad (no CVSS)
- [CVE-2008-6382](https://cve.now/CVE-2008-6382.md): ASP Portal 3.2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS)
- [CVE-2008-6383](https://cve.now/CVE-2008-6383.md): SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for (no CVSS)
- [CVE-2008-6384](https://cve.now/CVE-2008-6384.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers t (no CVSS)
- [CVE-2008-6385](https://cve.now/CVE-2008-6385.md): Cross-site scripting (XSS) vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-6386](https://cve.now/CVE-2008-6386.md): Cross-site scripting (XSS) vulnerability in showads.php in Z1Exchange 1.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-6387](https://cve.now/CVE-2008-6387.md): Quick Tree View .NET 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2008-6388](https://cve.now/CVE-2008-6388.md): Rapid Classified 3.1 and 3.15 stores sensitive information under the web root with insufficient access control, which allows remote attacker (no CVSS)
- [CVE-2008-6389](https://cve.now/CVE-2008-6389.md): SQL injection vulnerability in asadmin/default.asp in Rae Media Contact Management Software SOHO, Standard, and Enterprise allows remote att (no CVSS)
- [CVE-2008-6390](https://cve.now/CVE-2008-6390.md): SQL injection vulnerability in login.asp in Ocean12 Membership Manager Pro allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6391](https://cve.now/CVE-2008-6391.md): SQL injection vulnerability in main.asp in Jbook allows remote attackers to execute arbitrary SQL commands via the username (user parameter) (no CVSS)
- [CVE-2008-6392](https://cve.now/CVE-2008-6392.md): SQL injection vulnerability in showads.php in Z1Exchange allows remote attackers to execute arbitrary SQL commands via the id parameter. (no CVSS)
- [CVE-2008-6347](https://cve.now/CVE-2008-6347.md): PHP remote file inclusion vulnerability in lib/onguma.class.php in the Onguma Time Sheet (com\_ongumatimesheet20) 2.0 4b component for Joomla (no CVSS)
- [CVE-2008-6348](https://cve.now/CVE-2008-6348.md): Multiple SQL injection vulnerabilities in DevelopItEasy Photo Gallery 1.2 allow remote attackers to execute arbitrary SQL commands via the ( (no CVSS)
- [CVE-2008-6349](https://cve.now/CVE-2008-6349.md): SQL injection vulnerability in survey\_results\_text.php in TurnkeyForms Business Survey Pro 1.0 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-6350](https://cve.now/CVE-2008-6350.md): SQL injection vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6351](https://cve.now/CVE-2008-6351.md): Cross-site scripting (XSS) vulnerability in listtest.php in TurnkeyForms Local Classifieds allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2008-6352](https://cve.now/CVE-2008-6352.md): SQL injection vulnerability in home.html in Xpoze Pro 4.10 allows remote attackers to execute arbitrary SQL commands via the menu parameter. (no CVSS)
- [CVE-2008-6353](https://cve.now/CVE-2008-6353.md): SQL injection vulnerability in index.asp in ASP-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cha parameter. (no CVSS)
- [CVE-2008-6354](https://cve.now/CVE-2008-6354.md): The Net Guys ASPired2poll stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2008-6355](https://cve.now/CVE-2008-6355.md): The Net Guys ASPired2Protect stores sensitive information under the web root with insufficient access control, which allows remote attackers (no CVSS)
- [CVE-2008-6356](https://cve.now/CVE-2008-6356.md): evCal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow (no CVSS)
- [CVE-2008-6357](https://cve.now/CVE-2008-6357.md): MyCal Personal Events Calendar stores sensitive information under the web root with insufficient access control, which allows remote attacke (no CVSS)
- [CVE-2008-6358](https://cve.now/CVE-2008-6358.md): SQL injection vulnerability in group\_index.php in Social Groupie allows remote attackers to execute arbitrary SQL commands via the id parame (no CVSS)
- [CVE-2008-6359](https://cve.now/CVE-2008-6359.md): Cross-site scripting (XSS) vulnerability in index.php in Max's Guestbook allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-6360](https://cve.now/CVE-2008-6360.md): Cross-site scripting (XSS) vulnerability in the userranks feature in modules/system/admin.php in ImpressCMS 1.0.2 final allows remote attack (no CVSS)
- [CVE-2008-6361](https://cve.now/CVE-2008-6361.md): Directory traversal vulnerability in index.php in InSun Feed CMS 1.7.3 19Beta allows remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2008-6362](https://cve.now/CVE-2008-6362.md): SQL injection vulnerability in sitepage.php in Multiple Membership Script 2.5 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6363](https://cve.now/CVE-2008-6363.md): Stack-based buffer overflow in DesignWorks Professional 4.3.1 and 5.0.7 allows remote attackers to execute arbitrary code via a crafted .cct (no CVSS)
- [CVE-2008-6364](https://cve.now/CVE-2008-6364.md): SQL injection vulnerability in logon\_process.jsp in Ad Server Solutions Banner Exchange Solution Java allows remote attackers to execute arb (no CVSS)
- [CVE-2008-6365](https://cve.now/CVE-2008-6365.md): SQL injection vulnerability in logon.jsp in Ad Server Solutions Ad Management Software Java allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-6366](https://cve.now/CVE-2008-6366.md): SQL injection vulnerability in logon.jsp in Ad Server Solutions Affiliate Software Java 4.0 allows remote attackers to execute arbitrary SQL (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.