# CVEs published 2009-03-05

32 CVEs were published on March 5, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6399](https://cve.now/CVE-2008-6399.md): Unspecified vulnerability in DotNetNuke 4.5.2 through 4.9 allows remote attackers to "add additional roles to their user account" via unknow (no CVSS)
- [CVE-2008-6400](https://cve.now/CVE-2008-6400.md): Cross-site scripting (XSS) vulnerability in refbase before 0.9.5 allows remote attackers to inject arbitrary web script or HTML via the head (no CVSS)
- [CVE-2009-0826](https://cve.now/CVE-2009-0826.md): BlogHelper stores common\_db.inc under the web root with insufficient access control, which allows remote attackers to download the database (no CVSS)
- [CVE-2009-0827](https://cve.now/CVE-2009-0827.md): PollHelper stores poll.inc under the web root with insufficient access control, which allows remote attackers to download the database file (no CVSS)
- [CVE-2009-0828](https://cve.now/CVE-2009-0828.md): QuoteBook stores quotes.inc under the web root with insufficient access control, which allows remote attackers to obtain sensitive database (no CVSS)
- [CVE-2009-0829](https://cve.now/CVE-2009-0829.md): Multiple SQL injection vulnerabilities in QuoteBook allow remote attackers to execute arbitrary SQL commands via the (1) MyBox and (2) selec (no CVSS)
- [CVE-2009-0830](https://cve.now/CVE-2009-0830.md): Cross-site scripting (XSS) vulnerability in QuoteBook allows remote attackers to inject arbitrary web script or HTML via the (1) QuoteName a (no CVSS)
- [CVE-2009-0831](https://cve.now/CVE-2009-0831.md): SQL injection vulnerability in members.php in the Members CV (job) module 1.0 for PHP-Fusion, when magic\_quotes\_gpc is disabled, allows remo (no CVSS)
- [CVE-2009-0832](https://cve.now/CVE-2009-0832.md): SQL injection vulnerability in items.php in the E-Cart module 1.3 for PHP-Fusion allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2009-0833](https://cve.now/CVE-2009-0833.md): Heap-based buffer overflow in gen\_msn.dll in the gen\_msn plugin 0.31 for Winamp 5.541 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2009-0037](https://cve.now/CVE-2009-0037.md): The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT\_FOLLOWLOCATION is enabled, accepts arbitrary Location valu (no CVSS)
- [CVE-2009-0186](https://cve.now/CVE-2009-0186.md): Integer overflow in libsndfile 1.0.18, as used in Winamp and other products, allows context-dependent attackers to execute arbitrary code vi (no CVSS)
- [CVE-2009-0365](https://cve.now/CVE-2009-0365.md): nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains an incorrect deny setting, which allows local users to discover (1) network (no CVSS)
- [CVE-2009-0367](https://cve.now/CVE-2009-0367.md): The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by usin (no CVSS)
- [CVE-2009-0578](https://cve.now/CVE-2009-0578.md): GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local use (no CVSS)
- [CVE-2009-0619](https://cve.now/CVE-2009-0619.md): Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows remote attackers to caus (no CVSS)
- [CVE-2009-0771](https://cve.now/CVE-2009-0771.md): The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a deni (no CVSS)
- [CVE-2009-0772](https://cve.now/CVE-2009-0772.md): The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to caus (no CVSS)
- [CVE-2009-0773](https://cve.now/CVE-2009-0773.md): The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a (no CVSS)
- [CVE-2009-0774](https://cve.now/CVE-2009-0774.md): The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to caus (no CVSS)
- [CVE-2009-0775](https://cve.now/CVE-2009-0775.md): Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers (no CVSS)
- [CVE-2009-0776](https://cve.now/CVE-2009-0776.md): nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass th (no CVSS)
- [CVE-2009-0777](https://cve.now/CVE-2009-0777.md): Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed i (no CVSS)
- [CVE-2009-0813](https://cve.now/CVE-2009-0813.md): Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote atta (no CVSS)
- [CVE-2009-0814](https://cve.now/CVE-2009-0814.md): Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2009-0815](https://cve.now/CVE-2009-0815.md): The jumpUrl mechanism in class.tslib\_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alp (no CVSS, typo3/cms)
- [CVE-2009-0816](https://cve.now/CVE-2009-0816.md): Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 befor (no CVSS, typo3/cms)
- [CVE-2009-0817](https://cve.now/CVE-2009-0817.md): Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows (no CVSS)
- [CVE-2009-0818](https://cve.now/CVE-2009-0818.md): Cross-site scripting (XSS) vulnerability in the taxonomy\_theme\_admin\_table\_builder function (taxonomy\_theme\_admin.inc) in Taxonomy Theme mod (no CVSS)
- [CVE-2009-0819](https://cve.now/CVE-2009-0819.md): sql/item\_xmlfunc.cc in MySQL 5.1 before 5.1.32 and 6.0 before 6.0.10 allows remote authenticated users to cause a denial of service (crash) (no CVSS)
- [CVE-2009-0820](https://cve.now/CVE-2009-0820.md): Multiple eval injection vulnerabilities in phpScheduleIt before 1.2.11 allow remote attackers to execute arbitrary code via (1) the end\_date (no CVSS)
- [CVE-2009-0821](https://cve.now/CVE-2009-0821.md): Mozilla Firefox 2.0.0.20 and earlier allows remote attackers to cause a denial of service (application crash) via nested calls to the window (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.