# CVEs published 2009-03-19

15 CVEs were published on March 19, 2009: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-6489](https://cve.now/CVE-2008-6489.md): SQL injection vulnerability in MyAlbum component (com\_myalbum) 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6490](https://cve.now/CVE-2008-6490.md): function/update\_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in (no CVSS)
- [CVE-2008-6491](https://cve.now/CVE-2008-6491.md): PHP remote file inclusion vulnerability in connexion.php in PHPGKit 0.9 allows remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2009-0661](https://cve.now/CVE-2009-0661.md): Wee Enhanced Environment for Chat (WeeChat) 0.2.6 allows remote attackers to cause a denial of service (crash) via an IRC PRIVMSG command co (no CVSS)
- [CVE-2009-0927](https://cve.now/CVE-2009-0927.md): Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9 before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote attackers to e (CVSS 8.8, KEV)
- [CVE-2009-0963](https://cve.now/CVE-2009-0963.md): Multiple SQL injection vulnerabilities in PHPRunner 4.2, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2009-0964](https://cve.now/CVE-2009-0964.md): UserView\_list.php in PHPRunner 4.2, and possibly earlier, stores passwords in cleartext in the database, which allows attackers to gain priv (no CVSS)
- [CVE-2009-0965](https://cve.now/CVE-2009-0965.md): SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2009-0966](https://cve.now/CVE-2009-0966.md): PHP remote file inclusion vulnerability in cross.php in YABSoft Mega File Hosting 1.2 allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2009-0967](https://cve.now/CVE-2009-0967.md): The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of service (service hang) via a large n (no CVSS)
- [CVE-2009-0968](https://cve.now/CVE-2009-0968.md): SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-0969](https://cve.now/CVE-2009-0969.md): Cross-site request forgery (CSRF) vulnerability in account/settings/account/index.php in phpFoX 1.6.21 allows remote attackers to hijack the (no CVSS)
- [CVE-2009-0970](https://cve.now/CVE-2009-0970.md): PHP remote file inclusion vulnerability in includes/class\_image.php in PHP Pro Bid 6.05, when register\_globals is enabled, allows remote att (no CVSS)
- [CVE-2009-0971](https://cve.now/CVE-2009-0971.md): Cross-site scripting (XSS) vulnerability in futomi's CGI Cafe Access Analyzer CGI Standard Version 3.8.1 and earlier allows remote attackers (no CVSS)
- [CVE-2009-0962](https://cve.now/CVE-2009-0962.md): Unspecified vulnerability in Futomi's CGI Cafe MP Form Mail CGI eCommerce 1.3.0 and earlier, and CGI Professional 3.2.2 and earlier, allows (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.