# CVEs published 2009-03-24

27 CVEs were published on March 24, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0364](https://cve.now/CVE-2009-0364.md): Format string vulnerability in the mini\_calendar component in Citadel.org WebCit 7.22, and other versions before 7.39, allows remote attacke (no CVSS)
- [CVE-2009-1041](https://cve.now/CVE-2009-1041.md): The ktimer feature (sys/kern/kern\_time.c) in FreeBSD 7.0, 7.1, and 7.2 allows local users to overwrite arbitrary kernel memory via an out-of (no CVSS)
- [CVE-2009-1063](https://cve.now/CVE-2009-1063.md): Buffer overflow in eXeScope 6.50 allows user-assisted remote attackers to execute arbitrary code via a crafted executable (.exe) file. (no CVSS)
- [CVE-2009-1064](https://cve.now/CVE-2009-1064.md): Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers t (no CVSS)
- [CVE-2009-1065](https://cve.now/CVE-2009-1065.md): SQL injection vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to execute arbitrary SQL commands via the x parameter. (no CVSS)
- [CVE-2009-1066](https://cve.now/CVE-2009-1066.md): SQL injection vulnerability in the referral function in admin/lib/lib\_logs.php in Pixie CMS 1.01a allows remote attackers to execute arbitra (no CVSS)
- [CVE-2009-1067](https://cve.now/CVE-2009-1067.md): Cross-site scripting (XSS) vulnerability in index.php in Pixie CMS 1.01a allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-1068](https://cve.now/CVE-2009-1068.md): Stack-based buffer overflow in BS.Player (bsplayer) 2.32 Build 975 Free and 2.34 Build 980 PRO and earlier allows remote attackers to cause (no CVSS)
- [CVE-2009-1069](https://cve.now/CVE-2009-1069.md): Multiple cross-site scripting (XSS) vulnerabilities in the node edit form feature in Drupal Content Construction Kit (CCK) 6.x before 6.x-2. (no CVSS)
- [CVE-2009-1070](https://cve.now/CVE-2009-1070.md): Cross-site scripting (XSS) vulnerability in system/index.php in ExpressionEngine 1.6.4 through 1.6.6, and possibly earlier versions, allows (no CVSS)
- [CVE-2009-1071](https://cve.now/CVE-2009-1071.md): Stack-based buffer overflow in Icarus 2.0 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code (no CVSS)
- [CVE-2008-6512](https://cve.now/CVE-2008-6512.md): Cross-domain vulnerability in the WorkerPool API in Google Gears before 0.5.4.2 allows remote attackers to bypass the Same Origin Policy and (no CVSS)
- [CVE-2008-6513](https://cve.now/CVE-2008-6513.md): Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to execute arbitrary c (no CVSS)
- [CVE-2008-6514](https://cve.now/CVE-2008-6514.md): The Expo plugin in Compiz Fusion 0.7.8 allows local users with physical access to drag the screen saver aside and access the locked desktop (no CVSS)
- [CVE-2008-6515](https://cve.now/CVE-2008-6515.md): Cross-site scripting (XSS) vulnerability in Fritz Berger yet another php photo album - next generation (yappa-ng) allows remote attackers to (no CVSS)
- [CVE-2009-1049](https://cve.now/CVE-2009-1049.md): SQL injection vulnerability in articleCall.php in Bloginator 1A allows remote attackers to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2009-1050](https://cve.now/CVE-2009-1050.md): Bloginator 1A allows remote attackers to bypass authentication and gain administrative access by setting the identifyYourself cookie. (no CVSS)
- [CVE-2009-1051](https://cve.now/CVE-2009-1051.md): FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers t (no CVSS)
- [CVE-2009-1052](https://cve.now/CVE-2009-1052.md): FireAnt 1.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to d (no CVSS)
- [CVE-2009-1053](https://cve.now/CVE-2009-1053.md): chaozzDB 1.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2009-1054](https://cve.now/CVE-2009-1054.md): Unspecified vulnerability in JustSystems Ichitaro 13, 2004 through 2008, Lite2, and Ichitaro viewer 5.1.5.0 and earlier allows remote attack (no CVSS)
- [CVE-2009-1055](https://cve.now/CVE-2009-1055.md): Unspecified vulnerability in the web service in Sitecore CMS 5.3.1 rev. (no CVSS)
- [CVE-2009-1056](https://cve.now/CVE-2009-1056.md): IBM Rational AppScan Enterprise before 5.5 FP1 allows remote attackers to read arbitrary exported reports by "forcefully browsing." (no CVSS)
- [CVE-2009-1057](https://cve.now/CVE-2009-1057.md): MicroSmarts Enterprise ZipItFast! 3.0 allows remote attackers to execute arbitrary code via a crafted .zip file that triggers memory corrupt (no CVSS)
- [CVE-2009-1058](https://cve.now/CVE-2009-1058.md): Stack-based buffer overflow in ZipGenius might allow remote attackers to execute arbitrary code via a crafted .zip file that triggers an SEH (no CVSS)
- [CVE-2009-1059](https://cve.now/CVE-2009-1059.md): Stack-based buffer overflow in Trident PowerZip 7.2 might allow remote attackers to execute arbitrary code via a crafted .zip file. (no CVSS)
- [CVE-2009-1060](https://cve.now/CVE-2009-1060.md): Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.