# CVEs published 2009-03-25

58 CVEs were published on March 25, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0784](https://cve.now/CVE-2009-0784.md): Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTa (no CVSS)
- [CVE-2009-1093](https://cve.now/CVE-2009-1093.md): LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and e (no CVSS)
- [CVE-2009-1094](https://cve.now/CVE-2009-1094.md): Unspecified vulnerability in the LDAP implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and e (no CVSS)
- [CVE-2009-1095](https://cve.now/CVE-2009-1095.md): Integer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 (no CVSS)
- [CVE-2009-1096](https://cve.now/CVE-2009-1096.md): Buffer overflow in unpack200 in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 (no CVSS)
- [CVE-2009-1097](https://cve.now/CVE-2009-1097.md): Multiple buffer overflows in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allow remote attackers (no CVSS)
- [CVE-2009-1098](https://cve.now/CVE-2009-1098.md): Buffer overflow in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; 1.4. (no CVSS)
- [CVE-2009-1099](https://cve.now/CVE-2009-1099.md): Integer signedness error in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Update 12 and (no CVSS)
- [CVE-2009-1100](https://cve.now/CVE-2009-1100.md): Multiple unspecified vulnerabilities in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier, and 6 Up (no CVSS)
- [CVE-2009-1101](https://cve.now/CVE-2009-1101.md): Unspecified vulnerability in the lightweight HTTP server implementation in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) (no CVSS)
- [CVE-2009-1102](https://cve.now/CVE-2009-1102.md): Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier (no CVSS)
- [CVE-2009-1103](https://cve.now/CVE-2009-1103.md): Unspecified vulnerability in the Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; (no CVSS)
- [CVE-2009-1104](https://cve.now/CVE-2009-1104.md): The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; and (no CVSS)
- [CVE-2009-1105](https://cve.now/CVE-2009-1105.md): The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 allows user-assisted remote att (no CVSS)
- [CVE-2009-1106](https://cve.now/CVE-2009-1106.md): The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12, 11, and 10 does not properly parse crossdo (no CVSS)
- [CVE-2009-1107](https://cve.now/CVE-2009-1107.md): The Java Plug-in in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier, and 5.0 Update 17 and earlier, (no CVSS)
- [CVE-2008-6516](https://cve.now/CVE-2008-6516.md): Multiple directory traversal vulnerabilities in phpKF-Portal 1.10 allow remote attackers to include arbitrary files via a .. (no CVSS)
- [CVE-2008-6517](https://cve.now/CVE-2008-6517.md): SQL injection vulnerability in NewsHOWLER 1.03 Beta allows remote attackers to execute arbitrary SQL commands via the news\_user cookie param (no CVSS)
- [CVE-2008-6518](https://cve.now/CVE-2008-6518.md): Unrestricted file upload vulnerability in the profile feature in VidiScript allows registered remote authenticated users to execute arbitrar (no CVSS)
- [CVE-2008-6519](https://cve.now/CVE-2008-6519.md): Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial (no CVSS)
- [CVE-2008-6520](https://cve.now/CVE-2008-6520.md): Multiple format string vulnerabilities in the SSI filter in Xitami Web Server 2.5c2, and possibly other versions, allow remote attackers to (no CVSS)
- [CVE-2008-6521](https://cve.now/CVE-2008-6521.md): index.php in Terracotta (aka OpenTerracotta) 0.6.1 allows remote attackers to obtain sensitive information via an invalid File parameter, wh (no CVSS)
- [CVE-2008-6522](https://cve.now/CVE-2008-6522.md): Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1, (no CVSS)
- [CVE-2008-6523](https://cve.now/CVE-2008-6523.md): auth.php in openInvoice 0.90 beta and earlier allows remote attackers to bypass authentication and gain privileges by setting the oiauth coo (no CVSS)
- [CVE-2008-6524](https://cve.now/CVE-2008-6524.md): resetpass.php in openInvoice 0.90 beta and earlier allows remote authenticated users to change the passwords of arbitrary users via a modifi (no CVSS)
- [CVE-2008-6525](https://cve.now/CVE-2008-6525.md): SQL injection vulnerability in the Admin Panel in Nice PHP FAQ Script (Knowledge base Script) allows remote attackers to execute arbitrary S (no CVSS)
- [CVE-2008-6526](https://cve.now/CVE-2008-6526.md): SQL injection vulnerability in index.php in BosDev BosClassifieds allows remote attackers to execute arbitrary SQL commands via the cat\_id p (no CVSS)
- [CVE-2008-6527](https://cve.now/CVE-2008-6527.md): SQL injection vulnerability in forum.asp in GO4I.NET ASP Forum 1.0 allows remote attackers to execute arbitrary SQL commands via the iFor pa (no CVSS)
- [CVE-2009-1085](https://cve.now/CVE-2009-1085.md): Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to (no CVSS)
- [CVE-2009-1086](https://cve.now/CVE-2009-1086.md): Heap-based buffer overflow in the ldns\_rr\_new\_frm\_str\_internal function in ldns 1.4.x allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2009-1087](https://cve.now/CVE-2009-1087.md): Multiple argument injection vulnerabilities in PPLive.exe in PPLive 1.9.21 and earlier allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2009-1088](https://cve.now/CVE-2009-1088.md): Hannon Hill Cascade Server 5.7 and other versions allows remote authenticated users to execute arbitrary programs or Java code via a crafted (no CVSS)
- [CVE-2009-1089](https://cve.now/CVE-2009-1089.md): Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to read arbitrary files via a b (no CVSS)
- [CVE-2009-1090](https://cve.now/CVE-2009-1090.md): Directory traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to include and execute arbitrary lo (no CVSS)
- [CVE-2009-1091](https://cve.now/CVE-2009-1091.md): Cross-site scripting (XSS) vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2009-1092](https://cve.now/CVE-2009-1092.md): Use-after-free vulnerability in the LIVEAUDIO.LiveAudioCtrl.1 ActiveX control in LIVEAU~1.OCX 7.0 for GeoVision DVR systems allows remote at (no CVSS)
- [CVE-2009-0215](https://cve.now/CVE-2009-0215.md): Stack-based buffer overflow in the GetXMLValue method in the IBM Access Support ActiveX control in IbmEgath.dll, as distributed on IBM and L (no CVSS)
- [CVE-2009-1074](https://cve.now/CVE-2009-1074.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote atta (no CVSS)
- [CVE-2009-1075](https://cve.now/CVE-2009-1075.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whethe (no CVSS)
- [CVE-2009-1076](https://cve.now/CVE-2009-1076.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depen (no CVSS)
- [CVE-2009-1077](https://cve.now/CVE-2009-1077.md): The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the (no CVSS)
- [CVE-2009-1078](https://cve.now/CVE-2009-1078.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the expected privilege requirements for (1) deleting audit policies (no CVSS)
- [CVE-2009-1079](https://cve.now/CVE-2009-1079.md): Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inje (no CVSS)
- [CVE-2009-1080](https://cve.now/CVE-2009-1080.md): Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inje (no CVSS)
- [CVE-2009-1081](https://cve.now/CVE-2009-1081.md): Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inje (no CVSS)
- [CVE-2009-1082](https://cve.now/CVE-2009-1082.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands t (no CVSS)
- [CVE-2009-1083](https://cve.now/CVE-2009-1083.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of us (no CVSS)
- [CVE-2009-1084](https://cve.now/CVE-2009-1084.md): Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows re (no CVSS)
- [CVE-2009-0193](https://cve.now/CVE-2009-0193.md): Heap-based buffer overflow in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 allows remote attackers to execute arbit (no CVSS)
- [CVE-2009-0207](https://cve.now/CVE-2009-0207.md): Unspecified vulnerability in HP-UX B.11.11 running VERITAS Oracle Disk Manager (VRTSodm) 3.5, B.11.23 running VRTSodm 4.1 or VERITAS File Sy (no CVSS)
- [CVE-2009-0787](https://cve.now/CVE-2009-0787.md): The ecryptfs\_write\_metadata\_to\_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect (no CVSS)
- [CVE-2009-0891](https://cve.now/CVE-2009-0891.md): The Web Services Security component in IBM WebSphere Application Server 7.0 before Fix Pack 1 (7.0.0.1), 6.1 before Fix Pack 23 (6.1.0.23),a (no CVSS)
- [CVE-2009-0920](https://cve.now/CVE-2009-0920.md): Stack-based buffer overflow in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers t (no CVSS)
- [CVE-2009-0921](https://cve.now/CVE-2009-0921.md): Multiple heap-based buffer overflows in OvCgi/Toolbar.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote att (no CVSS)
- [CVE-2009-0928](https://cve.now/CVE-2009-0928.md): Heap-based buffer overflow in Adobe Acrobat Reader and Acrobat Professional 7.1.0, 8.1.3, 9.0.0, and other versions allows remote attackers (no CVSS)
- [CVE-2009-1061](https://cve.now/CVE-2009-1061.md): Unspecified vulnerability in Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to execute a (no CVSS)
- [CVE-2009-1062](https://cve.now/CVE-2009-1062.md): Adobe Acrobat Reader 9 before 9.1, 8 before 8.1.4, and 7 before 7.1.1 might allow remote attackers to trigger memory corruption and possibly (no CVSS)
- [CVE-2009-1072](https://cve.now/CVE-2009-1072.md): nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP\_MKNOD capability before handling a user request in a thread, which allows loc (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.