# CVEs published 2009-03-26

13 CVEs were published on March 26, 2009: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-6529](https://cve.now/CVE-2008-6529.md): Cross-site scripting (XSS) vulnerability in listtest.php in eZoneScripts Living Local 1.1 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2008-6530](https://cve.now/CVE-2008-6530.md): Unrestricted file upload vulnerability in editimage.php in eZoneScripts Living Local 1.1 allows remote authenticated administrators to execu (no CVSS)
- [CVE-2008-6531](https://cve.now/CVE-2008-6531.md): The WebWork 1 web application framework in Atlassian JIRA before 3.13.2 allows remote attackers to invoke exposed public JIRA methods via a (no CVSS)
- [CVE-2008-6532](https://cve.now/CVE-2008-6532.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote a (no CVSS)
- [CVE-2008-6533](https://cve.now/CVE-2008-6533.md): Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content fr (no CVSS)
- [CVE-2008-6534](https://cve.now/CVE-2008-6534.md): Incomplete blacklist vulnerability in NULL FTP Server Free and Pro 1.1.0.7 allows remote authenticated users to execute arbitrary commands v (no CVSS)
- [CVE-2008-6535](https://cve.now/CVE-2008-6535.md): admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password v (no CVSS)
- [CVE-2008-6528](https://cve.now/CVE-2008-6528.md): NTFS TmaxSoft JEUS 5 before Fix 26 allows remote attackers to read the source code for scripts by appending ::$DATA to the URL, which access (no CVSS)
- [CVE-2009-1148](https://cve.now/CVE-2009-1148.md): Directory traversal vulnerability in bs\_disp\_as\_mime\_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attac (no CVSS)
- [CVE-2009-1149](https://cve.now/CVE-2009-1149.md): CRLF injection vulnerability in bs\_disp\_as\_mime\_type.php in the BLOB streaming feature in phpMyAdmin before 3.1.3.1 allows remote attackers (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2009-1150](https://cve.now/CVE-2009-1150.md): Multiple cross-site scripting (XSS) vulnerabilities in the export page (display\_export.lib.php) in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x (no CVSS)
- [CVE-2009-1151](https://cve.now/CVE-2009-1151.md): Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inje (CVSS 9.8, KEV)
- [CVE-2009-1152](https://cve.now/CVE-2009-1152.md): Siemens Gigaset SE461 WiMAX router 1.5-BL024.9.6401, and possibly other versions, allows remote attackers to cause a denial of service (devi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.