# CVEs published 2009-03-30

28 CVEs were published on March 30, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1171](https://cve.now/CVE-2009-1171.md): The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read (no CVSS)
- [CVE-2008-6554](https://cve.now/CVE-2008-6554.md): cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metachara (no CVSS)
- [CVE-2008-6555](https://cve.now/CVE-2008-6555.md): cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig co (no CVSS)
- [CVE-2008-6556](https://cve.now/CVE-2008-6556.md): cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the wh (no CVSS)
- [CVE-2008-6557](https://cve.now/CVE-2008-6557.md): cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the de (no CVSS)
- [CVE-2008-6558](https://cve.now/CVE-2008-6558.md): Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root priv (no CVSS)
- [CVE-2008-6559](https://cve.now/CVE-2008-6559.md): Merge mcd in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges via a crafted -d argument that contains .. (no CVSS)
- [CVE-2008-6551](https://cve.now/CVE-2008-6551.md): Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magic\_quotes\_gpc is disabled, allow remote attackers to (no CVSS)
- [CVE-2008-6552](https://cve.now/CVE-2008-6552.md): Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspec (no CVSS)
- [CVE-2008-6553](https://cve.now/CVE-2008-6553.md): microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, whic (no CVSS)
- [CVE-2009-0115](https://cve.now/CVE-2009-0115.md): The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterpris (no CVSS)
- [CVE-2009-1170](https://cve.now/CVE-2009-1170.md): Unspecified vulnerability in Sun OpenSolaris snv\_100 through snv\_101 allows local users, with privileges in a non-global zone, to execute ar (no CVSS)
- [CVE-2007-6721](https://cve.now/CVE-2007-6721.md): The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impac (no CVSS, bouncycastle:bcprov-jdk14 · bouncycastle:bcprov-jdk15 +1)
- [CVE-2008-6536](https://cve.now/CVE-2008-6536.md): Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suit (no CVSS)
- [CVE-2008-6537](https://cve.now/CVE-2008-6537.md): LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via (no CVSS)
- [CVE-2008-6538](https://cve.now/CVE-2008-6538.md): DeStar 0.2.2-5 allows remote attackers to add arbitrary users via a direct request to config/add/CfgOptUser. (no CVSS)
- [CVE-2008-6539](https://cve.now/CVE-2008-6539.md): Static code injection vulnerability in user/settings/ in DeStar 0.2.2-5 allows remote authenticated users to add arbitrary administrators an (no CVSS)
- [CVE-2008-6540](https://cve.now/CVE-2008-6540.md): DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) Decrypti (no CVSS, DotNetNuke.Core)
- [CVE-2008-6541](https://cve.now/CVE-2008-6541.md): Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrar (no CVSS)
- [CVE-2008-6542](https://cve.now/CVE-2008-6542.md): Unspecified vulnerability in the Skin Manager in DotNetNuke before 4.8.2 allows remote authenticated administrators to perform "server-side (no CVSS)
- [CVE-2008-6543](https://cve.now/CVE-2008-6543.md): Multiple PHP remote file inclusion vulnerabilities in ComScripts TEAM Quick Classifieds 1.0 via the DOCUMENT\_ROOT parameter to (1) index.php (no CVSS)
- [CVE-2008-6544](https://cve.now/CVE-2008-6544.md): Multiple PHP remote file inclusion vulnerabilities in Simple Machines Forum (SMF) 1.1.4 allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2008-6545](https://cve.now/CVE-2008-6545.md): PHP remote file inclusion vulnerability in news/include/createdb.php in Web Server Creator Web Portal 0.1 allows remote attackers to execute (no CVSS)
- [CVE-2008-6546](https://cve.now/CVE-2008-6546.md): Unspecified vulnerability in phpns before 2.1.3 has unknown impact and attack vectors related to "activation permissions." (no CVSS)
- [CVE-2008-6547](https://cve.now/CVE-2008-6547.md): schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained\_validators feature, which allows attackers to bypass i (no CVSS, formencode)
- [CVE-2008-6548](https://cve.now/CVE-2008-6548.md): The rst parser (parser/text\_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorize (no CVSS, moin)
- [CVE-2008-6549](https://cve.now/CVE-2008-6549.md): The password\_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are no (no CVSS, moin)
- [CVE-2008-6550](https://cve.now/CVE-2008-6550.md): Cross-site scripting (XSS) vulnerability in glossaire.php in Glossaire 2.0 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.