# CVEs published 2009-03-31

35 CVEs were published on March 31, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6572](https://cve.now/CVE-2008-6572.md): SQL injection vulnerability in search\_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2003-1570](https://cve.now/CVE-2003-1570.md): The server in IBM Tivoli Storage Manager (TSM) 5.1.x, 5.2.x before 5.2.1.2, and 6.x before 6.1 does not require credentials to observe the s (no CVSS)
- [CVE-2004-2762](https://cve.now/CVE-2004-2762.md): The server in IBM Tivoli Storage Manager (TSM) 4.2.x on MVS, 5.1.9.x before 5.1.9.1, 5.1.x before 5.1.10, 5.2.2.x before 5.2.2.3, 5.2.x befo (no CVSS)
- [CVE-2009-0839](https://cve.now/CVE-2009-0839.md): Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a lo (no CVSS)
- [CVE-2009-0840](https://cve.now/CVE-2009-0840.md): Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows (no CVSS)
- [CVE-2009-0841](https://cve.now/CVE-2009-0841.md): Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with (no CVSS)
- [CVE-2009-0842](https://cve.now/CVE-2009-0842.md): mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to read arbitrary invalid .map files via a full pathname (no CVSS)
- [CVE-2009-0843](https://cve.now/CVE-2009-0843.md): The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence o (no CVSS)
- [CVE-2009-1073](https://cve.now/CVE-2009-1073.md): nss-ldapd before 0.6.8 uses world-readable permissions for the /etc/nss-ldapd.conf file, which allows local users to obtain a cleartext pass (no CVSS)
- [CVE-2009-1176](https://cve.now/CVE-2009-1176.md): mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a (no CVSS)
- [CVE-2009-1177](https://cve.now/CVE-2009-1177.md): Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact an (no CVSS)
- [CVE-2009-1178](https://cve.now/CVE-2009-1178.md): Unspecified vulnerability in the server in IBM Tivoli Storage Manager (TSM) 5.3.x before 5.3.2 and 6.x before 6.1 has unknown impact and att (no CVSS)
- [CVE-2005-4879](https://cve.now/CVE-2005-4879.md): Multiple cross-site scripting (XSS) vulnerabilities in jax\_guestbook.php in Jax Guestbook 3.1 and 3.31 allow remote attackers to inject arbi (no CVSS)
- [CVE-2005-4880](https://cve.now/CVE-2005-4880.md): Jax Guestbook 3.1 and 3.31 stores sensitive information under the web root with insufficient access control, which allows remote attackers t (no CVSS)
- [CVE-2006-7237](https://cve.now/CVE-2006-7237.md): PHP remote file inclusion vulnerability in mod/nc\_phpmyadmin/core/libraries/Theme\_Manager.class.php in Ixprim 2.0 allows remote attackers to (no CVSS)
- [CVE-2007-6722](https://cve.now/CVE-2007-6722.md): Vidalia bundle before 0.1.2.18, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that (no CVSS)
- [CVE-2007-6723](https://cve.now/CVE-2007-6723.md): TorK before 0.22, when running on Windows and Mac OS X, installs Privoxy with a configuration file (config.txt or config) that contains inse (no CVSS)
- [CVE-2007-6724](https://cve.now/CVE-2007-6724.md): Vidalia bundle before 0.1.2.18, when running on Windows, installs Privoxy with a configuration file (config.txt or config) that contains an (no CVSS)
- [CVE-2008-6561](https://cve.now/CVE-2008-6561.md): Citrix Presentation Server Client for Windows before 10.200 does not clear "credential information" from process memory in unspecified circu (no CVSS)
- [CVE-2008-6562](https://cve.now/CVE-2008-6562.md): Cross-site scripting (XSS) vulnerability in jax\_linklists.php in Jack (tR) Jax LinkLists 1.00 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2008-6563](https://cve.now/CVE-2008-6563.md): Buffer overflow in the XML parser in Trillian 3.1.9.0, and possibly earlier, allows remote attackers to cause a denial of service (crash) an (no CVSS)
- [CVE-2008-6564](https://cve.now/CVE-2008-6564.md): Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote att (no CVSS)
- [CVE-2008-6565](https://cve.now/CVE-2008-6565.md): Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2008-6566](https://cve.now/CVE-2008-6566.md): Unspecified vulnerability in Octopussy before 0.9.5.8 has unknown impact and attack vectors related to a "major security" vulnerability. (no CVSS)
- [CVE-2008-6567](https://cve.now/CVE-2008-6567.md): Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-6568](https://cve.now/CVE-2008-6568.md): Unrestricted file upload vulnerability in Yehe 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable (no CVSS)
- [CVE-2008-6569](https://cve.now/CVE-2008-6569.md): Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the (no CVSS)
- [CVE-2008-6570](https://cve.now/CVE-2008-6570.md): Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2008-6571](https://cve.now/CVE-2008-6571.md): Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2008-6560](https://cve.now/CVE-2008-6560.md): Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a (no CVSS)
- [CVE-2009-0892](https://cve.now/CVE-2009-0892.md): The administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 before 7.0.0.3 allows attackers to hijack u (no CVSS)
- [CVE-2009-1172](https://cve.now/CVE-2009-1172.md): The JAX-RPC WS-Security runtime in the Web Services Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 and 7.0 (no CVSS)
- [CVE-2009-1173](https://cve.now/CVE-2009-1173.md): IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.3 uses weak permissions (777) for files associated with unspecified "interim fixes," (no CVSS)
- [CVE-2009-1174](https://cve.now/CVE-2009-1174.md): The Web Services Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.35 and 7.0 before 7.0.0.3 has an unspecifie (no CVSS)
- [CVE-2009-1175](https://cve.now/CVE-2009-1175.md): Cross-site scripting (XSS) vulnerability in apps/web/vs\_diag.cgi in the DAAP extension in Banshee 1.4.2 allows remote attackers to inject ar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.