# CVEs published 2009-04-01

28 CVEs were published on April 1, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6573](https://cve.now/CVE-2008-6573.md): Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) all (no CVSS)
- [CVE-2008-6574](https://cve.now/CVE-2008-6574.md): Unspecified vulnerability in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain priv (no CVSS)
- [CVE-2008-6575](https://cve.now/CVE-2008-6575.md): Unspecified vulnerability in the SIP server in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote auth (no CVSS)
- [CVE-2008-6576](https://cve.now/CVE-2008-6576.md): Unspecified vulnerability in the "session limitation technique" in the FTP service on Nortel Communications Server 1000 (CS1K) 4.50.x, when (no CVSS)
- [CVE-2008-6577](https://cve.now/CVE-2008-6577.md): Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x contain multiple unspecified hard-coded ac (no CVSS)
- [CVE-2008-6578](https://cve.now/CVE-2008-6578.md): Multiple unspecified vulnerabilities in Nortel Communication Server 1000 4.50.x allow remote attackers to execute arbitrary commands to gain (no CVSS)
- [CVE-2008-6579](https://cve.now/CVE-2008-6579.md): Nortel Communication Server 1000 4.50.x allows remote attackers to obtain Web application structure via unknown vectors related to "web reso (no CVSS)
- [CVE-2007-4475](https://cve.now/CVE-2007-4475.md): Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote at (no CVSS)
- [CVE-2009-1218](https://cve.now/CVE-2009-1218.md): Multiple cross-site scripting (XSS) vulnerabilities in Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Ca (no CVSS)
- [CVE-2009-1219](https://cve.now/CVE-2009-1219.md): Sun Calendar Express Web Server in Sun ONE Calendar Server 6.0 and Sun Java System Calendar Server 6 2004Q2 through 6.3-7.01 allows remote a (no CVSS)
- [CVE-2009-1220](https://cve.now/CVE-2009-1220.md): Cross-site scripting (XSS) vulnerability in +webvpn+/index.html in WebVPN on the Cisco Adaptive Security Appliances (ASA) 5520 with software (no CVSS)
- [CVE-2008-3871](https://cve.now/CVE-2008-3871.md): Multiple format string vulnerabilities in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers (no CVSS)
- [CVE-2008-4825](https://cve.now/CVE-2008-4825.md): Multiple buffer overflows in UltraISO 9.3.1.2633, and possibly other versions before 9.3.3.2685, allow user-assisted attackers to execute ar (no CVSS)
- [CVE-2009-1216](https://cve.now/CVE-2009-1216.md): Multiple unspecified vulnerabilities in (1) unlzh.c and (2) unpack.c in the gzip libraries in Microsoft Windows Server 2008, Windows Service (no CVSS)
- [CVE-2009-1217](https://cve.now/CVE-2009-1217.md): Off-by-one error in the GpFont::SetData function in gdiplus.dll in Microsoft GDI+ on Windows XP allows remote attackers to cause a denial of (no CVSS)
- [CVE-2009-0686](https://cve.now/CVE-2009-0686.md): The TrendMicro Activity Monitor Module (tmactmon.sys) 2.52.0.1002 in Trend Micro Internet Pro 2008 and 2009, and Security Pro 2008 and 2009, (no CVSS)
- [CVE-2009-0790](https://cve.now/CVE-2009-0790.md): The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 befo (no CVSS)
- [CVE-2009-1206](https://cve.now/CVE-2009-1206.md): Unspecified vulnerability in futomi's CGI Cafe Access Analyzer CGI Professional Version 4.11.5 and earlier allows remote attackers to gain a (no CVSS)
- [CVE-2009-1207](https://cve.now/CVE-2009-1207.md): Race condition in the dircmp script in Sun Solaris 8 through 10, and OpenSolaris snv\_01 through snv\_111, allows local users to overwrite arb (no CVSS)
- [CVE-2009-1208](https://cve.now/CVE-2009-1208.md): SQL injection vulnerability in auth2db 0.2.5, and possibly other versions before 0.2.7, uses the addslashes function instead of the mysql\_re (no CVSS)
- [CVE-2009-1209](https://cve.now/CVE-2009-1209.md): Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows remote attackers to execute arbitrary code via a script tag with a long def (no CVSS)
- [CVE-2009-1210](https://cve.now/CVE-2009-1210.md): Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in Wireshark 1.0.6 and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2009-1211](https://cve.now/CVE-2009-1211.md): Blue Coat ProxySG, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows r (no CVSS)
- [CVE-2009-1212](https://cve.now/CVE-2009-1212.md): Multiple insecure method vulnerabilities in PRECIS~2.DLL in the PrecisionID Datamatrix ActiveX control (DMATRIXLib.Datamatrix) allow remote (no CVSS)
- [CVE-2009-1213](https://cve.now/CVE-2009-1213.md): Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allow (no CVSS)
- [CVE-2009-1214](https://cve.now/CVE-2009-1214.md): GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain se (no CVSS)
- [CVE-2009-1215](https://cve.now/CVE-2009-1215.md): Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchang (no CVSS)
- [CVE-2009-1204](https://cve.now/CVE-2009-1204.md): Cross-site scripting (XSS) vulnerability in TikiWiki (Tiki) CMS/Groupware 2.2 allows remote attackers to inject arbitrary web script or HTML (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.