# CVEs published 2009-04-02

21 CVEs were published on April 2, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1231](https://cve.now/CVE-2009-1231.md): Unspecified vulnerability in the eClient in IBM DB2 Content Manager 8.4.1 before 8.4.1.1 has unknown impact and attack vectors. (no CVSS)
- [CVE-2009-1232](https://cve.now/CVE-2009-1232.md): Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service (memory corruption) via an XML documen (no CVSS)
- [CVE-2009-1233](https://cve.now/CVE-2009-1233.md): Apple Safari 3.2.2 and 4 Beta on Windows allows remote attackers to cause a denial of service (application crash) via an XML document contai (no CVSS)
- [CVE-2009-1234](https://cve.now/CVE-2009-1234.md): Opera 9.64 allows remote attackers to cause a denial of service (application crash) via an XML document containing a long series of start-ta (no CVSS)
- [CVE-2009-1235](https://cve.now/CVE-2009-1235.md): XNU 1228.9.59 and earlier on Apple Mac OS X 10.5.6 and earlier does not properly restrict interaction between user space and the HFS IOCTL h (no CVSS)
- [CVE-2009-1236](https://cve.now/CVE-2009-1236.md): Heap-based buffer overflow in the AppleTalk networking stack in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allows remote (no CVSS)
- [CVE-2009-1237](https://cve.now/CVE-2009-1237.md): Multiple memory leaks in XNU 1228.3.13 and earlier on Apple Mac OS X 10.5.6 and earlier allow local users to cause a denial of service (kern (no CVSS)
- [CVE-2009-1238](https://cve.now/CVE-2009-1238.md): Race condition in the HFS vfs sysctl interface in XNU 1228.8.20 and earlier on Apple Mac OS X 10.5.6 and earlier allows local users to cause (no CVSS)
- [CVE-2003-1571](https://cve.now/CVE-2003-1571.md): Web Wiz Guestbook 6.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to dow (no CVSS)
- [CVE-2008-6580](https://cve.now/CVE-2008-6580.md): The Red\_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows re (no CVSS)
- [CVE-2008-6581](https://cve.now/CVE-2008-6581.md): login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie pa (no CVSS)
- [CVE-2008-6582](https://cve.now/CVE-2008-6582.md): SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter (no CVSS)
- [CVE-2009-1222](https://cve.now/CVE-2009-1222.md): Directory traversal vulnerability in index.php in webEdition 6.0.0.4 and earlier, when register\_globals is enabled and magic\_quotes\_gpc is d (no CVSS)
- [CVE-2009-1223](https://cve.now/CVE-2009-1223.md): aspWebCalendar Free Edition stores sensitive information under the web root with insufficient access control, which allows remote attackers (no CVSS)
- [CVE-2009-1224](https://cve.now/CVE-2009-1224.md): SQL injection vulnerability in vsp-core/pub/themes/bismarck/gamestat.php in vsp stats processor 0.45 allows remote attackers to execute arbi (no CVSS)
- [CVE-2009-1225](https://cve.now/CVE-2009-1225.md): Cross-site scripting (XSS) vulnerability in index.php in Turnkey Ebook Store 1.1 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2009-1226](https://cve.now/CVE-2009-1226.md): core/admin/delete.php in Podcast Generator 1.1 and earlier does not properly restrict access to administrative functions, which allows remot (no CVSS)
- [CVE-2009-1227](https://cve.now/CVE-2009-1227.md): NOTE: this issue has been disputed by the vendor. (no CVSS)
- [CVE-2009-1228](https://cve.now/CVE-2009-1228.md): Cross-site scripting (XSS) vulnerability in register.php in Arcadwy Arcade Script CMS allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-1229](https://cve.now/CVE-2009-1229.md): SQL injection vulnerability in Arcadwy Arcade Script allows remote attackers to execute arbitrary SQL commands via the user cookie parameter (no CVSS)
- [CVE-2009-1230](https://cve.now/CVE-2009-1230.md): Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.