# CVEs published 2009-04-03 25 CVEs were published on April 3, 2009: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2008-6583](https://cve.now/CVE-2008-6583.md): Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code (no CVSS) - [CVE-2008-6584](https://cve.now/CVE-2008-6584.md): html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable (no CVSS) - [CVE-2008-6585](https://cve.now/CVE-2008-6585.md): Cross-site request forgery (CSRF) vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of (no CVSS) - [CVE-2008-6586](https://cve.now/CVE-2008-6586.md): Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attackers to (1) hijack th (no CVSS) - [CVE-2008-6587](https://cve.now/CVE-2008-6587.md): Cross-site request forgery (CSRF) vulnerability in index.tmpl in Vuze (formerly Azureus HTML WebUI), probably 0.7.6, allows remote attackers (no CVSS) - [CVE-2008-6588](https://cve.now/CVE-2008-6588.md): Aztech ADSL2/2+ 4-port router has a default "isp" account with a default "isp" password, which allows remote attackers to obtain access if t (no CVSS) - [CVE-2008-6589](https://cve.now/CVE-2008-6589.md): Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, (no CVSS) - [CVE-2008-6590](https://cve.now/CVE-2008-6590.md): Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow (no CVSS) - [CVE-2008-6591](https://cve.now/CVE-2008-6591.md): LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via (no CVSS) - [CVE-2008-6592](https://cve.now/CVE-2008-6592.md): thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy (no CVSS) - [CVE-2008-6593](https://cve.now/CVE-2008-6593.md): SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary (no CVSS) - [CVE-2008-6594](https://cve.now/CVE-2008-6594.md): SQL injection vulnerability in the cm\_rdfexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifie (no CVSS) - [CVE-2008-6595](https://cve.now/CVE-2008-6595.md): SQL injection vulnerability in the pmk\_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspe (no CVSS) - [CVE-2008-6596](https://cve.now/CVE-2008-6596.md): SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash par (no CVSS) - [CVE-2008-6597](https://cve.now/CVE-2008-6597.md): Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web scri (no CVSS) - [CVE-2008-6598](https://cve.now/CVE-2008-6598.md): Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic." (no CVSS) - [CVE-2008-6599](https://cve.now/CVE-2008-6599.md): cookiecheck.php in CookieCheck 1.0 stores tmp/cc\_sessions under the web root with insufficient access control, which allows remote attackers (no CVSS) - [CVE-2008-6600](https://cve.now/CVE-2008-6600.md): Cross-site scripting (XSS) vulnerability in the search feature in XMLPortal 3.0 allows remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2008-6601](https://cve.now/CVE-2008-6601.md): Unspecified vulnerability in Epona 1.5rc3 allows remote attackers to obtain the real IP address of users via unknown vectors. (no CVSS) - [CVE-2008-6602](https://cve.now/CVE-2008-6602.md): Unspecified vulnerability in Download Center Lite before 2.1 has unknown impact and attack vectors related to "A minor security fix." (no CVSS) - [CVE-2008-6603](https://cve.now/CVE-2008-6603.md): MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl\_hierarchic is set to True, which might allow remote attackers to bypass (no CVSS, moin) - [CVE-2009-0556](https://cve.now/CVE-2009-0556.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to ex (CVSS 8.8, KEV) - [CVE-2009-1239](https://cve.now/CVE-2009-1239.md): IBM DB2 9.1 before FP7 returns incorrect query results in certain situations related to the order of application of an INNER JOIN predicate (no CVSS) - [CVE-2009-1240](https://cve.now/CVE-2009-1240.md): Unspecified vulnerability in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network Ma (no CVSS) - [CVE-2009-1241](https://cve.now/CVE-2009-1241.md): Unspecified vulnerability in ClamAV before 0.95 allows remote attackers to bypass detection of malware via a modified RAR archive. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-04-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.