# CVEs published 2009-04-06

38 CVEs were published on April 6, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6621](https://cve.now/CVE-2008-6621.md): Unspecified vulnerability in GraphicsMagick before 1.2.3 allows remote attackers to cause a denial of service (crash) via unspecified vector (no CVSS)
- [CVE-2008-6622](https://cve.now/CVE-2008-6622.md): SQL injection vulnerability in choosecard.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02, 1.01, and earlier allows remote attackers to (no CVSS)
- [CVE-2008-6623](https://cve.now/CVE-2008-6623.md): SQL injection vulnerability in getin.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02 and earlier allows remote attackers to execute arb (no CVSS)
- [CVE-2008-6624](https://cve.now/CVE-2008-6624.md): SQL injection vulnerability in getin.php in WEBBDOMAIN Petition 1.02, 2.0, and 3.0 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-6625](https://cve.now/CVE-2008-6625.md): SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2008-6626](https://cve.now/CVE-2008-6626.md): SQL injection vulnerability in getin.php in WEBBDOMAIN Quiz 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-6627](https://cve.now/CVE-2008-6627.md): SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-6629](https://cve.now/CVE-2008-6629.md): Cross-site scripting (XSS) vulnerability in detail.php in WEBBDOMAIN Multi Languages WebShop Online 1.02 allows remote attackers to inject a (no CVSS)
- [CVE-2008-6614](https://cve.now/CVE-2008-6614.md): Multiple SQL injection vulnerabilities in microcms-admin-login.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) allow remote attacke (no CVSS)
- [CVE-2008-6615](https://cve.now/CVE-2008-6615.md): SQL injection vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to execute arbitrary SQL commands via the key (no CVSS)
- [CVE-2008-6616](https://cve.now/CVE-2008-6616.md): Cross-site scripting (XSS) vulnerability in index.php in Zen Software Zen Cart 2008 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2008-6617](https://cve.now/CVE-2008-6617.md): Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by upl (no CVSS)
- [CVE-2008-6618](https://cve.now/CVE-2008-6618.md): Multiple SQL injection vulnerabilities in ClassSystem 2.3 allow remote attackers to execute arbitrary SQL commands via the teacher\_id parame (no CVSS)
- [CVE-2008-6619](https://cve.now/CVE-2008-6619.md): Unrestricted file upload vulnerability in class/ApplyDB.php in ClassSystem 2.3 allows remote attackers to execute arbitrary code by uploadin (no CVSS)
- [CVE-2008-6620](https://cve.now/CVE-2008-6620.md): Multiple cross-site scripting (XSS) vulnerabilities in javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php in Gr (no CVSS)
- [CVE-2008-6609](https://cve.now/CVE-2008-6609.md): Cross-site scripting (XSS) vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2008-6610](https://cve.now/CVE-2008-6610.md): Absolute path traversal vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2.0 allows remote attackers to list arbitrary directories and (no CVSS)
- [CVE-2008-6611](https://cve.now/CVE-2008-6611.md): SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2008-6612](https://cve.now/CVE-2008-6612.md): Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploa (no CVSS)
- [CVE-2008-6613](https://cve.now/CVE-2008-6613.md): uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a d (no CVSS)
- [CVE-2009-1245](https://cve.now/CVE-2009-1245.md): Multiple SQL injection vulnerabilities in the insert\_to\_pastebin function in php/cccp-admin/inc/functions.php in CCCP Community Clan Portal (no CVSS)
- [CVE-2009-1246](https://cve.now/CVE-2009-1246.md): Multiple directory traversal vulnerabilities in Blogplus 1.0 allow remote attackers to include and execute arbitrary local files via a .. (no CVSS)
- [CVE-2009-1247](https://cve.now/CVE-2009-1247.md): SQL injection vulnerability in login.php in Acute Control Panel 1.0.0 allows remote attackers to execute arbitrary SQL commands via the user (no CVSS)
- [CVE-2009-1248](https://cve.now/CVE-2009-1248.md): Multiple PHP remote file inclusion vulnerabilities in Acute Control Panel 1.0.0 allow remote attackers to execute arbitrary PHP code via a U (no CVSS)
- [CVE-2009-1249](https://cve.now/CVE-2009-1249.md): Cross-site scripting (XSS) vulnerability in Feed element mapper 5.x before 5.x-1.1, a module for Drupal, allows remote attackers to inject a (no CVSS)
- [CVE-2008-4916](https://cve.now/CVE-2008-4916.md): Unspecified vulnerability in a guest virtual device driver in VMware Workstation before 5.5.9 build 126128, and 6.5.1 and earlier 6.x versio (no CVSS)
- [CVE-2009-0518](https://cve.now/CVE-2009-0518.md): VI Client in VMware VirtualCenter before 2.5 Update 4, VMware ESXi 3.5 before Update 4, and VMware ESX 3.5 before Update 4 retains the Virtu (no CVSS)
- [CVE-2009-0908](https://cve.now/CVE-2009-0908.md): Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMw (no CVSS)
- [CVE-2009-0909](https://cve.now/CVE-2009-0909.md): Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 1 (no CVSS)
- [CVE-2009-0910](https://cve.now/CVE-2009-0910.md): Heap-based buffer overflow in the VNnc Codec in VMware Workstation 6.5.x before 6.5.2 build 156735, VMware Player 2.5.x before 2.5.2 build 1 (no CVSS)
- [CVE-2009-1146](https://cve.now/CVE-2009-1146.md): Unspecified vulnerability in an ioctl in hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5. (no CVSS)
- [CVE-2009-1147](https://cve.now/CVE-2009-1147.md): Unspecified vulnerability in vmci.sys in the Virtual Machine Communication Interface (VMCI) in VMware Workstation 6.5.1 and earlier, VMware (no CVSS)
- [CVE-2008-6605](https://cve.now/CVE-2008-6605.md): Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 1701HG, 1800HW, 2071HG (no CVSS)
- [CVE-2008-6606](https://cve.now/CVE-2008-6606.md): SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands via the id paramete (no CVSS)
- [CVE-2008-6607](https://cve.now/CVE-2008-6607.md): Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML v (no CVSS)
- [CVE-2008-6608](https://cve.now/CVE-2008-6608.md): Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary SQL commands via (1) (no CVSS)
- [CVE-2009-1242](https://cve.now/CVE-2009-1242.md): The vmx\_set\_msr function in arch/x86/kvm/vmx.c in the VMX implementation in the KVM subsystem in the Linux kernel before 2.6.29.1 on the i38 (no CVSS)
- [CVE-2009-1243](https://cve.now/CVE-2009-1243.md): net/ipv4/udp.c in the Linux kernel before 2.6.29.1 performs an unlocking step in certain incorrect circumstances, which allows local users t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.