# CVEs published 2009-04-07

43 CVEs were published on April 7, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6661](https://cve.now/CVE-2008-6661.md): Multiple integer overflows in the scanning engine in Bitdefender for Linux 7.60825 and earlier allow remote attackers to cause a denial of s (no CVSS)
- [CVE-2008-6662](https://cve.now/CVE-2008-6662.md): AVG Anti-Virus for Linux 7.5.51, and possibly earlier, allows remote attackers to cause a denial of service (segmentation fault) or possibly (no CVSS)
- [CVE-2009-0796](https://cve.now/CVE-2009-0796.md): Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod\_perl1 and mod\_perl2 for the Apache HTTP S (no CVSS)
- [CVE-2009-1256](https://cve.now/CVE-2009-1256.md): SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId parameter. (no CVSS)
- [CVE-2009-1257](https://cve.now/CVE-2009-1257.md): Heap-based buffer overflow in Magic ISO Maker 5.5 build 0274 allows remote attackers to cause a denial of service (crash) or execute arbitra (no CVSS)
- [CVE-2009-1258](https://cve.now/CVE-2009-1258.md): SQL injection vulnerability in the RD-Autos (com\_rdautos) component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2009-1259](https://cve.now/CVE-2009-1259.md): SQL injection vulnerability in inc/bb/topic.php in Insane Visions AdaptBB 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to (no CVSS)
- [CVE-2009-1260](https://cve.now/CVE-2009-1260.md): Multiple stack-based buffer overflows in UltraISO 9.3.3.2685 and earlier allow remote attackers to cause a denial of service (crash) or exec (no CVSS)
- [CVE-2009-1261](https://cve.now/CVE-2009-1261.md): Multiple cross-site scripting (XSS) vulnerabilities in Web Help Desk 9.1.22 (evaluation version) allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2009-1262](https://cve.now/CVE-2009-1262.md): Format string vulnerability in Fortinet FortiClient 3.0.614, and possibly earlier, allows local users to execute arbitrary code via format s (no CVSS)
- [CVE-2009-1263](https://cve.now/CVE-2009-1263.md): SQL injection vulnerability in sub\_commententry.php in the BookJoomlas (com\_bookjoomlas) component 0.1 for Joomla! allows remote attackers t (no CVSS)
- [CVE-2009-1264](https://cve.now/CVE-2009-1264.md): Frontend User Registration (sr\_feuser\_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows (no CVSS, sjbr/sr-feuser-register)
- [CVE-2008-6657](https://cve.now/CVE-2008-6657.md): Cross-site request forgery (CSRF) vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows re (no CVSS)
- [CVE-2008-6658](https://cve.now/CVE-2008-6658.md): Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authentic (no CVSS)
- [CVE-2008-6659](https://cve.now/CVE-2008-6659.md): Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authentic (no CVSS)
- [CVE-2008-6660](https://cve.now/CVE-2008-6660.md): Unrestricted file upload vulnerability in bigdump.php in Alexey Ozerov BigDump 0.29b allows remote attackers to execute arbitrary code by up (no CVSS)
- [CVE-2008-6630](https://cve.now/CVE-2008-6630.md): Directory traversal vulnerability in the wt\_gallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image fi (no CVSS)
- [CVE-2008-6631](https://cve.now/CVE-2008-6631.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2008-6632](https://cve.now/CVE-2008-6632.md): SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2008-6633](https://cve.now/CVE-2008-6633.md): SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idresa parameter to resa (no CVSS)
- [CVE-2008-6634](https://cve.now/CVE-2008-6634.md): SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idroom parameter to week (no CVSS)
- [CVE-2008-6635](https://cve.now/CVE-2008-6635.md): PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when register\_globals is en (no CVSS)
- [CVE-2008-6636](https://cve.now/CVE-2008-6636.md): PHP remote file inclusion vulnerability in skins/default.php in Geody Labs Dagger - The Cutting Edge r12feb2008, when register\_globals is en (no CVSS)
- [CVE-2008-6637](https://cve.now/CVE-2008-6637.md): Multiple cross-site scripting (XSS) vulnerabilities in forgotPW.php in Library Video Company SAFARI Montage 3.1.x allow remote attackers to (no CVSS)
- [CVE-2008-6638](https://cve.now/CVE-2008-6638.md): Insecure method vulnerability in the Versalsoft HTTP Image Uploader ActiveX control (UUploaderSvrD.dll 6.0.0.35) allows remote attackers to (no CVSS)
- [CVE-2008-6639](https://cve.now/CVE-2008-6639.md): Cross-site request forgery (CSRF) vulnerability in admin.php in AjaXplorer 2.3.3 and 2.3.4 allows remote attackers to hijack the authenticat (no CVSS)
- [CVE-2008-6640](https://cve.now/CVE-2008-6640.md): Multiple SQL injection vulnerabilities in BatmanPorTaL allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) (no CVSS)
- [CVE-2008-6641](https://cve.now/CVE-2008-6641.md): Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2008-6642](https://cve.now/CVE-2008-6642.md): SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL commands via the sid pa (no CVSS)
- [CVE-2008-6643](https://cve.now/CVE-2008-6643.md): LokiCMS 0.3.4 and possibly earlier versions does not properly restrict access to administrative functions, which allows remote attackers to (no CVSS)
- [CVE-2008-6644](https://cve.now/CVE-2008-6644.md): Cross-site scripting (XSS) vulnerability in Default.aspx in DotNetNuke 4.8.3 and earlier allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-6645](https://cve.now/CVE-2008-6645.md): Cross-site scripting (XSS) vulnerability in Opencosmo VisualSentinel 0.7 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-6646](https://cve.now/CVE-2008-6646.md): Cross-site scripting (XSS) vulnerability in index.php in CoronaMatrix phpAddressBook 2.0 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-6647](https://cve.now/CVE-2008-6647.md): SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL commands via the gid (no CVSS)
- [CVE-2008-6648](https://cve.now/CVE-2008-6648.md): SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2008-6649](https://cve.now/CVE-2008-6649.md): SQL injection vulnerability in manager/image\_details\_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versions through 3.5.2 all (no CVSS)
- [CVE-2008-6650](https://cve.now/CVE-2008-6650.md): del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post\_id parameter, a diffe (no CVSS)
- [CVE-2008-6651](https://cve.now/CVE-2008-6651.md): Static code injection vulnerability in edithistory.php in OxYProject OxYBox 0.85 allows remote attackers to inject arbitrary PHP code into o (no CVSS)
- [CVE-2008-6652](https://cve.now/CVE-2008-6652.md): SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the sitename parameter. (no CVSS)
- [CVE-2008-6653](https://cve.now/CVE-2008-6653.md): SQL injection vulnerability in webhosting.php in the Webhosting Component (com\_webhosting) module before 1.1 RC7 for Joomla! and Mambo allow (no CVSS)
- [CVE-2008-6654](https://cve.now/CVE-2008-6654.md): Cross-site scripting (XSS) vulnerability in search\_results.php in InfoBiz Server allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-6655](https://cve.now/CVE-2008-6655.md): Multiple cross-site scripting (XSS) vulnerabilities in GEDCOM\_TO\_MYSQL 2 allow remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2008-6656](https://cve.now/CVE-2008-6656.md): Multiple SQL injection vulnerabilities in Open Auto Classifieds 1.4.3b allow remote attackers to execute arbitrary SQL commands via (1) the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.