# CVEs published 2009-04-09 31 CVEs were published on April 9, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-1277](https://cve.now/CVE-2009-1277.md): SQL injection vulnerability in index.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2009-1278](https://cve.now/CVE-2009-1278.md): Static code injection vulnerability in forms/ajax/configure.php in Gravity Board X (GBX) 2.0 BETA allows remote attackers to inject arbitrar (no CVSS) - [CVE-2009-1279](https://cve.now/CVE-2009-1279.md): Multiple cross-site scripting (XSS) vulnerabilities in Joomla! 1.5 through 1.5.9 allow remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2009-1280](https://cve.now/CVE-2009-1280.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the com\_media component for Joomla! 1.5.x through 1.5.9 allow remote attackers (no CVSS) - [CVE-2009-1281](https://cve.now/CVE-2009-1281.md): Cross-site scripting (XSS) vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspeci (no CVSS) - [CVE-2009-1282](https://cve.now/CVE-2009-1282.md): SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2009-1283](https://cve.now/CVE-2009-1283.md): glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gai (no CVSS) - [CVE-2009-1284](https://cve.now/CVE-2009-1284.md): Buffer overflow in BibTeX 0.99 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a long .bib (no CVSS) - [CVE-2007-6726](https://cve.now/CVE-2007-6726.md): Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attac (no CVSS, org.apache.struts:struts2-dojo-plugin) - [CVE-2008-2025](https://cve.now/CVE-2008-2025.md): Cross-site scripting (XSS) vulnerability in Apache Struts before 1.2.9-162.31.1 on SUSE Linux Enterprise (SLE) 11, before 1.2.9-108.2 on SUS (no CVSS, struts:struts) - [CVE-2008-5519](https://cve.now/CVE-2008-5519.md): The JK Connector (aka mod\_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary (no CVSS) - [CVE-2008-6681](https://cve.now/CVE-2008-6681.md): Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML v (no CVSS, dojo) - [CVE-2008-6682](https://cve.now/CVE-2008-6682.md): Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.x before 2.0.11.1 and 2.1.x before 2.1.1 allow remote attackers to (no CVSS, org.apache.struts:struts2-core) - [CVE-2009-0197](https://cve.now/CVE-2009-0197.md): Integer overflow in the FORMATS Plugin before 4.23 for IrfanView allows remote attackers to execute arbitrary code or cause a denial of serv (no CVSS) - [CVE-2009-0793](https://cve.now/CVE-2009-0793.md): cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of serv (no CVSS) - [CVE-2009-1144](https://cve.now/CVE-2009-1144.md): Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xp (no CVSS) - [CVE-2009-1155](https://cve.now/CVE-2009-1155.md): Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.1(1) through 7.1(2)82, 7.2 before 7.2(4)27, 8.0 before 8. (no CVSS) - [CVE-2009-1156](https://cve.now/CVE-2009-1156.md): Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 8.0 before 8.0(4)25 and 8.1 before 8.1(2)15, when (no CVSS) - [CVE-2009-1157](https://cve.now/CVE-2009-1157.md): Memory leak on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)6, 7.1 before 7.1(2)82, 7.2 (no CVSS) - [CVE-2009-1158](https://cve.now/CVE-2009-1158.md): Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series devices 7.0 before 7.0(8)6, 7.1 before 7.1(2)82, 7.2 befor (no CVSS) - [CVE-2009-1159](https://cve.now/CVE-2009-1159.md): Unspecified vulnerability on Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.2 before 7.2(4)26, 8.0 befor (no CVSS) - [CVE-2009-1160](https://cve.now/CVE-2009-1160.md): Cisco Adaptive Security Appliances (ASA) 5500 Series and PIX Security Appliances 7.0 before 7.0(8)1, 7.1 before 7.1(2)74, 7.2 before 7.2(4)9 (no CVSS) - [CVE-2009-1275](https://cve.now/CVE-2009-1275.md): Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain (no CVSS, org.apache.tiles:tiles-core) - [CVE-2009-1276](https://cve.now/CVE-2009-1276.md): XScreenSaver in Sun Solaris 10 and OpenSolaris before snv\_109, and Solaris 8 and 9 with GNOME 2.0 or 2.0.2, allows physically proximate atta (no CVSS) - [CVE-2009-0844](https://cve.now/CVE-2009-0844.md): The get\_input\_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a (no CVSS) - [CVE-2009-0846](https://cve.now/CVE-2009-0846.md): The asn1\_decode\_generaltime function in lib/krb5/asn.1/asn1\_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) befor (no CVSS) - [CVE-2009-0847](https://cve.now/CVE-2009-0847.md): The asn1buf\_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a (no CVSS) - [CVE-2009-1250](https://cve.now/CVE-2009-1250.md): The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58, and IBM AFS 3.6 before Patch 19, on Linux allows remo (no CVSS) - [CVE-2009-1251](https://cve.now/CVE-2009-1251.md): Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows (no CVSS) - [CVE-2009-1253](https://cve.now/CVE-2009-1253.md): James Stone Tunapie 2.1 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file. (no CVSS) - [CVE-2009-1254](https://cve.now/CVE-2009-1254.md): James Stone Tunapie 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a stream URL. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-04-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.