# CVEs published 2009-04-10 32 CVEs were published on April 10, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2008-6683](https://cve.now/CVE-2008-6683.md): Cross-site scripting (XSS) vulnerability in listtest.php in Apartment Search Script allows remote attackers to inject arbitrary web script o (no CVSS) - [CVE-2008-6684](https://cve.now/CVE-2008-6684.md): Unrestricted file upload vulnerability in editimage.php in Apartment Search Script allows remote attackers to execute arbitrary code by uplo (no CVSS) - [CVE-2008-6685](https://cve.now/CVE-2008-6685.md): Unspecified vulnerability in Frontend Filemanager (air\_filemanager) 0.6.1 and earlier extension for TYPO3 allows remote attackers to execute (no CVSS) - [CVE-2008-6686](https://cve.now/CVE-2008-6686.md): SQL injection vulnerability in CoolURI (cooluri) 1.0.11 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL com (no CVSS) - [CVE-2008-6687](https://cve.now/CVE-2008-6687.md): Cross-site scripting (XSS) vulnerability in DCD GoogleMap (dcdgooglemap) 1.1.0 and earlier extension for TYPO3 allows remote attackers to in (no CVSS) - [CVE-2008-6688](https://cve.now/CVE-2008-6688.md): Cross-site scripting (XSS) vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to inj (no CVSS) - [CVE-2008-6689](https://cve.now/CVE-2008-6689.md): SQL injection vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrar (no CVSS) - [CVE-2008-6690](https://cve.now/CVE-2008-6690.md): Unspecified vulnerability in nepa-design.de Spam Protection (nd\_antispam) extension 1.0.3 for TYPO3 allows remote attackers to modify config (no CVSS) - [CVE-2008-6691](https://cve.now/CVE-2008-6691.md): SQL injection vulnerability in Diocese of Portsmouth Calendar Today (pd\_calendar\_today) extension 0.0.3 for TYPO3 allows remote attackers to (no CVSS) - [CVE-2008-6692](https://cve.now/CVE-2008-6692.md): SQL injection vulnerability in Diocese of Portsmouth Training Courses (pd\_trainingcourses) extension 0.1.1 for TYPO3 allows remote attackers (no CVSS) - [CVE-2008-6693](https://cve.now/CVE-2008-6693.md): SQL injection vulnerability in Download system (sb\_downloader) extension 0.1.4 and earlier for TYPO3 allows remote attackers to execute arbi (no CVSS) - [CVE-2008-6694](https://cve.now/CVE-2008-6694.md): SQL injection vulnerability in Random Prayer (ste\_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unkn (no CVSS) - [CVE-2008-6695](https://cve.now/CVE-2008-6695.md): SQL injection vulnerability in TIMTAB social bookmark icons (timtab\_sociable) 2.0.4 and earlier extension for TYPO3 allows remote attackers (no CVSS) - [CVE-2008-6696](https://cve.now/CVE-2008-6696.md): SQL injection vulnerability in Fussballtippspiel (toto) 0.1.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary S (no CVSS) - [CVE-2008-6697](https://cve.now/CVE-2008-6697.md): SQL injection vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to execute ar (no CVSS) - [CVE-2008-6698](https://cve.now/CVE-2008-6698.md): Cross-site scripting (XSS) vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers (no CVSS) - [CVE-2008-6699](https://cve.now/CVE-2008-6699.md): Cross-site scripting (XSS) vulnerability in Resource Library (tjs\_reslib) 0.1.0 and earlier extension for TYPO3 allows remote attackers to i (no CVSS) - [CVE-2008-6700](https://cve.now/CVE-2008-6700.md): Multiple cross-site scripting (XSS) vulnerabilities in Butterfly Organizer 2.0.0 allow remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2008-6701](https://cve.now/CVE-2008-6701.md): NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en\_US/domains/add\_doma (no CVSS) - [CVE-2008-6702](https://cve.now/CVE-2008-6702.md): S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a denial of service (crash) via a long nickname, whi (no CVSS) - [CVE-2008-6703](https://cve.now/CVE-2008-6703.md): Stack-based buffer overflow in the IPureServer::\_Recieve function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote at (no CVSS) - [CVE-2008-6704](https://cve.now/CVE-2008-6704.md): Integer overflow in the NET\_Compressor::Decompress function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attacker (no CVSS) - [CVE-2008-6705](https://cve.now/CVE-2008-6705.md): The MultipacketReciever::RecievePacket function in S.T.A.L.K.E.R.: Shadow of Chernobyl 1.0006 and earlier allows remote attackers to cause a (no CVSS) - [CVE-2008-6706](https://cve.now/CVE-2008-6706.md): Multiple unspecified vulnerabilities in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya (no CVSS) - [CVE-2008-6707](https://cve.now/CVE-2008-6707.md): The Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communication Manager 3.1.x, does not pe (no CVSS) - [CVE-2008-6708](https://cve.now/CVE-2008-6708.md): Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communicati (no CVSS) - [CVE-2008-6709](https://cve.now/CVE-2008-6709.md): Unspecified vulnerability in the Web management interface in Avaya SIP Enablement Services (SES) 3.x and 4.0, as used with Avaya Communicati (no CVSS) - [CVE-2008-6710](https://cve.now/CVE-2008-6710.md): Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0. (no CVSS) - [CVE-2008-6711](https://cve.now/CVE-2008-6711.md): Unspecified vulnerability in the Web administration interface in Avaya Communication Manager 3.1.x before CM 3.1.4 SP2 and 4.0.x before 4.0. (no CVSS) - [CVE-2008-6712](https://cve.now/CVE-2008-6712.md): The HTTP/XML-RPC service in Crysis 1.21 (game version 1.1.1.6156) and earlier allows remote attackers to cause a denial of service (crash) v (no CVSS) - [CVE-2008-6713](https://cve.now/CVE-2008-6713.md): World in Conflict (WIC) 1.008 and earlier allows remote attackers to cause a denial of service (access violation and crash) via a zero-byte (no CVSS) - [CVE-2008-6714](https://cve.now/CVE-2008-6714.md): admin.php in xeCMS 1.0.0 RC2 and earlier allows remote attackers to bypass authentication and access the admin panel by setting the xecms\_us (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-04-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.