# CVEs published 2009-04-17

32 CVEs were published on April 17, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-5518](https://cve.now/CVE-2008-5518.md): Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Wi (no CVSS, org.apache.geronimo.plugins:console)
- [CVE-2009-0038](https://cve.now/CVE-2009-0038.md): Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1. (no CVSS, org.apache.geronimo.plugins:console)
- [CVE-2009-0039](https://cve.now/CVE-2009-0039.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 throu (no CVSS, org.apache.geronimo.plugins:console)
- [CVE-2009-1185](https://cve.now/CVE-2009-1185.md): udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sen (no CVSS)
- [CVE-2009-1186](https://cve.now/CVE-2009-1186.md): Buffer overflow in the util\_path\_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of ser (no CVSS)
- [CVE-2009-1331](https://cve.now/CVE-2009-1331.md): Integer overflow in Microsoft Windows Media Player (WMP) 11.0.5721.5260 allows remote attackers to cause a denial of service (application cr (no CVSS)
- [CVE-2009-1332](https://cve.now/CVE-2009-1332.md): The Online Help feature in Sun Java System Directory Server 5.2 and Enterprise Edition 5 allows remote attackers to determine the existence (no CVSS)
- [CVE-2009-1333](https://cve.now/CVE-2009-1333.md): Cross-site scripting (XSS) vulnerability in refresh\_rate.htm in the web interface on the HP Deskjet 6840 printer with firmware XF1M131A allo (no CVSS)
- [CVE-2009-1334](https://cve.now/CVE-2009-1334.md): Cross-site scripting (XSS) vulnerability in login/FilepathLogin.html in IBM Tivoli Continuous Data Protection (CDP) for Files 3.1.4.0 allows (no CVSS)
- [CVE-2009-1335](https://cve.now/CVE-2009-1335.md): Microsoft Internet Explorer 7 and 8 on Windows XP and Vista allows remote attackers to cause a denial of service (application hang) via a la (no CVSS)
- [CVE-2008-6724](https://cve.now/CVE-2008-6724.md): Cross-site scripting (XSS) vulnerability in index.pl in Perl Nopaste 1.0 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2008-6725](https://cve.now/CVE-2008-6725.md): Multiple SQL injection vulnerabilities in CMScout 2.06 allow remote authenticated users to execute arbitrary SQL commands via the id paramet (no CVSS)
- [CVE-2008-6726](https://cve.now/CVE-2008-6726.md): Multiple directory traversal vulnerabilities in CMScout 2.06, when register\_globals is enabled, allow remote attackers to include and execut (no CVSS)
- [CVE-2009-1315](https://cve.now/CVE-2009-1315.md): Multiple cross-site scripting (XSS) vulnerabilities in AbleSpace 1.0 allow remote attackers to inject arbitrary web script or HTML via the ( (no CVSS)
- [CVE-2009-1316](https://cve.now/CVE-2009-1316.md): Multiple SQL injection vulnerabilities in AbleSpace 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) eid parameter t (no CVSS)
- [CVE-2009-1317](https://cve.now/CVE-2009-1317.md): Multiple SQL injection vulnerabilities in Aqua CMS 1.1, when magic\_quotes\_gpc is disabled, allow remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2009-1318](https://cve.now/CVE-2009-1318.md): Directory traversal vulnerability in index.php in Jamroom 3.1.2, 3.2.3 through 3.2.6, 4.0.2, and possibly other versions before 3.4.0 allows (no CVSS)
- [CVE-2009-1319](https://cve.now/CVE-2009-1319.md): Directory traversal vulnerability in includes/ini.inc.php in GuestCal 2.1 allows remote attackers to include and execute arbitrary files via (no CVSS)
- [CVE-2009-1320](https://cve.now/CVE-2009-1320.md): Multiple cross-site scripting (XSS) vulnerabilities in include/zstore.php in Zazzle Store Builder 1.0.2 allow remote attackers to inject arb (no CVSS)
- [CVE-2009-1321](https://cve.now/CVE-2009-1321.md): Cross-site scripting (XSS) vulnerability in search.asp in ASP Product Catalog 1.0 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-1322](https://cve.now/CVE-2009-1322.md): ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to d (no CVSS)
- [CVE-2009-1323](https://cve.now/CVE-2009-1323.md): SQL injection vulnerability in body.asp in Web File Explorer 3.1 allows remote attackers to execute arbitrary SQL commands via the id parame (no CVSS)
- [CVE-2009-1324](https://cve.now/CVE-2009-1324.md): Stack-based buffer overflow in Mini-stream ASX to MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in (no CVSS)
- [CVE-2009-1325](https://cve.now/CVE-2009-1325.md): Stack-based buffer overflow in Mini-stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long URI in a playlist (.m (no CVSS)
- [CVE-2009-1326](https://cve.now/CVE-2009-1326.md): Stack-based buffer overflow in Mini-stream RM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playl (no CVSS)
- [CVE-2009-1327](https://cve.now/CVE-2009-1327.md): Stack-based buffer overflow in Mini-stream WM Downloader 3.0.0.9 allows remote attackers to execute arbitrary code via a long URI in a playl (no CVSS)
- [CVE-2009-1328](https://cve.now/CVE-2009-1328.md): Stack-based buffer overflow in Mini-stream RM-MP3 Converter 3.0.0.7 allows remote attackers to execute arbitrary code via a long URI in a pl (no CVSS)
- [CVE-2009-1329](https://cve.now/CVE-2009-1329.md): Stack-based buffer overflow in Mini-stream Shadow Stream Recorder 3.0.1.7 allows remote attackers to execute arbitrary code via a long URI i (no CVSS)
- [CVE-2009-1330](https://cve.now/CVE-2009-1330.md): Stack-based buffer overflow in Easy RM to MP3 Converter allows remote attackers to execute arbitrary code via a long filename in a playlist (no CVSS)
- [CVE-2008-1107](https://cve.now/CVE-2008-1107.md): Multiple stack-based buffer overflows in the Danske Bank e-Sec Control Module ActiveX control (DanskeSikker.ocx) 3.1.0.48, and possibly earl (no CVSS)
- [CVE-2009-0946](https://cve.now/CVE-2009-0946.md): Multiple integer overflows in FreeType 2.3.9 and earlier allow remote attackers to execute arbitrary code via vectors related to large value (no CVSS)
- [CVE-2009-1314](https://cve.now/CVE-2009-1314.md): body.asp in Web File Explorer 3.1 allows remote attackers to create arbitrary files and execute arbitrary code via the savefile action with (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.