# CVEs published 2009-04-22

25 CVEs were published on April 22, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6743](https://cve.now/CVE-2008-6743.md): RSMScript 1.21 allows remote attackers to bypass authentication and gain administrative privileges by setting the verified cookie to an arbi (no CVSS)
- [CVE-2009-1366](https://cve.now/CVE-2009-1366.md): Cross-site scripting (XSS) vulnerability in Website\\admin\\Sales\\paypalipn.aspx in DotNetNuke (DNN) before 4.9.3 allows remote attackers to i (no CVSS)
- [CVE-2009-1367](https://cve.now/CVE-2009-1367.md): Cross-site scripting (XSS) vulnerability in index.php in moziloCMS 1.11 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2009-1368](https://cve.now/CVE-2009-1368.md): Directory traversal vulnerability in index.php in moziloCMS 1.11 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-1369](https://cve.now/CVE-2009-1369.md): moziloCMS 1.11 allows remote attackers to obtain sensitive information via the (1) gal\[\] parameter to gallery.php, (2) page\[\] and (3) cat\[\] (no CVSS)
- [CVE-2009-1370](https://cve.now/CVE-2009-1370.md): Stack-based buffer overflow in ape\_plugin.plg in Xilisoft Video Converter 3.1.53.0704n and 5.1.23.0402 allows remote attackers to cause a de (no CVSS)
- [CVE-2009-0307](https://cve.now/CVE-2009-0307.md): Cross-site scripting (XSS) vulnerability in the "Customize Statistics Page" (admin/statistics/ConfigureStatistics) in the MDS Connection Ser (no CVSS)
- [CVE-2009-1302](https://cve.now/CVE-2009-1302.md): The browser engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to (no CVSS)
- [CVE-2009-1303](https://cve.now/CVE-2009-1303.md): The browser engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to caus (no CVSS)
- [CVE-2009-1304](https://cve.now/CVE-2009-1304.md): The JavaScript engine in Mozilla Firefox 3.x before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers (no CVSS)
- [CVE-2009-1305](https://cve.now/CVE-2009-1305.md): The JavaScript engine in Mozilla Firefox before 3.0.9, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.16 allows remote attackers to c (no CVSS)
- [CVE-2009-1306](https://cve.now/CVE-2009-1306.md): The jar: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not follow the Content-Disposition header of th (no CVSS)
- [CVE-2009-1307](https://cve.now/CVE-2009-1307.md): The view-source: URI implementation in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey does not properly implement the Same Origin (no CVSS)
- [CVE-2009-1308](https://cve.now/CVE-2009-1308.md): Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbit (no CVSS)
- [CVE-2009-1309](https://cve.now/CVE-2009-1309.md): Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey do not properly implement the Same Origin Policy for (1) XMLHttpRequest, involving (no CVSS)
- [CVE-2009-1310](https://cve.now/CVE-2009-1310.md): Cross-site scripting (XSS) vulnerability in the MozSearch plugin implementation in Mozilla Firefox before 3.0.9 allows user-assisted remote (no CVSS)
- [CVE-2009-1311](https://cve.now/CVE-2009-1311.md): Mozilla Firefox before 3.0.9 and SeaMonkey before 1.1.17 allow user-assisted remote attackers to obtain sensitive information via a web page (no CVSS)
- [CVE-2009-1312](https://cve.now/CVE-2009-1312.md): Mozilla Firefox before 3.0.9 and SeaMonkey 1.1.17 do not block javascript: URIs in Refresh headers in HTTP responses, which allows remote at (no CVSS)
- [CVE-2009-1361](https://cve.now/CVE-2009-1361.md): dig.php in GScripts.net DNS Tools allows remote attackers to execute arbitrary commands via shell metacharacters in the host parameter. (no CVSS)
- [CVE-2009-1362](https://cve.now/CVE-2009-1362.md): SQL injection vulnerability in administration/index.php in chCounter 3.1.3 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-1336](https://cve.now/CVE-2009-1336.md): fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filena (no CVSS)
- [CVE-2009-1337](https://cve.now/CVE-2009-1337.md): The exit\_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP\_KILL capability (no CVSS)
- [CVE-2009-1338](https://cve.now/CVE-2009-1338.md): The kill\_something\_info function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signa (no CVSS)
- [CVE-2009-1359](https://cve.now/CVE-2009-1359.md): Unspecified vulnerability in the SCTP sockets implementation in Sun OpenSolaris snv\_106 through snv\_107 allows local users to cause a denial (no CVSS)
- [CVE-2009-1360](https://cve.now/CVE-2009-1360.md): The \_\_inet6\_check\_established function in net/ipv6/inet6\_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.