# CVEs published 2009-04-24

23 CVEs were published on April 24, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1433](https://cve.now/CVE-2009-1433.md): SQL injection vulnerability in File::find (filesystem/File.php) in SilverStripe before 2.3.1 allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2009-0063](https://cve.now/CVE-2009-0063.md): Cross-site scripting (XSS) vulnerability in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allows remote authentic (no CVSS)
- [CVE-2009-0064](https://cve.now/CVE-2009-0064.md): Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated (no CVSS)
- [CVE-2009-0164](https://cve.now/CVE-2009-0164.md): The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attack (no CVSS)
- [CVE-2009-0798](https://cve.now/CVE-2009-0798.md): ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by open (no CVSS)
- [CVE-2009-1192](https://cve.now/CVE-2009-1192.md): The (1) agp\_generic\_alloc\_page and (2) agp\_generic\_alloc\_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux ker (no CVSS)
- [CVE-2009-1412](https://cve.now/CVE-2009-1412.md): Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59, when invoked by Internet Explorer, (no CVSS)
- [CVE-2009-1413](https://cve.now/CVE-2009-1413.md): Google Chrome 1.0.x does not cancel timeouts upon a page transition, which makes it easier for attackers to conduct Universal XSS attacks by (no CVSS)
- [CVE-2009-1414](https://cve.now/CVE-2009-1414.md): Google Chrome 2.0.x lets modifications to the global object persist across a page transition, which makes it easier for attackers to conduct (no CVSS)
- [CVE-2008-6748](https://cve.now/CVE-2008-6748.md): Eval injection vulnerability in Megacubo 5.0.7 allows remote attackers to inject and execute arbitrary PHP code via the play action in a meg (no CVSS)
- [CVE-2008-6749](https://cve.now/CVE-2008-6749.md): Multiple SQL injection vulnerabilities in admin/usercheck.php in FlexPHPDirectory 0.0.1, when magic\_quotes\_gpc is disabled, allow remote att (no CVSS)
- [CVE-2008-6750](https://cve.now/CVE-2008-6750.md): Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a (no CVSS)
- [CVE-2008-6751](https://cve.now/CVE-2008-6751.md): Unrestricted file upload vulnerability in index.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging allows remote attackers to (no CVSS)
- [CVE-2008-6752](https://cve.now/CVE-2008-6752.md): adminlogin/password.php in the Twitter Clone (TClone) plugin for ReVou Micro Blogging does not verify the original password before changing (no CVSS)
- [CVE-2009-1403](https://cve.now/CVE-2009-1403.md): SQL injection vulnerability in product\_info.php in CRE Loaded 6.2 allows remote attackers to execute arbitrary SQL commands via the products (no CVSS)
- [CVE-2009-1404](https://cve.now/CVE-2009-1404.md): SQL injection vulnerability in admin.php in PastelCMS 0.8.0, when magic\_quotes\_gpc is disabled, allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2009-1405](https://cve.now/CVE-2009-1405.md): Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic\_quotes\_gpc is disabled, allows remote attackers to include and (no CVSS)
- [CVE-2009-1406](https://cve.now/CVE-2009-1406.md): Directory traversal vulnerability in cms\_detect.php in TotalCalendar 2.4 allows remote attackers to include and execute arbitrary local file (no CVSS)
- [CVE-2009-1407](https://cve.now/CVE-2009-1407.md): Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-1408](https://cve.now/CVE-2009-1408.md): Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote att (no CVSS)
- [CVE-2009-1409](https://cve.now/CVE-2009-1409.md): SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic\_quotes\_gpc is d (no CVSS)
- [CVE-2009-1410](https://cve.now/CVE-2009-1410.md): SQL injection vulnerability in index.php in Quick.Cms.Lite 0.5 allows remote attackers to execute arbitrary SQL commands via the id paramete (no CVSS)
- [CVE-2009-1411](https://cve.now/CVE-2009-1411.md): SQL injection vulnerability in events/inc/events.inc.php in the Events plugin for Seditio CMS 1.0 allows remote attackers to execute arbitra (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.