# CVEs published 2009-04-28

26 CVEs were published on April 28, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-2438](https://cve.now/CVE-2008-2438.md): Integer overflow in ovalarmsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbi (no CVSS)
- [CVE-2008-6757](https://cve.now/CVE-2008-6757.md): Cross-site scripting (XSS) vulnerability in manuals\_search.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to inject arbit (no CVSS)
- [CVE-2008-6758](https://cve.now/CVE-2008-6758.md): Cross-site request forgery (CSRF) vulnerability in cart\_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to hijack the (no CVSS)
- [CVE-2008-6759](https://cve.now/CVE-2008-6759.md): ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a URL in the POST\_DATA parameter to manuals\_s (no CVSS)
- [CVE-2008-6760](https://cve.now/CVE-2008-6760.md): ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for a (no CVSS)
- [CVE-2008-6761](https://cve.now/CVE-2008-6761.md): Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject arbitrary PHP code int (no CVSS)
- [CVE-2008-6762](https://cve.now/CVE-2008-6762.md): Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web (no CVSS)
- [CVE-2008-6763](https://cve.now/CVE-2008-6763.md): login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrary account by setting (no CVSS)
- [CVE-2008-6764](https://cve.now/CVE-2008-6764.md): Cross-site scripting (XSS) vulnerability in login.php in Silentum LoginSys 1.0.0 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2008-6765](https://cve.now/CVE-2008-6765.md): ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to access the contents of an arbitrary shopping cart via a modified cart\_name par (no CVSS)
- [CVE-2008-6766](https://cve.now/CVE-2008-6766.md): cart\_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to cause a denial of service (excessive shopping carts) via a fl (no CVSS)
- [CVE-2008-6767](https://cve.now/CVE-2008-6767.md): wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of servic (no CVSS)
- [CVE-2009-1452](https://cve.now/CVE-2009-1452.md): Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2009-1453](https://cve.now/CVE-2009-1453.md): SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic\_quotes\_gpc is disabled, allows remote attackers to execut (no CVSS)
- [CVE-2009-1454](https://cve.now/CVE-2009-1454.md): Cross-site scripting (XSS) vulnerability in tasks.php in WebCollab before 2.50 (aka Billy Goat) allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2009-1455](https://cve.now/CVE-2009-1455.md): Multiple cross-site request forgery (CSRF) vulnerabilities in WebCollab before 2.50 (aka Billy Goat) allow remote attackers to hijack the au (no CVSS)
- [CVE-2009-1456](https://cve.now/CVE-2009-1456.md): Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary l (no CVSS)
- [CVE-2009-1457](https://cve.now/CVE-2009-1457.md): Cross-site scripting (XSS) vulnerability in player.php in Nuke Evolution Xtreme 2.x allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2009-1458](https://cve.now/CVE-2009-1458.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2009-1459](https://cve.now/CVE-2009-1459.md): Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrator (no CVSS)
- [CVE-2009-1460](https://cve.now/CVE-2009-1460.md): razorCMS before 0.4 uses weak permissions for (1) admin/core/admin\_config.php, which allows local users to obtain the administrator's passwo (no CVSS)
- [CVE-2009-1461](https://cve.now/CVE-2009-1461.md): Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to in (no CVSS)
- [CVE-2009-1462](https://cve.now/CVE-2009-1462.md): The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsi (no CVSS)
- [CVE-2009-1463](https://cve.now/CVE-2009-1463.md): Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving cont (no CVSS)
- [CVE-2009-1450](https://cve.now/CVE-2009-1450.md): PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2009-1451](https://cve.now/CVE-2009-1451.md): Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-04-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.