# CVEs published 2009-05-07 19 CVEs were published on May 7, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2008-6799](https://cve.now/CVE-2008-6799.md): connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative privileges by setting (no CVSS) - [CVE-2008-6801](https://cve.now/CVE-2008-6801.md): Cross-site request forgery (CSRF) vulnerability in Vivvo CMS before 4.0.4 allows remote attackers to hijack the authentication of unspecifie (no CVSS) - [CVE-2008-6802](https://cve.now/CVE-2008-6802.md): Multiple SQL injection vulnerabilities in index.php in phPhotoGallery 0.92 allow remote attackers to execute arbitrary SQL commands via the (no CVSS) - [CVE-2009-1582](https://cve.now/CVE-2009-1582.md): Million Dollar Text Links 1.0 does not properly restrict administrator access to admin.home.php, which allows remote attackers to bypass int (no CVSS) - [CVE-2009-1583](https://cve.now/CVE-2009-1583.md): Multiple cross-site scripting (XSS) vulnerabilities in TemaTres 1.0.3 and 1.031 allow remote attackers to inject arbitrary web script or HTM (no CVSS) - [CVE-2009-1584](https://cve.now/CVE-2009-1584.md): Multiple SQL injection vulnerabilities in TemaTres 1.0.3 and 1.031, when magic\_quotes\_gpc is disabled, allow remote attackers or remote auth (no CVSS) - [CVE-2009-1585](https://cve.now/CVE-2009-1585.md): Multiple SQL injection vulnerabilities in TemaTres 1.031, when magic\_quotes\_gpc is disabled, allow remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2009-1586](https://cve.now/CVE-2009-1586.md): Stack-based buffer overflow in the NZB importer feature in GrabIt 1.7.2 Beta 3 and earlier allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2009-1587](https://cve.now/CVE-2009-1587.md): index.php in PHP Site Lock 2.0 allows remote attackers to bypass authentication and obtain administrative access by setting the login\_id, gr (no CVSS) - [CVE-2008-6797](https://cve.now/CVE-2008-6797.md): The server in Mitel NuPoint Messenger R11 and R3 sends usernames and passwords in cleartext to Exchange servers, which allows remote attacke (no CVSS) - [CVE-2008-6798](https://cve.now/CVE-2008-6798.md): Multiple SQL injection vulnerabilities in login.php in Pre Projects Pre Real Estate Listings allow remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2008-6792](https://cve.now/CVE-2008-6792.md): system-tools-backends before 2.6.0-1ubuntu1.1 in Ubuntu 8.10, as used by "Users and Groups" in GNOME System Tools, hashes account passwords (no CVSS) - [CVE-2008-6793](https://cve.now/CVE-2008-6793.md): The get\_file\_type function in lib/file\_content.php in DFLabs PTK 0.1, 0.2, and 1.0 allows remote attackers to execute arbitrary commands via (no CVSS) - [CVE-2008-6794](https://cve.now/CVE-2008-6794.md): SQL injection vulnerability in directory.php in Scripts For Sites (SFS) EZ Pub Site allows remote attackers to execute arbitrary SQL command (no CVSS) - [CVE-2008-6795](https://cve.now/CVE-2008-6795.md): SQL injection vulnerability in view\_news.php in nicLOR Vibro-School-CMS allows remote attackers to execute arbitrary SQL commands via the nI (no CVSS) - [CVE-2008-6796](https://cve.now/CVE-2008-6796.md): SQL injection vulnerability in manager/login.php in Pre Projects Pre Real Estate Listings allows remote attackers to execute arbitrary SQL c (no CVSS) - [CVE-2009-1441](https://cve.now/CVE-2009-1441.md): Heap-based buffer overflow in the ParamTraits\::Read function in Google Chrome before 1.0.154.64 allows attackers to leverage rende (no CVSS) - [CVE-2009-1442](https://cve.now/CVE-2009-1442.md): Multiple integer overflows in Skia, as used in Google Chrome 1.x before 1.0.154.64 and 2.x, and possibly Android, might allow remote attacke (no CVSS) - [CVE-2009-1577](https://cve.now/CVE-2009-1577.md): Multiple stack-based buffer overflows in the putstring function in find.c in Cscope before 15.6 allow user-assisted remote attackers to exec (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-05-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.