# CVEs published 2009-05-11

27 CVEs were published on May 11, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6803](https://cve.now/CVE-2008-6803.md): SQL injection vulnerability in diziler.asp in Yigit Aybuga Dizi Portali allows remote attackers to execute arbitrary SQL commands via the id (no CVSS)
- [CVE-2008-6804](https://cve.now/CVE-2008-6804.md): Tribiq CMS 5.0.9a beta allows remote attackers to bypass authentication and gain administrative access by setting the COOKIE\_LAST\_ADMIN\_USER (no CVSS)
- [CVE-2008-6805](https://cve.now/CVE-2008-6805.md): Multiple SQL injection vulnerabilities in Mic\_Blog 0.0.3, when magic\_quotes\_gpc is disabled, allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-1612](https://cve.now/CVE-2009-1612.md): Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute (no CVSS)
- [CVE-2009-1613](https://cve.now/CVE-2009-1613.md): Multiple SQL injection vulnerabilities in leap.php in Leap CMS 0.1.4, when magic\_quotes\_gpc is disabled, allow remote attackers to execute a (no CVSS)
- [CVE-2009-1614](https://cve.now/CVE-2009-1614.md): Multiple cross-site scripting (XSS) vulnerabilities in Leap CMS 0.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) (no CVSS)
- [CVE-2009-1615](https://cve.now/CVE-2009-1615.md): Unrestricted file upload vulnerability in Leap CMS 0.1.4 allows remote attackers to execute arbitrary code by uploading a file with an execu (no CVSS)
- [CVE-2009-1616](https://cve.now/CVE-2009-1616.md): Cross-site scripting (XSS) vulnerability in docs/showdoc.php in Coppermine Photo Gallery (CPG) before 1.4.22 allows remote attackers to inje (no CVSS)
- [CVE-2009-1604](https://cve.now/CVE-2009-1604.md): Unspecified vulnerability in LimeSurvey before 1.82 allows remote attackers to execute commands and obtain sensitive data via unknown attack (no CVSS)
- [CVE-2009-1605](https://cve.now/CVE-2009-1605.md): Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf\_function.c in MuPDF in the mupdf-20090223-win32 package, as used (CVSS 5.4)
- [CVE-2009-1606](https://cve.now/CVE-2009-1606.md): Multiple stack-based and heap-based buffer overflows in Dafolo DafoloControl ActiveX control (DafoloFFControl.dll) 1.108.6.195 allow remote (no CVSS)
- [CVE-2009-1607](https://cve.now/CVE-2009-1607.md): Cross-site scripting (XSS) vulnerability in the administrator panel in phpForm.net LinkBase 2.0 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2009-1608](https://cve.now/CVE-2009-1608.md): Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow user-assisted remote attackers to execute arbitrar (no CVSS)
- [CVE-2009-1609](https://cve.now/CVE-2009-1609.md): Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by uplo (no CVSS)
- [CVE-2009-1610](https://cve.now/CVE-2009-1610.md): admin/changepassword.php in Job Script Job Board Software 2.0 allows remote attackers to change the administrator password and gain administ (no CVSS)
- [CVE-2009-1611](https://cve.now/CVE-2009-1611.md): Stack-based buffer overflow in ElectraSoft 32bit FTP 09.04.24 allows remote FTP servers to execute arbitrary code via a long 257 reply to a (no CVSS)
- [CVE-2009-1603](https://cve.now/CVE-2009-1603.md): src/tools/pkcs11-tool.c in pkcs11-tool in OpenSC 0.11.7, when used with unspecified third-party PKCS#11 modules, generates RSA keys with inc (no CVSS)
- [CVE-2009-0194](https://cve.now/CVE-2009-0194.md): The domain-locking implementation in the GARMINAXCONTROL.GarminAxControl\_t.1 ActiveX control in npGarmin.dll in the Garmin Communicator Plug (no CVSS)
- [CVE-2009-1194](https://cve.now/CVE-2009-1194.md): Integer overflow in the pango\_glyph\_string\_set\_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers (no CVSS)
- [CVE-2009-1597](https://cve.now/CVE-2009-1597.md): Mozilla Firefox executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in a (no CVSS)
- [CVE-2009-1598](https://cve.now/CVE-2009-1598.md): Google Chrome executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an (no CVSS)
- [CVE-2009-1599](https://cve.now/CVE-2009-1599.md): Opera executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline P (no CVSS)
- [CVE-2009-1600](https://cve.now/CVE-2009-1600.md): Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an i (no CVSS)
- [CVE-2009-1601](https://cve.now/CVE-2009-1601.md): The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working (no CVSS)
- [CVE-2009-1602](https://cve.now/CVE-2009-1602.md): Pablo Software Solutions Quick 'n Easy Mail Server 3.3 allows remote attackers to cause a denial of service (daemon outage or CPU consumptio (no CVSS)
- [CVE-2009-1595](https://cve.now/CVE-2009-1595.md): The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change (no CVSS, org.igniterealtime.openfire:parent)
- [CVE-2009-1596](https://cve.now/CVE-2009-1596.md): Ignite Realtime Openfire before 3.6.5 does not properly implement the register.password (aka canChangePassword) console configuration settin (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.