# CVEs published 2009-05-12 27 CVEs were published on May 12, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-0220](https://cve.now/CVE-2009-0220.md): Multiple stack-based buffer overflows in the PowerPoint 4.0 importer (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 200 (no CVSS) - [CVE-2009-0221](https://cve.now/CVE-2009-0221.md): Integer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a PowerPoint fil (no CVSS) - [CVE-2009-0222](https://cve.now/CVE-2009-0222.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f (no CVSS) - [CVE-2009-0223](https://cve.now/CVE-2009-0223.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f (no CVSS) - [CVE-2009-0224](https://cve.now/CVE-2009-0224.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; PowerPoint Viewer 2003 and 2007 SP1 and SP2; PowerPoint in M (no CVSS) - [CVE-2009-0225](https://cve.now/CVE-2009-0225.md): Microsoft Office PowerPoint 2002 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a file that uses a PowerPoi (no CVSS) - [CVE-2009-0226](https://cve.now/CVE-2009-0226.md): Stack-based buffer overflow in the PowerPoint 4.2 conversion filter in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows r (no CVSS) - [CVE-2009-0227](https://cve.now/CVE-2009-0227.md): Stack-based buffer overflow in the PowerPoint 4.2 conversion filter (PP4X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 (no CVSS) - [CVE-2009-1128](https://cve.now/CVE-2009-1128.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f (no CVSS) - [CVE-2009-1129](https://cve.now/CVE-2009-1129.md): Multiple stack-based buffer overflows in the PowerPoint 95 importer (PP7X32.DLL) in Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 (no CVSS) - [CVE-2009-1130](https://cve.now/CVE-2009-1130.md): Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows rem (no CVSS) - [CVE-2009-1131](https://cve.now/CVE-2009-1131.md): Multiple stack-based buffer overflows in Microsoft Office PowerPoint 2000 SP3 allow remote attackers to execute arbitrary code via a large a (no CVSS) - [CVE-2009-1137](https://cve.now/CVE-2009-1137.md): Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3 allows remote attackers to execute arbitrary code via crafted sound data in a f (no CVSS) - [CVE-2008-6806](https://cve.now/CVE-2008-6806.md): Unrestricted file upload vulnerability in includes/imageupload.php in 7Shop 1.1 and earlier allows remote attackers to execute arbitrary cod (no CVSS) - [CVE-2008-6807](https://cve.now/CVE-2008-6807.md): PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to execute arbitrary PHP code via a URL (no CVSS) - [CVE-2008-6808](https://cve.now/CVE-2008-6808.md): SQL injection vulnerability in links.php in Scripts for Sites (SFS) EZ Link Directory allows remote attackers to execute arbitrary SQL comma (no CVSS) - [CVE-2009-1617](https://cve.now/CVE-2009-1617.md): Teraway LinkTracker 1.0 allows remote attackers to bypass authentication and gain administrative access via a userid=1&lvl=1 value for the t (no CVSS) - [CVE-2009-1618](https://cve.now/CVE-2009-1618.md): Teraway LiveHelp 2.0 allows remote attackers to bypass authentication and gain administrative access via a pwd=&lvl=1&usr=&alias=admin&useri (no CVSS) - [CVE-2009-1619](https://cve.now/CVE-2009-1619.md): Teraway FileStream 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the twFSadmin cookie to 1. (no CVSS) - [CVE-2009-1620](https://cve.now/CVE-2009-1620.md): Multiple cross-site scripting (XSS) vulnerabilities in input.php in MataChat allow remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2009-1621](https://cve.now/CVE-2009-1621.md): Directory traversal vulnerability in index.php in OpenCart 1.1.8 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2009-1622](https://cve.now/CVE-2009-1622.md): SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via the order\_sn parameter (no CVSS) - [CVE-2009-1623](https://cve.now/CVE-2009-1623.md): Cross-site scripting (XSS) vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2009-1624](https://cve.now/CVE-2009-1624.md): Directory traversal vulnerability in index.php in Dew-NewPHPLinks 2.0 allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2009-1625](https://cve.now/CVE-2009-1625.md): Directory traversal vulnerability in index.php in Thickbox Gallery 2 allows remote attackers to include and execute arbitrary local files vi (no CVSS) - [CVE-2009-1626](https://cve.now/CVE-2009-1626.md): SQL injection vulnerability in public/specific.php in EZ-Blog before Beta 2 20090427, when magic\_quotes\_gpc is disabled, allows remote attac (no CVSS) - [CVE-2009-1627](https://cve.now/CVE-2009-1627.md): Stack-based buffer overflow in Streaming Download Project (SDP) Downloader 2.3.0 allows remote attackers to execute arbitrary code via a lon (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-05-12 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.