# CVEs published 2010-01-18

16 CVEs were published on January 18, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4614](https://cve.now/CVE-2009-4614.md): Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers to execute arbitrary PHP code via (no CVSS)
- [CVE-2009-4615](https://cve.now/CVE-2009-4615.md): SQL injection vulnerability in review.php in MYRE Holiday Rental Manager allows remote attackers to execute arbitrary SQL commands via the l (no CVSS)
- [CVE-2009-4616](https://cve.now/CVE-2009-4616.md): Cross-site scripting (XSS) vulnerability in search.php in MYRE Holiday Rental Manager allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-4617](https://cve.now/CVE-2009-4617.md): Multiple SQL injection vulnerabilities in Tourism Script Accommodation Hotel Booking Portal Script allow remote attackers to execute arbitra (no CVSS)
- [CVE-2009-4618](https://cve.now/CVE-2009-4618.md): Multiple SQL injection vulnerabilities in Tourism Script Bus Script allow remote attackers to execute arbitrary SQL commands via the sitetex (no CVSS)
- [CVE-2009-4619](https://cve.now/CVE-2009-4619.md): SQL injection vulnerability in the Lucy Games (com\_lucygames) component 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2009-4620](https://cve.now/CVE-2009-4620.md): SQL injection vulnerability in the Joomloc (com\_joomloc) component 1.0 for Joomla allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-4621](https://cve.now/CVE-2009-4621.md): SQL injection vulnerability in the JiangHu Inn plugin 1.1 and earlier for Discuz! allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-4622](https://cve.now/CVE-2009-4622.md): PHP remote file inclusion vulnerability in admin/admin\_news\_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to (no CVSS)
- [CVE-2009-4623](https://cve.now/CVE-2009-4623.md): Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2009-4624](https://cve.now/CVE-2009-4624.md): SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands via the cat\_id para (no CVSS)
- [CVE-2009-4625](https://cve.now/CVE-2009-4625.md): SQL injection vulnerability in the updateOnePage function in components/com\_bfsurvey\_pro/controller.php in BF Survey Pro Free (com\_bfsurvey\_ (no CVSS)
- [CVE-2009-4626](https://cve.now/CVE-2009-4626.md): Directory traversal vulnerability in menu.php in phpNagios 1.2.0 allows remote attackers to include and execute arbitrary local files via di (no CVSS)
- [CVE-2009-4627](https://cve.now/CVE-2009-4627.md): Directory traversal vulnerability in sources/\_template\_parser.php in Moa Gallery 1.2.0 and earlier allows remote attackers to read arbitrary (no CVSS)
- [CVE-2009-4628](https://cve.now/CVE-2009-4628.md): SQL injection vulnerability in the TemplatePlaza.com TPDugg (com\_tpdugg) component 1.1 for Joomla! allows remote attackers to execute arbitr (no CVSS)
- [CVE-2010-0356](https://cve.now/CVE-2010-0356.md): Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.