# CVEs published 2010-04-22

16 CVEs were published on April 22, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4790](https://cve.now/CVE-2009-4790.md): Multiple directory traversal vulnerabilities in Sysax Multi Server 4.5 allow remote authenticated users to read or modify arbitrary files vi (no CVSS)
- [CVE-2009-4791](https://cve.now/CVE-2009-4791.md): Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2009-4792](https://cve.now/CVE-2009-4792.md): SQL injection vulnerability in includes/content/member\_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL co (no CVSS)
- [CVE-2009-4793](https://cve.now/CVE-2009-4793.md): Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators (no CVSS)
- [CVE-2009-4794](https://cve.now/CVE-2009-4794.md): Multiple SQL injection vulnerabilities in Community CMS 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) article\_id (no CVSS)
- [CVE-2009-4795](https://cve.now/CVE-2009-4795.md): Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to exe (no CVSS)
- [CVE-2009-4796](https://cve.now/CVE-2009-4796.md): Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and (no CVSS)
- [CVE-2009-4797](https://cve.now/CVE-2009-4797.md): SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk par (no CVSS)
- [CVE-2009-4798](https://cve.now/CVE-2009-4798.md): Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter (no CVSS)
- [CVE-2009-4799](https://cve.now/CVE-2009-4799.md): Diskos CMS 6.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a (no CVSS)
- [CVE-2009-4800](https://cve.now/CVE-2009-4800.md): Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrary files via a ..// ( (no CVSS)
- [CVE-2010-0593](https://cve.now/CVE-2010-0593.md): The Cisco RVS4000 4-port Gigabit Security Router before 1.3.2.0, PVC2300 Business Internet Video Camera before 1.1.2.6, WVC200 Wireless-G PT (no CVSS)
- [CVE-2010-0991](https://cve.now/CVE-2010-0991.md): Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted (1) ARGB, (2) (no CVSS)
- [CVE-2010-1278](https://cve.now/CVE-2010-1278.md): Buffer overflow in the Atlcom.get\_atlcom ActiveX control in gp.ocx in Adobe Download Manager, as used in Adobe Reader and Acrobat 8.x before (no CVSS)
- [CVE-2010-1320](https://cve.now/CVE-2010-1320.md): Double free vulnerability in do\_tgs\_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 all (no CVSS)
- [CVE-2010-1486](https://cve.now/CVE-2010-1486.md): Multiple cross-site scripting (XSS) vulnerabilities in \_invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-04-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.