# CVEs published 2010-04-23

28 CVEs were published on April 23, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4801](https://cve.now/CVE-2009-4801.md): EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP script (no CVSS)
- [CVE-2009-4802](https://cve.now/CVE-2009-4802.md): SQL injection vulnerability in the Flat Manager (flatmgr) extension before 1.9.16 for TYPO3 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-4803](https://cve.now/CVE-2009-4803.md): SQL injection vulnerability in the Accessibility Glossary (a21glossary) extension 0.4.10 and earlier for TYPO3 allows remote attackers to ex (no CVSS, svewap/a21glossary · wapplersystems/a21glossary)
- [CVE-2009-4804](https://cve.now/CVE-2009-4804.md): Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allo (no CVSS)
- [CVE-2009-4805](https://cve.now/CVE-2009-4805.md): Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magic\_quotes\_gpc is disabled, allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-4806](https://cve.now/CVE-2009-4806.md): admin/save\_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attack (no CVSS)
- [CVE-2009-4807](https://cve.now/CVE-2009-4807.md): Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-4808](https://cve.now/CVE-2009-4808.md): admin.php in Graugon PHP Article Publisher 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting (no CVSS)
- [CVE-2009-4809](https://cve.now/CVE-2009-4809.md): Directory traversal vulnerability in thumbnail.ghp in Easy File Sharing (EFS) Web Server 4.8 allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2009-4810](https://cve.now/CVE-2009-4810.md): The Secure Remote Password (SRP) implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protoc (no CVSS)
- [CVE-2010-1034](https://cve.now/CVE-2010-1034.md): Unspecified vulnerability in HP System Management Homepage (SMH) 6.0 before 6.0.0-95 on Linux, and 6.0 before 6.0.0.96 on Windows, allows re (no CVSS)
- [CVE-2010-1035](https://cve.now/CVE-2010-1035.md): Multiple unspecified vulnerabilities in HP Virtual Machine Manager (VMM) before 6.0 allow remote authenticated users to execute arbitrary co (no CVSS)
- [CVE-2010-1157](https://cve.now/CVE-2010-1157.md): Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by (no CVSS, org.apache.tomcat:tomcat)
- [CVE-2010-1491](https://cve.now/CVE-2010-1491.md): Directory traversal vulnerability in the MMS Blog (com\_mmsblog) component 2.3.0 for Joomla! allows remote attackers to read arbitrary files (no CVSS)
- [CVE-2010-1492](https://cve.now/CVE-2010-1492.md): Directory traversal vulnerability in help/frameRight.php in Elastix 1.6.0 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2010-1493](https://cve.now/CVE-2010-1493.md): SQL injection vulnerability in the AWDwall (com\_awdwall) component before 1.5.5 for Joomla! allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2010-1494](https://cve.now/CVE-2010-1494.md): Directory traversal vulnerability in the AWDwall (com\_awdwall) component 1.5.4 for Joomla! allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2010-1495](https://cve.now/CVE-2010-1495.md): Directory traversal vulnerability in the Matamko (com\_matamko) component 1.01 for Joomla! allows remote attackers to read arbitrary files vi (no CVSS)
- [CVE-2010-1496](https://cve.now/CVE-2010-1496.md): SQL injection vulnerability in the JoltCard (com\_joltcard) component 1.2.1 for Joomla! allows remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2010-1497](https://cve.now/CVE-2010-1497.md): Cross-site scripting (XSS) vulnerability in download\_proc.php in dl\_stats before 2.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2010-1498](https://cve.now/CVE-2010-1498.md): Multiple SQL injection vulnerabilities in dl\_stats before 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter (no CVSS)
- [CVE-2010-1499](https://cve.now/CVE-2010-1499.md): SQL injection vulnerability in genre\_artists.php in MusicBox 3.3 allows remote attackers to execute arbitrary SQL commands via the id parame (no CVSS)
- [CVE-2010-1500](https://cve.now/CVE-2010-1500.md): Google Chrome before 4.1.249.1059 does not properly support forms, which has unknown impact and attack vectors, related to a "type confusion (no CVSS)
- [CVE-2010-1502](https://cve.now/CVE-2010-1502.md): Unspecified vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to access local files via vectors related to "develop (no CVSS)
- [CVE-2010-1503](https://cve.now/CVE-2010-1503.md): Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2010-1504](https://cve.now/CVE-2010-1504.md): Cross-site scripting (XSS) vulnerability in Google Chrome before 4.1.249.1059 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2010-1505](https://cve.now/CVE-2010-1505.md): Google Chrome before 4.1.249.1059 does not prevent pages from loading with the New Tab page's privileges, which has unknown impact and attac (no CVSS)
- [CVE-2010-1506](https://cve.now/CVE-2010-1506.md): The Google V8 bindings in Google Chrome before 4.1.249.1059 allow attackers to cause a denial of service (memory corruption) via unknown vec (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-04-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.