# CVEs published 2010-04-27 24 CVEs were published on April 27, 2010: 0 critical, 0 high. Days are UTC. - [CVE-2009-4811](https://cve.now/CVE-2009-4811.md): VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 (no CVSS) - [CVE-2009-4812](https://cve.now/CVE-2009-4812.md): Wolfram Research webMathematica allows remote attackers to obtain sensitive information via a direct request to the MSP script, which reveal (no CVSS) - [CVE-2009-4813](https://cve.now/CVE-2009-4813.md): Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web sc (no CVSS) - [CVE-2009-4814](https://cve.now/CVE-2009-4814.md): Cross-site scripting (XSS) vulnerability in Wolfram Research webMathematica allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2009-4815](https://cve.now/CVE-2009-4815.md): Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read arbitrary files via unspecified vectors (no CVSS) - [CVE-2009-4816](https://cve.now/CVE-2009-4816.md): Directory traversal vulnerability in api/download\_checker.php in MegaLab The Uploader 2.0 allows remote attackers to read arbitrary files vi (no CVSS) - [CVE-2009-4817](https://cve.now/CVE-2009-4817.md): Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary code by uploading a (no CVSS) - [CVE-2009-4818](https://cve.now/CVE-2009-4818.md): Unrestricted file upload vulnerability in upload.php in PHPSimplicity Simplicity oF Upload 1.3.2 allows remote attackers to execute arbitrar (no CVSS) - [CVE-2009-4819](https://cve.now/CVE-2009-4819.md): Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploadin (no CVSS) - [CVE-2009-4820](https://cve.now/CVE-2009-4820.md): Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download (no CVSS) - [CVE-2009-4821](https://cve.now/CVE-2009-4821.md): The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to (1) c (no CVSS) - [CVE-2009-4822](https://cve.now/CVE-2009-4822.md): Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kasseler CMS 1.3.4 allow remote attackers to inject arbitrary web script (no CVSS) - [CVE-2009-4823](https://cve.now/CVE-2009-4823.md): Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject a (no CVSS) - [CVE-2009-4824](https://cve.now/CVE-2009-4824.md): Unspecified vulnerability in Kolab Webclient before 1.2.0 in Kolab Server before 2.2.3 allows attackers to have an unspecified impact via ve (no CVSS) - [CVE-2009-4825](https://cve.now/CVE-2009-4825.md): 8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to downloa (no CVSS) - [CVE-2009-4826](https://cve.now/CVE-2009-4826.md): Cross-site request forgery (CSRF) vulnerability in hosting/admin\_ac.php in ScriptsEz Mini Hosting Panel allows remote attackers to hijack th (no CVSS) - [CVE-2009-4827](https://cve.now/CVE-2009-4827.md): Cross-site request forgery (CSRF) vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of adm (no CVSS) - [CVE-2009-4828](https://cve.now/CVE-2009-4828.md): Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attacker (no CVSS) - [CVE-2009-4829](https://cve.now/CVE-2009-4829.md): Cross-site scripting (XSS) vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows (no CVSS) - [CVE-2009-4830](https://cve.now/CVE-2009-4830.md): Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator ac (no CVSS) - [CVE-2010-0105](https://cve.now/CVE-2010-0105.md): The hfs implementation in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 supports hard links to directories and does not prevent certain dee (no CVSS) - [CVE-2010-0772](https://cve.now/CVE-2010-0772.md): Unspecified vulnerability in the channel process in IBM WebSphere MQ 7.0 before 7.0.1.2 allows remote authenticated users to cause a denial (no CVSS) - [CVE-2010-1559](https://cve.now/CVE-2010-1559.md): SQL injection vulnerability in the SermonSpeaker (com\_sermonspeaker) component before 3.2.1 for Joomla! allows remote attackers to execute a (no CVSS) - [CVE-2010-1560](https://cve.now/CVE-2010-1560.md): Buffer overflow in the REPEAT function in IBM DB2 9.1 before FP9 allows remote authenticated users to cause a denial of service (trap) via u (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2010-04-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.