CVE-2009-4804

Cross-site scripting XSS vulnerability in the Calendar Base cal extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."...

CVE-2009-4806

CVE-2009-4806 affects Digital Interchange Document Library 1.0.1; the admin/save_user.asp endpoint does not require administrative authentication, allowing remote attackers to read or modify the administrator credentials via unspecified vectors. This yields partial confidentiality and integrity i...

CVE-2009-4809

Affects Easy File Sharing (EFS) Web Server 4.8. The vulnerability is a directory traversal in thumbnail.ghp where an attacker can read arbitrary files by manipulating the vfolder parameter (dot-dot sequence). This is a file-read impact, enabling access to portions of the server’s filesystem. The ...

CVE-2009-4809

Directory traversal vulnerability in thumbnail.ghp in Easy File Sharing EFS Web Server 4.8 allows remote attackers to read arbitrary files via a .. dot dot in the vfolder parameter...

CVE-2009-4805

EZ-Blog Beta 1 is affected by SQL injection vulnerabilities in public/view.php (storyid) and admin/remove.php (kill) when magic_quotes_gpc is disabled. The issue allows remote attackers to execute arbitrary SQL commands as described in CVE-2009-4805. The OpenVAS entry confirms an SQLi vulnerabili...

CVE-2009-4801

CVE-2009-4801 affects EZ-Blog Beta 1. The vulnerability is an authentication bypass: remote attackers can craft requests to PHP scripts to create or delete arbitrary posts due to missing access control. Root cause is lack of authentication on post-manipulation endpoints, enabling network-based, u...

CVE-2009-4803

CVE-2009-4803 affects the TYPO3 Accessibility Glossary extension (a21glossary) up to version 0.4.10 and earlier. The vulnerability is an SQL injection in the extension that allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Documents consistently describe the issue...

CVE-2009-4803

SQL injection vulnerability in the Accessibility Glossary a21glossary extension 0.4.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4804

CVE-2009-4804 is an XSS vulnerability in the TYPO3 Calendar Base (cal) extension, present in versions before 1.1.1 when Internet Explorer 6 is used. The issue allows an attacker to inject arbitrary script/HTML via the "search parameters" in the affected interface. Connected documents corroborate ...

CVE-2009-4806

admin/saveuser.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors. NOTE: some of these details are obtained from third party information...

CVE-2009-4802

CVE-2009-4802 affects the TYPO3 Flat Manager (flatmgr) extension prior to version 1.9.16. It allows remote SQL injection via unspecified vectors, enabling attackers to execute arbitrary SQL commands. Remediation: upgrade to flatmgr 1.9.16 or later (per sources). The connected Red Hat/NVD entries ...

CVE-2009-4810

The CVE-2009-4810 entry concerns the SRP implementation in Samhain prior to version 2.5.4. A zero-value check required by the SRP protocol is omitted, allowing remote attackers to bypass authentication via crafted input. The impact is an authentication bypass affecting Samhain’s SRP authenticatio...

CVE-2009-4808

CVE-2009-4808 affects Graugon PHP Article Publisher 1.0. The admin.php authentication check can be bypassed by setting the g_admin cookie to 1, allowing remote attackers to gain administrative access. This is the root cause and impact described across sources; no remediation or mitigation details...

CVE-2009-4810

The Secure Remote Password SRP implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protocol, which allows remote attackers to bypass authentication via crafted input...

Ipswitch WS_FTP Professional < 12.2 'HTTP' Response Format String Vulnerability

Ipswitch WSFTP Professional is prone to a format string vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2009-4794

CVE-2009-4794 concerns vulnerable installations of Community CMS 0.5 . The issue comprises multiple SQL injection vulnerabilities exploitable via the (1) article_id parameter to view.php and (2) a parameter in an event action to calendar.php (accessible through index.php). Remote attackers could ...

CVE-2009-4800

The CVE-2009-4800 entry describes a directory traversal vulnerability in Sysax Multi Server versions 4.3 and 4.5 . It allows remote authenticated users to delete arbitrary files via a “..//” sequence in a DELE command, indicating a flaw in path handling during FTP-like file operations. The availa...

CVE-2009-4790

CVE-2009-4790 concerns Sysax Multi Server 4.5, where multiple directory traversal vulnerabilities allow remote authenticated users to read or modify arbitrary files via crafted FTP commands. The description notes that provenance is unknown and details come from third‑party information. All connec...

CVE-2009-4792

BandSite CMS 1.1.4 contains an SQL injection vulnerability in includes/content/member_content.php, exploitable via the memid parameter to members.php, allowing remote execution of arbitrary SQL commands. No remediation details are provided in the supplied documents.

CVE-2009-4799

Diskos CMS 6.x contains a vulnerability where sensitive data is stored under the web root with insufficient access control, allowing remote attackers to download the database via direct requests to artikler_prod.mdb or medlemmer.mdb. The issue is characterized by a network attack vector, low atta...