CVE-2009-4798

CVE-2009-4798 affects Diskos CMS 6.x, with multiple SQL injection flaws exposed via the (1) kat parameter to side.asp and (2) brugerid and (3) password fields in the administration login. The root cause is improper input handling allowing arbitrary SQL execution by remote attackers. The available...

CVE-2009-4795

CVE-2009-4795 : In Xlight FTP Server prior to 3.2.1, when ODBC authentication is enabled, remote attackers can trigger SQL injection through the USER (username) or PASS (password) commands. The underlying issue is the server processing user-supplied credentials in SQL without proper validation, a...

CVE-2009-4796

glFusion versions 1.1.2 and earlier are affected by multiple SQL injection vulnerabilities in the ExecuteQueries function of private/system/classes/listfactory.class.php. The flaw allows remote attackers to inject arbitrary SQL via the (1) order and (2) direction parameters to search.php. Impact ...

CVE-2009-4797

CVE-2009-4797 describes an SQL injection in JobHut browse.php for versions 1.2 and earlier, exploitable via the pk parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands and may impact data confidentiality, integrity, and availability as described in the CVSS 2.0 v...

CVE-2009-4790

CVE-2009-4790 concerns Sysax Multi Server 4.5, where multiple directory traversal vulnerabilities allow remote authenticated users to read or modify arbitrary files via crafted FTP commands. The description notes that provenance is unknown and details come from third‑party information. All connec...

CVE-2009-4793

The CVE-2009-4793 issue affects BandSite CMS 1.1.4, specifically the adminpanel/scripts/addphotos.php functionality. Unrestricted file upload in the addphotos action of adminpanel/index.php allows remote authenticated administrators to upload a file with an executable extension and then access it...

CVE-2009-2779

creationtimestamp| type| source ---|---|--- 2010-04-22 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/12346...

CVE-2009-4784

SQL injection vulnerability in the Joaktree comjoaktree component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the treeId parameter to index.php...

CVE-2009-4776

CVE-2009-4776 describes a buffer overflow in Hitachi Cosminexus components (V4–V8 Processing Kit for XML and Developer’s Kit for Java) used in products such as uCosminexus, Electronic Form Workflow, GroupMax, and IBM XL C/C++ Enterprise Edition 7–8. The issue involves GIF image processing APIs in...

CVE-2009-4782

Theela CMS (Theeta CMS) is affected by multiple XSS vulnerabilities described in CVE-2009-4782. The issue enables remote attackers to inject arbitrary script or HTML via specific URL parameters: (1) start, (2) forum, and (3) cat in community/thread.php; (4) start and (5) cat in community/forum.ph...

CVE-2009-4783

The CVE-2009-4783 item concerns multiple SQL injection vulnerabilities in Theeta CMS (version unclear). The affected entry points are the start parameter in three PHP scripts: community/forum.php, community/thread.php, and blog/index.php, where user-supplied input may be concatenated into SQL que...

CVE-2009-4789

MojoBlog component RC 0.15 for Joomla! is affected by multiple PHP remote file inclusion vulnerabilities. An attacker can cause remote code execution by supplying a URL via the mosConfig_absolute_path parameter to either wp-comments-post.php or wp-trackback.php. The issue is documented across mul...

CVE-2009-4780

CVE-2009-4780 affects phpMyFAQ

CVE-2009-4779

CVE-2009-4779 affects NukeHall 0.3 and earlier. The vulnerability is a PHP remote file inclusion in the spaw_root parameter to admin/modules/ (blocks.php, messages.php, stories.php), allowing an attacker to execute arbitrary PHP code. The issue is caused by unsafely including a URL supplied by th...

CVE-2009-4786

Pligg before version 1.0.3 is vulnerable to multiple cross-site scripting (XSS) flaws via the HTTP Referer header in eight endpoints (admin_config.php, admin_modules.php, delete.php, editlink.php, submit.php, submit_groups.php, user_add_remove_links.php, user_settings.php). The issue allows remot...

CVE-2009-4785

The CVE-2009-4785 entry concerns a SQL injection vulnerability in the Joomla! Quick News (com_quicknews) component. The flaw allows remote attackers to inject arbitrary SQL commands through the newsid parameter in the view_item action to index.php. Multiple connected sources (Red Hat advisory, NV...

CVE-2009-4774

Summary: CVE-2009-4774 affects Sun Solaris 10 and OpenSolaris snv_49–snv_117 when running in 64-bit mode on x86 with a Linux (lx) branded zone, enabling local users to trigger a denial of service (panic) via unspecified vectors. The issue is related to a prior CVE-2007-6225 family and is document...

CVE-2009-4778

CVE-2009-4778 affects Research In Motion/BlackBerry BES and BlackBerry Professional Software, where the PDF distiller in the Attachment Service is vulnerable to user‑assisted remote exploitation via a crafted PDF file attachment. The issue enables a denial of service (memory corruption) and poten...

CVE-2009-4780

Multiple cross-site scripting XSS vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via 1 the lang parameter in a sitemap action, 2 the search parameter in a search action, 3 the taggingid parameter in a search action, 4 the...

CVE-2009-4777

Hitachi JP1 products (Automatic Job Management System 2 - View, JP1/Integrated Management - View, and JP1/Cm2/SNMP System Observer) are affected by a GIF file processing vulnerability. A remote attacker can trigger a denial of service via processing an invalid GIF file, causing an abnormal termin...