# CVEs published 2009-08-31

28 CVEs were published on August 31, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2944](https://cve.now/CVE-2009-2944.md): Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent… (no CVSS)
- [CVE-2009-3021](https://cve.now/CVE-2009-3021.md): Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package… (no CVSS)
- [CVE-2009-3022](https://cve.now/CVE-2009-3022.md): Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other… (CVSS 6.5)
- [CVE-2009-3023](https://cve.now/CVE-2009-3023.md): Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to… (no CVSS)
- [CVE-2009-3024](https://cve.now/CVE-2009-3024.md): The verify\_hostname\_of\_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches… (no CVSS)
- [CVE-2009-3025](https://cve.now/CVE-2009-3025.md): Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM. (no CVSS)
- [CVE-2009-3026](https://cve.now/CVE-2009-3026.md): protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when… (no CVSS)
- [CVE-2009-3010](https://cve.now/CVE-2009-3010.md): Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block… (no CVSS)
- [CVE-2009-3011](https://cve.now/CVE-2009-3011.md): Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in… (no CVSS)
- [CVE-2009-3012](https://cve.now/CVE-2009-3012.md): Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP… (no CVSS)
- [CVE-2009-3013](https://cve.now/CVE-2009-3013.md): Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which… (no CVSS)
- [CVE-2009-3014](https://cve.now/CVE-2009-3014.md): Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly… (no CVSS)
- [CVE-2009-3015](https://cve.now/CVE-2009-3015.md): QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which… (no CVSS)
- [CVE-2009-3016](https://cve.now/CVE-2009-3016.md): Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers… (no CVSS)
- [CVE-2009-3017](https://cve.now/CVE-2009-3017.md): Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote… (no CVSS)
- [CVE-2009-3018](https://cve.now/CVE-2009-3018.md): Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses… (no CVSS)
- [CVE-2009-3019](https://cve.now/CVE-2009-3019.md): Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2009-3020](https://cve.now/CVE-2009-3020.md): win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a… (no CVSS)
- [CVE-2008-7122](https://cve.now/CVE-2008-7122.md): Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers… (no CVSS)
- [CVE-2008-7123](https://cve.now/CVE-2008-7123.md): Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject… (no CVSS)
- [CVE-2008-7124](https://cve.now/CVE-2008-7124.md): zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote… (no CVSS)
- [CVE-2008-7125](https://cve.now/CVE-2008-7125.md): pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors… (no CVSS)
- [CVE-2008-7126](https://cve.now/CVE-2008-7126.md): Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2008-7127](https://cve.now/CVE-2008-7127.md): osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via… (no CVSS)
- [CVE-2008-7128](https://cve.now/CVE-2008-7128.md): The ssl\_parse\_client\_key\_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen… (no CVSS)
- [CVE-2008-7129](https://cve.now/CVE-2008-7129.md): XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA… (no CVSS)
- [CVE-2008-7130](https://cve.now/CVE-2008-7130.md): Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors. (no CVSS)
- [CVE-2008-7131](https://cve.now/CVE-2008-7131.md): Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2009-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.