# CVEs published 2009-06-05 25 CVEs were published on June 5, 2009: 1 critical, 0 high. Days are UTC. - [CVE-2008-6825](https://cve.now/CVE-2008-6825.md): Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute (no CVSS) - [CVE-2009-1943](https://cve.now/CVE-2009-1943.md): Stack-based buffer overflow in the IKE service (ireIke.exe) in SafeNet SoftRemote before 10.8.6 allows remote attackers to execute arbitrary (no CVSS) - [CVE-2009-1944](https://cve.now/CVE-2009-1944.md): Stack-based buffer overflow in AIMP 2.51 build 330 allows remote attackers to execute arbitrary code via an MP3 file with a long ID3 tag. (no CVSS) - [CVE-2009-1945](https://cve.now/CVE-2009-1945.md): SQL injection vulnerability in webCal3\_detail.asp in WebCal 3.04 allows remote attackers to execute arbitrary SQL commands via the event\_id (no CVSS) - [CVE-2009-1946](https://cve.now/CVE-2009-1946.md): PHP remote file inclusion vulnerability in latestposts.php in AdaptBB 1.0, when register\_globals is enabled, allows remote attackers to exec (no CVSS) - [CVE-2009-1947](https://cve.now/CVE-2009-1947.md): SQL injection vulnerability in the UnbDbEncode function in unb\_lib/database.lib.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote atta (no CVSS) - [CVE-2009-1948](https://cve.now/CVE-2009-1948.md): Multiple directory traversal vulnerabilities in forum.php in Unclassified NewsBoard (UNB) 1.6.4, when register\_globals is enabled and magic\_ (no CVSS) - [CVE-2009-1949](https://cve.now/CVE-2009-1949.md): import\_wbb1.php in Unclassified NewsBoard (UNB) 1.6.4 allows remote attackers to obtain sensitive information via a direct request, which re (no CVSS) - [CVE-2009-1950](https://cve.now/CVE-2009-1950.md): SQL injection vulnerability in yorum.asp in WebEyes Guest Book 3 allows remote attackers to execute arbitrary SQL commands via the mesajid p (no CVSS) - [CVE-2009-1951](https://cve.now/CVE-2009-1951.md): Cross-site scripting (XSS) vulnerability in index.php in PropertyMax Pro FREE 0.3 allows remote attackers to inject arbitrary web script or (no CVSS) - [CVE-2009-1952](https://cve.now/CVE-2009-1952.md): Multiple SQL injection vulnerabilities in the administrative login feature in PropertyMax Pro FREE 0.3, when magic\_quotes\_gpc is disabled, a (no CVSS) - [CVE-2009-1936](https://cve.now/CVE-2009-1936.md): \_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows re (CVSS 9.8) - [CVE-2009-1937](https://cve.now/CVE-2009-1937.md): Cross-site scripting (XSS) vulnerability in the comment posting feature in LightNEasy 2.2.1 "no database" (aka flat) and 2.2.2 SQLite allows (no CVSS) - [CVE-2009-1938](https://cve.now/CVE-2009-1938.md): Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitrary web script or HTML via (no CVSS) - [CVE-2009-1939](https://cve.now/CVE-2009-1939.md): Cross-site scripting (XSS) vulnerability in the JA\_Purity template for Joomla! 1.5.x through 1.5.10 allows remote attackers to inject arbitr (no CVSS) - [CVE-2009-1940](https://cve.now/CVE-2009-1940.md): Cross-site scripting (XSS) vulnerability in the administrator panel in the com\_users core component for Joomla! 1.5.x through 1.5.10 allows (no CVSS) - [CVE-2009-1941](https://cve.now/CVE-2009-1941.md): PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attacker (no CVSS) - [CVE-2009-1942](https://cve.now/CVE-2009-1942.md): Cross-site scripting (XSS) vulnerability in the Quiz module 5.x, 6.x-2.x before 6.x-2.2, and 6.x-3.x before 6.x-3.0, a module for Drupal, al (no CVSS) - [CVE-2009-0033](https://cve.now/CVE-2009-0033.md): Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod\_jk load balancing ar (no CVSS, org.apache.tomcat:tomcat) - [CVE-2009-0580](https://cve.now/CVE-2009-0580.md): Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attacker (no CVSS, org.apache.tomcat:tomcat) - [CVE-2009-0783](https://cve.now/CVE-2009-0783.md): Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used fo (no CVSS, org.apache.tomcat:tomcat) - [CVE-2009-1162](https://cve.now/CVE-2009-1162.md): Cross-site scripting (XSS) vulnerability in the Spam Quarantine login page in Cisco IronPort AsyncOS before 6.5.2 on Series C, M, and X appl (no CVSS) - [CVE-2009-1717](https://cve.now/CVE-2009-1717.md): Integer overflow in Terminal in Apple Mac OS X 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of ser (no CVSS) - [CVE-2009-1933](https://cve.now/CVE-2009-1933.md): Kerberos in Sun Solaris 8, 9, and 10, and OpenSolaris before snv\_117, does not properly manage credential caches, which allows local users t (no CVSS) - [CVE-2009-1934](https://cve.now/CVE-2009-1934.md): Cross-site scripting (XSS) vulnerability in the Reverse Proxy Plug-in in Sun Java System Web Server 6.1 before SP11 allows remote attackers (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-06-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.