# CVEs published 2009-06-16 18 CVEs were published on June 16, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-1389](https://cve.now/CVE-2009-1389.md): Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial (no CVSS) - [CVE-2009-1391](https://cve.now/CVE-2009-1391.md): Off-by-one error in the inflate function in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017, as used in AMaViS, SpamAssassin, and po (no CVSS) - [CVE-2009-1719](https://cve.now/CVE-2009-1719.md): The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to (no CVSS) - [CVE-2009-1761](https://cve.now/CVE-2009-1761.md): The message engine in CA ARCserve Backup r12.0 and r12.0 SP1 for Windows allows remote attackers to cause a denial of service (crash) via (1 (no CVSS) - [CVE-2009-2084](https://cve.now/CVE-2009-2084.md): Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1 (no CVSS) - [CVE-2008-5515](https://cve.now/CVE-2008-5515.md): Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname (no CVSS, org.apache.tomcat:tomcat) - [CVE-2009-1390](https://cve.now/CVE-2009-1390.md): Mutt 1.5.19, when linked against (1) OpenSSL (mutt\_ssl.c) or (2) GnuTLS (mutt\_ssl\_gnutls.c), allows connections when only one TLS certificat (no CVSS) - [CVE-2009-2011](https://cve.now/CVE-2009-2011.md): Worldweaver DX Studio Player 3.0.29.0, 3.0.22.0, 3.0.12.0, and probably other versions before 3.0.29.1, when used as a plug-in for Firefox, (no CVSS) - [CVE-2009-2082](https://cve.now/CVE-2009-2082.md): SQL injection vulnerability in insidepage.php in Creative Web Solutions Multi-Level CMS 1.21 allows remote attackers to execute arbitrary SQ (no CVSS) - [CVE-2009-2083](https://cve.now/CVE-2009-2083.md): Cross-site scripting (XSS) vulnerability in the term data detail page in Taxonomy manager 5.x before 5.x-1.2, a module for Drupal, allows re (no CVSS) - [CVE-2009-2074](https://cve.now/CVE-2009-2074.md): Cross-site scripting (XSS) vulnerability in Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, allows remote authenti (no CVSS) - [CVE-2009-2075](https://cve.now/CVE-2009-2075.md): Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, does not properly restrict access when displaying node titles, whi (no CVSS) - [CVE-2009-2076](https://cve.now/CVE-2009-2076.md): Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbit (no CVSS) - [CVE-2009-2077](https://cve.now/CVE-2009-2077.md): Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and (1) read unpublished con (no CVSS) - [CVE-2009-2078](https://cve.now/CVE-2009-2078.md): Multiple cross-site scripting (XSS) vulnerabilities in Booktree 5.x before 5.x-7.3 and 6.x before 6.x-1.1, a module for Drupal, allow remote (no CVSS) - [CVE-2009-2079](https://cve.now/CVE-2009-2079.md): Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, (no CVSS) - [CVE-2009-2080](https://cve.now/CVE-2009-2080.md): admin.php in MRCGIGUY The Ticket System 2.0 does not properly restrict access, which allows remote attackers to (1) obtain sensitive configu (no CVSS) - [CVE-2009-2081](https://cve.now/CVE-2009-2081.md): Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-06-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.