# CVEs published 2009-06-19 25 CVEs were published on June 19, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-2134](https://cve.now/CVE-2009-2134.md): pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals (no CVSS) - [CVE-2009-2135](https://cve.now/CVE-2009-2135.md): Multiple race conditions in the Solaris Event Port API in Sun Solaris 10 and OpenSolaris before snv\_107 allow local users to cause a denial (no CVSS) - [CVE-2009-2136](https://cve.now/CVE-2009-2136.md): Unspecified vulnerability in the TCP/IP networking stack in Sun Solaris 10, and OpenSolaris snv\_01 through snv\_82 and snv\_111 through snv\_11 (no CVSS) - [CVE-2009-2137](https://cve.now/CVE-2009-2137.md): Memory leak in the Ultra-SPARC T2 crypto provider device driver (aka n2cp) in Sun Solaris 10, and OpenSolaris snv\_54 through snv\_112, allows (no CVSS) - [CVE-2009-2138](https://cve.now/CVE-2009-2138.md): Multiple open redirect vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to redirect users to arbitrary web sites and conduct phi (no CVSS) - [CVE-2009-2122](https://cve.now/CVE-2009-2122.md): SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arb (no CVSS) - [CVE-2009-2123](https://cve.now/CVE-2009-2123.md): Multiple SQL injection vulnerabilities in Elvin 1.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) inUser (aka Usern (no CVSS) - [CVE-2009-2124](https://cve.now/CVE-2009-2124.md): Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute arbitrary local files via a .. (no CVSS) - [CVE-2009-2125](https://cve.now/CVE-2009-2125.md): delete\_bug.php in Elvin before 1.2.1 does not require administrative privileges, which allows remote authenticated users to bypass intended (no CVSS) - [CVE-2009-2126](https://cve.now/CVE-2009-2126.md): Cross-site scripting (XSS) vulnerability in close\_bug.php in Elvin before 1.2.1 allows remote attackers to inject arbitrary web script or HT (no CVSS) - [CVE-2009-2127](https://cve.now/CVE-2009-2127.md): Cross-site scripting (XSS) vulnerability in show\_activity.php in Elvin 1.2.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2009-2128](https://cve.now/CVE-2009-2128.md): SQL injection vulnerability in close\_bug.php in Elvin before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the title ( (no CVSS) - [CVE-2009-2129](https://cve.now/CVE-2009-2129.md): Cross-site request forgery (CSRF) vulnerability in login.php in Elvin 1.2.0 allows remote attackers to hijack the authentication of arbitrar (no CVSS) - [CVE-2009-2130](https://cve.now/CVE-2009-2130.md): Elvin 1.2.0 allows remote attackers to read the PHP source code of (1) login.ei, (2) jump\_bug.ei, or (3) create\_account.ei in inc/ via a dir (no CVSS) - [CVE-2009-2131](https://cve.now/CVE-2009-2131.md): Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HT (no CVSS) - [CVE-2009-2132](https://cve.now/CVE-2009-2132.md): Directory traversal vulnerability in global.php in 4images before 1.7.7, when magic\_quotes\_gpc is disabled, allows remote attackers to inclu (no CVSS) - [CVE-2009-2133](https://cve.now/CVE-2009-2133.md): Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7 allow remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2009-0958](https://cve.now/CVE-2009-0958.md): Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an (no CVSS) - [CVE-2009-0959](https://cve.now/CVE-2009-0959.md): The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause (no CVSS) - [CVE-2009-0960](https://cve.now/CVE-2009-0960.md): The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable (no CVSS) - [CVE-2009-0961](https://cve.now/CVE-2009-0961.md): The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog wh (no CVSS) - [CVE-2009-1679](https://cve.now/CVE-2009-1679.md): The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration (no CVSS) - [CVE-2009-1680](https://cve.now/CVE-2009-1680.md): Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when i (no CVSS) - [CVE-2009-1683](https://cve.now/CVE-2009-1683.md): The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause (no CVSS) - [CVE-2009-1692](https://cve.now/CVE-2009-1692.md): WebKit before r41741, as used in Apple iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Safari, and other software, (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-06-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.