# CVEs published 2009-06-22

31 CVEs were published on June 22, 2009: 1 critical, 0 high. Days are UTC.

- [CVE-2009-2169](https://cve.now/CVE-2009-2169.md): Insecure method vulnerability in the PDFVIEWER.PDFViewerCtrl.1 ActiveX control (pdfviewer.ocx) in Edraw PDF Viewer Component before 3.2.0.12 (no CVSS)
- [CVE-2008-6833](https://cve.now/CVE-2008-6833.md): Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary l (no CVSS)
- [CVE-2008-6834](https://cve.now/CVE-2008-6834.md): Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local (no CVSS)
- [CVE-2009-2163](https://cve.now/CVE-2009-2163.md): Cross-site scripting (XSS) vulnerability in login/default.aspx in Sitecore CMS before 6.0.2 Update-1 090507 allows remote attackers to injec (no CVSS)
- [CVE-2009-2164](https://cve.now/CVE-2009-2164.md): Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic\_quotes\_gpc is disabled, allow remote attackers to execute ar (no CVSS)
- [CVE-2009-2165](https://cve.now/CVE-2009-2165.md): SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, whi (no CVSS)
- [CVE-2009-2166](https://cve.now/CVE-2009-2166.md): Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2009-2167](https://cve.now/CVE-2009-2167.md): Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic\_quotes\_gpc is disabled, (no CVSS)
- [CVE-2009-2168](https://cve.now/CVE-2009-2168.md): cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier sends a redirect to the web browser but does not exit when the supplied crede (CVSS 9.8)
- [CVE-2009-2155](https://cve.now/CVE-2009-2155.md): Cross-site scripting (XSS) vulnerability in report/ReportViewAction.do in WebNMS Free Edition 5 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2009-2156](https://cve.now/CVE-2009-2156.md): Multiple cross-site scripting (XSS) vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to inject arbitrary web s (no CVSS)
- [CVE-2009-2157](https://cve.now/CVE-2009-2157.md): Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (no CVSS)
- [CVE-2009-2158](https://cve.now/CVE-2009-2158.md): account-recover.php in TorrentTrader Classic 1.09 chooses random passwords from an insufficiently large set, which makes it easier for remot (no CVSS)
- [CVE-2009-2159](https://cve.now/CVE-2009-2159.md): backup-database.php in TorrentTrader Classic 1.09 does not require administrative authentication, which allows remote attackers to create an (no CVSS)
- [CVE-2009-2160](https://cve.now/CVE-2009-2160.md): TorrentTrader Classic 1.09 allows remote attackers to (1) obtain configuration information via a direct request to phpinfo.php, which calls (no CVSS)
- [CVE-2009-2161](https://cve.now/CVE-2009-2161.md): Directory traversal vulnerability in backend/admin-functions.php in TorrentTrader Classic 1.09, when used on a case-insensitive web site, al (no CVSS)
- [CVE-2009-2162](https://cve.now/CVE-2009-2162.md): Cross-site scripting (XSS) vulnerability in the XOOPS MANIAC PukiWikiMod module 1.6.6.2 and earlier for XOOPS allows remote attackers to inj (no CVSS)
- [CVE-2009-2141](https://cve.now/CVE-2009-2141.md): Multiple cross-site scripting (XSS) vulnerabilities in TBDev.NET 01-01-08 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-2142](https://cve.now/CVE-2009-2142.md): Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execute arbitrary SQL comm (no CVSS)
- [CVE-2009-2143](https://cve.now/CVE-2009-2143.md): PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote a (no CVSS)
- [CVE-2009-2144](https://cve.now/CVE-2009-2144.md): SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2009-2145](https://cve.now/CVE-2009-2145.md): Multiple cross-site scripting (XSS) vulnerabilities in transLucid 1.75 allow remote attackers to inject arbitrary web script or HTML via the (no CVSS)
- [CVE-2009-2146](https://cve.now/CVE-2009-2146.md): Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5. (no CVSS)
- [CVE-2009-2147](https://cve.now/CVE-2009-2147.md): SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-2148](https://cve.now/CVE-2009-2148.md): SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id par (no CVSS)
- [CVE-2009-2149](https://cve.now/CVE-2009-2149.md): Multiple cross-site scripting (XSS) vulnerabilities in Campus Virtual-LMS allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-2150](https://cve.now/CVE-2009-2150.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Campus Virtual-LMS allow (1) remote attackers to hijack the authentication of (no CVSS)
- [CVE-2009-2151](https://cve.now/CVE-2009-2151.md): Directory traversal vulnerability in index.php in AdaptWeb 0.9.2 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-2152](https://cve.now/CVE-2009-2152.md): SQL injection vulnerability in a\_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands via the CodigoDiscipl (no CVSS)
- [CVE-2009-2153](https://cve.now/CVE-2009-2153.md): Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-2154](https://cve.now/CVE-2009-2154.md): SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic\_quotes\_gpc is disabled, allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-06-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.