# CVEs published 2009-06-23

18 CVEs were published on June 23, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-0690](https://cve.now/CVE-2009-0690.md): The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a negative value (no CVSS)
- [CVE-2009-0691](https://cve.now/CVE-2009-0691.md): The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for Foxit Reader 3.0 before Build 1817 does not properly handle a fatal error du (no CVSS)
- [CVE-2009-2121](https://cve.now/CVE-2009-2121.md): Buffer overflow in the browser kernel in Google Chrome before 2.0.172.33 allows remote HTTP servers to cause a denial of service (applicatio (no CVSS)
- [CVE-2009-2172](https://cve.now/CVE-2009-2172.md): Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows remote registered use (no CVSS)
- [CVE-2009-2173](https://cve.now/CVE-2009-2173.md): The LAN game feature in Carom3D 5.06 allows remote authenticated users to cause a denial of service (application hang) via a crafted HTTP re (no CVSS)
- [CVE-2009-2174](https://cve.now/CVE-2009-2174.md): GUPnP 0.12.7 allows remote attackers to cause a denial of service (crash) via an empty (1) subscription or (2) control message. (no CVSS)
- [CVE-2009-2175](https://cve.now/CVE-2009-2175.md): Stack-based buffer overflow in the flattenIncrementally function in flatten.c in xcftools 1.0.4, as reachable from the (1) xcf2pnm and (2) x (no CVSS)
- [CVE-2009-2176](https://cve.now/CVE-2009-2176.md): Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic\_quotes\_gpc is disabled, allow remote attackers (no CVSS)
- [CVE-2009-2177](https://cve.now/CVE-2009-2177.md): code/display.php in fuzzylime (cms) 3.03a and earlier, when magic\_quotes\_gpc is disabled, allows remote attackers to conduct directory trave (no CVSS)
- [CVE-2009-2178](https://cve.now/CVE-2009-2178.md): Cross-site scripting (XSS) vulnerability in website.php in phpDatingClub 3.7 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-2179](https://cve.now/CVE-2009-2179.md): SQL injection vulnerability in search.php in phpDatingClub 3.7 allows remote attackers to execute arbitrary SQL commands via the sform\[day\] (no CVSS)
- [CVE-2009-2180](https://cve.now/CVE-2009-2180.md): Multiple directory traversal vulnerabilities in upfiles/index.php in Pc4 Uploader 10.0 and earlier allow remote attackers to read arbitrary (no CVSS)
- [CVE-2009-2181](https://cve.now/CVE-2009-2181.md): Cross-site scripting (XSS) vulnerability in admin-files/templates/list\_dir.php in Campsite 3.3.0 RC1 allows remote attackers to inject arbit (no CVSS)
- [CVE-2009-2182](https://cve.now/CVE-2009-2182.md): Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2009-2183](https://cve.now/CVE-2009-2183.md): Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary (no CVSS)
- [CVE-2009-2184](https://cve.now/CVE-2009-2184.md): Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files v (no CVSS)
- [CVE-2009-2170](https://cve.now/CVE-2009-2170.md): Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0 before 1.0.12 and 1.1 before 1.1.5 allow remote attackers to inject arbitr (no CVSS)
- [CVE-2009-2171](https://cve.now/CVE-2009-2171.md): Mahara 1.1 before 1.1.5 does not apply permission checks when saving a view that contains artefacts, which allows remote authenticated users (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-06-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.