# CVEs published 2009-07-01 25 CVEs were published on July 1, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2008-6840](https://cve.now/CVE-2008-6840.md): Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (no CVSS) - [CVE-2008-6841](https://cve.now/CVE-2008-6841.md): PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com\_dbquery) component 1 (no CVSS) - [CVE-2009-0689](https://cve.now/CVE-2009-0689.md): Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in (no CVSS) - [CVE-2009-1889](https://cve.now/CVE-2009-1889.md): The OSCAR protocol implementation in Pidgin before 2.5.8 misinterprets the ICQWebMessage message type as the ICQSMS message type, which allo (no CVSS) - [CVE-2009-2268](https://cve.now/CVE-2009-2268.md): Cross-site scripting (XSS) vulnerability in the Cross-Domain Controller (CDC) servlet in Sun Java System Access Manager 6 2005Q1, 7 2005Q4, (no CVSS) - [CVE-2009-2269](https://cve.now/CVE-2009-2269.md): SQL injection vulnerability in Empire CMS 5.1 allows remote attackers to execute arbitrary SQL commands via the bid parameter to the default (no CVSS) - [CVE-2009-2270](https://cve.now/CVE-2009-2270.md): Unrestricted file upload vulnerability in member/uploads\_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by upload (no CVSS) - [CVE-2009-2271](https://cve.now/CVE-2009-2271.md): The Huawei D100 has (1) a certain default administrator password for the web interface, and does not force a password change; and has (2) a (no CVSS) - [CVE-2009-2272](https://cve.now/CVE-2009-2272.md): The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows context-dependent attackers to o (no CVSS) - [CVE-2009-2273](https://cve.now/CVE-2009-2273.md): The default configuration of the Wi-Fi component on the Huawei D100 does not use encryption, which makes it easier for remote attackers to o (no CVSS) - [CVE-2009-2274](https://cve.now/CVE-2009-2274.md): The Huawei D100 allows remote attackers to obtain sensitive information via a direct request to (1) lan\_status\_adv.asp, (2) wlan\_basic\_cfg.a (no CVSS) - [CVE-2009-2275](https://cve.now/CVE-2009-2275.md): Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (no CVSS) - [CVE-2009-2276](https://cve.now/CVE-2009-2276.md): SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arb (no CVSS) - [CVE-2009-2282](https://cve.now/CVE-2009-2282.md): The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun Solaris 10, and OpenSolaris snv\_41 through snv\_108 (no CVSS) - [CVE-2009-2283](https://cve.now/CVE-2009-2283.md): Multiple cross-site scripting (XSS) vulnerabilities in the help jsp scripts in Sun Java Web Console 3.0.2 through 3.0.5, and Sun Java Web Co (no CVSS) - [CVE-2009-2284](https://cve.now/CVE-2009-2284.md): Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a c (no CVSS) - [CVE-2009-2285](https://cve.now/CVE-2009-2285.md): Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) vi (no CVSS) - [CVE-2009-2286](https://cve.now/CVE-2009-2286.md): Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in (no CVSS) - [CVE-2009-2287](https://cve.now/CVE-2009-2287.md): The kvm\_arch\_vcpu\_ioctl\_set\_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the (no CVSS) - [CVE-2009-2288](https://cve.now/CVE-2009-2288.md): statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) T (no CVSS) - [CVE-2009-2289](https://cve.now/CVE-2009-2289.md): Cross-site scripting (XSS) vulnerability in index.php in Arcade Trade Script 1.0 beta allows remote attackers to inject arbitrary web script (no CVSS) - [CVE-2009-2290](https://cve.now/CVE-2009-2290.md): SQL injection vulnerability in the Boy Scout Advancement (com\_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execut (no CVSS) - [CVE-2009-2291](https://cve.now/CVE-2009-2291.md): Unspecified vulnerability in LoginToboggan 6.x-1.x before 6.x-1.5, a module for Drupal, when "Allow users to login using their e-mail addres (no CVSS) - [CVE-2009-2292](https://cve.now/CVE-2009-2292.md): Cross-site scripting (XSS) vulnerability in Appleple a-News 2.32 allows remote attackers to inject arbitrary web script or HTML via unspecif (no CVSS) - [CVE-2009-2293](https://cve.now/CVE-2009-2293.md): Optimum Web Design Tutorial Share 3.5.0 and earlier allows remote attackers to bypass authentication and obtain administrative access by set (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-07-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.