# CVEs published 2009-07-05

28 CVEs were published on July 5, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2007-6727](https://cve.now/CVE-2007-6727.md): SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum param (no CVSS)
- [CVE-2007-6728](https://cve.now/CVE-2007-6728.md): Cross-site scripting (XSS) vulnerability in XMB 1.5 allows remote attackers to inject arbitrary web script or HTML via the MSN field during (no CVSS)
- [CVE-2009-0904](https://cve.now/CVE-2009-0904.md): The IBM Stax XMLStreamWriter in the Web Services component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 does not properly p (no CVSS)
- [CVE-2009-1388](https://cve.now/CVE-2009-1388.md): The ptrace\_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do\_coredump f (no CVSS)
- [CVE-2009-1648](https://cve.now/CVE-2009-1648.md): The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstan (no CVSS)
- [CVE-2009-1890](https://cve.now/CVE-2009-1890.md): The stream\_reqbody\_cl function in mod\_proxy\_http.c in the mod\_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is c (no CVSS)
- [CVE-2009-2265](https://cve.now/CVE-2009-2265.md): Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary dire (no CVSS)
- [CVE-2009-2294](https://cve.now/CVE-2009-2294.md): Integer overflow in the Png\_datainfo\_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) (no CVSS)
- [CVE-2009-2295](https://cve.now/CVE-2009-2295.md): Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG (no CVSS)
- [CVE-2009-2314](https://cve.now/CVE-2009-2314.md): Race condition in the Sun Lightweight Availability Collection Tool 3.0 on Solaris 7 through 10 allows local users to overwrite arbitrary fil (no CVSS)
- [CVE-2009-2316](https://cve.now/CVE-2009-2316.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2009-2317](https://cve.now/CVE-2009-2317.md): The Axesstel MV 410R has a certain default administrator password, and does not force a password change, which makes it easier for remote at (no CVSS)
- [CVE-2009-2318](https://cve.now/CVE-2009-2318.md): The Axesstel MV 410R allows remote attackers to cause a denial of service via a flood of SYN packets, a related issue to CVE-1999-0116. (no CVSS)
- [CVE-2009-2319](https://cve.now/CVE-2009-2319.md): The default configuration of the Wi-Fi component on the Axesstel MV 410R does not use encryption, which makes it easier for remote attackers (no CVSS)
- [CVE-2009-2320](https://cve.now/CVE-2009-2320.md): The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send cra (no CVSS)
- [CVE-2009-2321](https://cve.now/CVE-2009-2321.md): cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service (configuration reset) via a RESTORE=RESTORE (no CVSS)
- [CVE-2009-2322](https://cve.now/CVE-2009-2322.md): Cross-site scripting (XSS) vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2009-2323](https://cve.now/CVE-2009-2323.md): The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it eas (no CVSS)
- [CVE-2009-2324](https://cve.now/CVE-2009-2324.md): Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2009-2325](https://cve.now/CVE-2009-2325.md): Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-2326](https://cve.now/CVE-2009-2326.md): Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) an (no CVSS)
- [CVE-2009-2327](https://cve.now/CVE-2009-2327.md): Cross-site scripting (XSS) vulnerability in add\_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arb (no CVSS)
- [CVE-2009-2328](https://cve.now/CVE-2009-2328.md): admin/edit\_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delet (no CVSS)
- [CVE-2009-2329](https://cve.now/CVE-2009-2329.md): KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) admin/head.php, or (2) vo (no CVSS)
- [CVE-2009-2330](https://cve.now/CVE-2009-2330.md): Cross-site scripting (XSS) vulnerability in admin/admin\_menu.php in CMS Chainuk 1.2 and earlier allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2009-2331](https://cve.now/CVE-2009-2331.md): Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into s (no CVSS)
- [CVE-2009-2332](https://cve.now/CVE-2009-2332.md): CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to index.php or (2) a non (no CVSS)
- [CVE-2009-2333](https://cve.now/CVE-2009-2333.md): Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local fi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-07-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.