# CVEs published 2009-07-07

27 CVEs were published on July 7, 2009: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2008-0015](https://cve.now/CVE-2008-0015.md): Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques (CVSS 8.8, KEV)
- [CVE-2008-0020](https://cve.now/CVE-2008-0020.md): Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL), as used in the Micros (no CVSS)
- [CVE-2009-2350](https://cve.now/CVE-2009-2350.md): Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows rem (no CVSS)
- [CVE-2009-2351](https://cve.now/CVE-2009-2351.md): Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross- (no CVSS)
- [CVE-2009-2352](https://cve.now/CVE-2009-2352.md): Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to (no CVSS)
- [CVE-2009-2353](https://cve.now/CVE-2009-2353.md): encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web (no CVSS)
- [CVE-2009-2354](https://cve.now/CVE-2009-2354.md): SQL injection vulnerability in the auth\_checkpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute (no CVSS)
- [CVE-2009-2355](https://cve.now/CVE-2009-2355.md): The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifyi (no CVSS)
- [CVE-2009-2356](https://cve.now/CVE-2009-2356.md): Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote a (no CVSS)
- [CVE-2009-2357](https://cve.now/CVE-2009-2357.md): The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote at (no CVSS)
- [CVE-2009-2358](https://cve.now/CVE-2009-2358.md): TekRADIUS 3.0 uses BUILTIN\\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credential (no CVSS)
- [CVE-2009-2359](https://cve.now/CVE-2009-2359.md): Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI (no CVSS)
- [CVE-2009-2339](https://cve.now/CVE-2009-2339.md): SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via the product parameter. (no CVSS)
- [CVE-2009-2340](https://cve.now/CVE-2009-2340.md): SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName (a (no CVSS)
- [CVE-2009-2341](https://cve.now/CVE-2009-2341.md): SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the albumid parame (no CVSS)
- [CVE-2009-2342](https://cve.now/CVE-2009-2342.md): Cross-site scripting (XSS) vulnerability in admin.php (aka the login page) in Content Management Made Easy (CMME) before 1.22 allows remote (no CVSS)
- [CVE-2009-2343](https://cve.now/CVE-2009-2343.md): Cross-site scripting (XSS) vulnerability in people.php in Zoph before 0.7.0.6 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-2344](https://cve.now/CVE-2009-2344.md): The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain pr (no CVSS)
- [CVE-2009-2345](https://cve.now/CVE-2009-2345.md): Multiple SQL injection vulnerabilities in ClanSphere before 2009.0.1 allow remote attackers to execute arbitrary SQL commands via unknown pa (no CVSS)
- [CVE-2008-6848](https://cve.now/CVE-2008-6848.md): Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2008-6849](https://cve.now/CVE-2008-6849.md): Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PHP code by uploading (no CVSS)
- [CVE-2008-6850](https://cve.now/CVE-2008-6850.md): Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2008-6851](https://cve.now/CVE-2008-6851.md): SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register\_globals is enabled and magic\_quotes\_gpc is disabled (no CVSS)
- [CVE-2008-6852](https://cve.now/CVE-2008-6852.md): SQL injection vulnerability in the Ice Gallery (com\_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2008-6853](https://cve.now/CVE-2008-6853.md): SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-2337](https://cve.now/CVE-2009-2337.md): SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magic\_quotes\_gpc is dis (no CVSS)
- [CVE-2009-2338](https://cve.now/CVE-2009-2338.md): Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register\_globals is enabled, allows rem (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.