# CVEs published 2009-07-10

17 CVEs were published on July 10, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2334](https://cve.now/CVE-2009-2334.md): wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of (no CVSS)
- [CVE-2009-2335](https://cve.now/CVE-2009-2335.md): WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, (no CVSS)
- [CVE-2009-2336](https://cve.now/CVE-2009-2336.md): The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whet (no CVSS)
- [CVE-2009-2431](https://cve.now/CVE-2009-2431.md): WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by (no CVSS)
- [CVE-2009-2432](https://cve.now/CVE-2009-2432.md): WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, whic (no CVSS)
- [CVE-2009-2433](https://cve.now/CVE-2009-2433.md): Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (a (no CVSS)
- [CVE-2009-2423](https://cve.now/CVE-2009-2423.md): SQL injection vulnerability in category.php in Ebay Clone 2009 allows remote attackers to execute arbitrary SQL commands via the cate\_id par (no CVSS)
- [CVE-2009-2424](https://cve.now/CVE-2009-2424.md): Cross-site scripting (XSS) vulnerability in search.php in Ebay Clone 2009 allows remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-2425](https://cve.now/CVE-2009-2425.md): Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor. (no CVSS)
- [CVE-2009-2426](https://cve.now/CVE-2009-2426.md): The connection\_edge\_process\_relay\_cell\_not\_open function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x before 0.1.2.8-beta allows (no CVSS)
- [CVE-2009-2427](https://cve.now/CVE-2009-2427.md): SQL injection vulnerability in co-profile.php in Jobbr 2.2.7 allows remote attackers to execute arbitrary SQL commands via the emp\_id parame (no CVSS)
- [CVE-2009-2428](https://cve.now/CVE-2009-2428.md): Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the (1) userid (no CVSS)
- [CVE-2009-2429](https://cve.now/CVE-2009-2429.md): SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in admin\_backup.xml files and uses insecure permissions for t (no CVSS)
- [CVE-2009-2430](https://cve.now/CVE-2009-2430.md): Unspecified vulnerability in auditconfig in Sun Solaris 8, 9, 10, and OpenSolaris snv\_01 through snv\_58, when Solaris Auditing is enabled, a (no CVSS)
- [CVE-2009-1891](https://cve.now/CVE-2009-1891.md): The mod\_deflate module in Apache httpd 2.2.11 and earlier compresses large files until completion even after the associated network connecti (no CVSS)
- [CVE-2009-2386](https://cve.now/CVE-2009-2386.md): Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attac (no CVSS)
- [CVE-2009-2422](https://cve.now/CVE-2009-2422.md): The example code for the digest authentication functionality (http\_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate\_ (no CVSS, rails)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-07-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.