# CVEs published 2009-08-03

18 CVEs were published on August 3, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6892](https://cve.now/CVE-2008-6892.md): SQL injection vulnerability in lire/index.php in Peel 3.1 allows remote attackers to execute arbitrary SQL commands via the rubid parameter. (no CVSS)
- [CVE-2008-6893](https://cve.now/CVE-2008-6893.md): Cross-site scripting (XSS) vulnerability in Alt-N MDaemon WorldClient 10.0.2, when Internet Explorer 7 is used, allows remote attackers to i (no CVSS)
- [CVE-2008-6894](https://cve.now/CVE-2008-6894.md): Multiple cross-site scripting (XSS) vulnerabilities in login.php in 3CX Phone System Free Edition 6.1793 and 6.0.806.0 allow remote attacker (no CVSS)
- [CVE-2008-6895](https://cve.now/CVE-2008-6895.md): 3CX Phone System 6.0.806.0 allows remote attackers to cause a denial of service (unstable service or crash) via unspecified vectors, as demo (no CVSS)
- [CVE-2008-6896](https://cve.now/CVE-2008-6896.md): login.php in 3CX Phone System 6.0.806.0, when 100% disk capacity is reached, allows remote attackers to gain sensitive information via unspe (no CVSS)
- [CVE-2009-2204](https://cve.now/CVE-2009-2204.md): Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, (no CVSS)
- [CVE-2009-2656](https://cve.now/CVE-2009-2656.md): Unspecified vulnerability in the com.android.phone process in Android 1.0, 1.1, and 1.5 allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2008-6886](https://cve.now/CVE-2008-6886.md): RSA EnVision 3.5.0, 3.5.1, 3.5.2, and 3.7.0 does not properly restrict access to unspecified user profile functionality, which allows remote (no CVSS)
- [CVE-2008-6887](https://cve.now/CVE-2008-6887.md): SQL injection vulnerability in detailad.asp in Pre Classified Listings 1.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-6888](https://cve.now/CVE-2008-6888.md): Cross-site scripting (XSS) vulnerability in signup.asp in Pre Classified Listings 1.0 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2008-6889](https://cve.now/CVE-2008-6889.md): SQL injection vulnerability in Merchantsadd.asp in ASPReferral 5.3 allows remote attackers to execute arbitrary SQL commands via the Account (no CVSS)
- [CVE-2008-6890](https://cve.now/CVE-2008-6890.md): SQL injection vulnerability in messages.asp in ASP Forum Script allows remote attackers to execute arbitrary SQL commands via the message\_id (no CVSS)
- [CVE-2008-6891](https://cve.now/CVE-2008-6891.md): Multiple cross-site scripting (XSS) vulnerabilities in ASP Forum Script allow remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2009-2404](https://cve.now/CVE-2009-2404.md): Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thun (no CVSS)
- [CVE-2009-2652](https://cve.now/CVE-2009-2652.md): Unspecified vulnerability in Solaris Trusted Extensions in Sun Solaris 10, and OpenSolaris snv\_37 through snv\_120, allows remote attackers t (no CVSS)
- [CVE-2009-2653](https://cve.now/CVE-2009-2653.md): The NtUserConsoleControl function in win32k.sys in Microsoft Windows XP SP2 and SP3, and Server 2003 before SP1, allows local administrators (no CVSS)
- [CVE-2009-2654](https://cve.now/CVE-2009-2654.md): Mozilla Firefox before 3.0.13, and 3.5.x before 3.5.2, allows remote attackers to spoof the address bar, and possibly conduct phishing attac (no CVSS)
- [CVE-2009-2655](https://cve.now/CVE-2009-2655.md): mshtml.dll in Microsoft Internet Explorer 7 and 8 on Windows XP SP3 allows remote attackers to cause a denial of service (application crash) (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.