# CVEs published 2009-08-11

22 CVEs were published on August 11, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-6928](https://cve.now/CVE-2008-6928.md): Unrestricted file upload vulnerability in PHPStore Complete Classifieds allows remote authenticated users to execute arbitrary code by uploa (no CVSS)
- [CVE-2008-6929](https://cve.now/CVE-2008-6929.md): Unrestricted file upload vulnerability in PHPStore Auto Classifieds allows remote authenticated users to execute arbitrary code by uploading (no CVSS)
- [CVE-2008-6930](https://cve.now/CVE-2008-6930.md): Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary code by uploading a fi (no CVSS)
- [CVE-2008-6931](https://cve.now/CVE-2008-6931.md): Unrestricted file upload vulnerability in PHPStore Job Search (aka PHPCareers) allows remote authenticated users to execute arbitrary code b (no CVSS)
- [CVE-2008-6932](https://cve.now/CVE-2008-6932.md): Unrestricted file upload vulnerability in submit\_file.php in AlstraSoft SendIt Pro allows remote attackers to execute arbitrary code by uplo (no CVSS)
- [CVE-2008-6933](https://cve.now/CVE-2008-6933.md): Directory traversal vulnerability in index.php in MiniGal b13 (aka MG2) allows remote attackers to read the source code of .php files, and p (no CVSS)
- [CVE-2008-6934](https://cve.now/CVE-2008-6934.md): Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script, when downloaded before 20081111, al (no CVSS)
- [CVE-2008-6935](https://cve.now/CVE-2008-6935.md): Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary file (no CVSS)
- [CVE-2008-6936](https://cve.now/CVE-2008-6936.md): Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary file (no CVSS)
- [CVE-2008-6937](https://cve.now/CVE-2008-6937.md): Argument injection vulnerability in Exodus 0.10 allows remote attackers to inject arbitrary command line arguments, overwrite arbitrary file (no CVSS)
- [CVE-2008-6938](https://cve.now/CVE-2008-6938.md): Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote att (no CVSS)
- [CVE-2009-1885](https://cve.now/CVE-2009-1885.md): Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to (no CVSS)
- [CVE-2009-2414](https://cve.now/CVE-2009-2414.md): Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers (no CVSS)
- [CVE-2009-2416](https://cve.now/CVE-2009-2416.md): Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent at (CVSS 6.5)
- [CVE-2009-2738](https://cve.now/CVE-2009-2738.md): Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication (no CVSS)
- [CVE-2009-2739](https://cve.now/CVE-2009-2739.md): Cross-site scripting (XSS) vulnerability in FreeNAS before 0.69.2 allows remote attackers to inject arbitrary web script or HTML via unknown (no CVSS)
- [CVE-2009-0687](https://cve.now/CVE-2009-0687.md): The pf\_test\_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, an (no CVSS)
- [CVE-2009-2704](https://cve.now/CVE-2009-2704.md): CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing a %00 (no CVSS)
- [CVE-2009-2705](https://cve.now/CVE-2009-2705.md): CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing non-ca (no CVSS)
- [CVE-2009-2735](https://cve.now/CVE-2009-2735.md): SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to execute a (no CVSS)
- [CVE-2009-2736](https://cve.now/CVE-2009-2736.md): Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary P (no CVSS)
- [CVE-2009-2737](https://cve.now/CVE-2009-2737.md): The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly c (no CVSS, roundup)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.