# CVEs published 2009-08-12

43 CVEs were published on August 12, 2009: 1 critical, 1 high. Days are UTC.

- [CVE-2009-2195](https://cve.now/CVE-2009-2195.md): Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (appli (no CVSS)
- [CVE-2009-2196](https://cve.now/CVE-2009-2196.md): Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and (no CVSS)
- [CVE-2009-2199](https://cve.now/CVE-2009-2199.md): Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod (no CVSS)
- [CVE-2009-2200](https://cve.now/CVE-2009-2200.md): WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows (no CVSS)
- [CVE-2009-0562](https://cve.now/CVE-2009-0562.md): The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Compone (no CVSS)
- [CVE-2009-1133](https://cve.now/CVE-2009-1133.md): Heap-based buffer overflow in Microsoft Remote Desktop Connection (formerly Terminal Services Client) running RDP 5.0 through 6.1 on Windows (no CVSS)
- [CVE-2009-1534](https://cve.now/CVE-2009-1534.md): Buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2000 Web Components SP3, Office XP Web Compo (no CVSS)
- [CVE-2009-1536](https://cve.now/CVE-2009-1536.md): ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not prope (no CVSS)
- [CVE-2009-1544](https://cve.now/CVE-2009-1544.md): Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted (CVSS 8.8)
- [CVE-2009-1545](https://cve.now/CVE-2009-1545.md): Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Se (no CVSS)
- [CVE-2009-1546](https://cve.now/CVE-2009-1546.md): Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute ar (no CVSS)
- [CVE-2009-1922](https://cve.now/CVE-2009-1922.md): The Message Queuing (aka MSMQ) service for Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP2, and Vista Gold does not properly validate un (no CVSS)
- [CVE-2009-1923](https://cve.now/CVE-2009-1923.md): Heap-based buffer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 and Server 2003 SP2 allows r (no CVSS)
- [CVE-2009-1924](https://cve.now/CVE-2009-1924.md): Integer overflow in the Windows Internet Name Service (WINS) component for Microsoft Windows 2000 SP4 allows remote WINS replication partner (no CVSS)
- [CVE-2009-1929](https://cve.now/CVE-2009-1929.md): Heap-based buffer overflow in the Microsoft Terminal Services Client ActiveX control running RDP 6.1 on Windows XP SP2, Vista SP1 or SP2, or (no CVSS)
- [CVE-2009-1930](https://cve.now/CVE-2009-1930.md): The Telnet service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 al (no CVSS)
- [CVE-2009-2494](https://cve.now/CVE-2009-2494.md): The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 (CVSS 9.8)
- [CVE-2009-2496](https://cve.now/CVE-2009-2496.md): Heap-based buffer overflow in the Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Component (no CVSS)
- [CVE-2008-6939](https://cve.now/CVE-2008-6939.md): TurnkeyForms Web Hosting Directory allows remote attackers to bypass authentication and (1) gain administrative privileges by setting the ad (no CVSS)
- [CVE-2008-6940](https://cve.now/CVE-2008-6940.md): TurnkeyForms Web Hosting Directory stores sensitive information under the web root with insufficient access control, which allows remote att (no CVSS)
- [CVE-2008-6941](https://cve.now/CVE-2008-6941.md): SQL injection vulnerability in the login functionality in TurnkeyForms Web Hosting Directory allows remote attackers to execute arbitrary SQ (no CVSS)
- [CVE-2008-6942](https://cve.now/CVE-2008-6942.md): Unrestricted file upload vulnerability in ScriptsFeed Realtor Classifieds System (aka Real Estate Classifieds) allows remote authenticated u (no CVSS)
- [CVE-2008-6943](https://cve.now/CVE-2008-6943.md): Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing Portal allows remote authenticated users to execute arbitrary code by (no CVSS)
- [CVE-2008-6944](https://cve.now/CVE-2008-6944.md): Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds allows remote authenticated users to execute arbitrary code by upload (no CVSS)
- [CVE-2008-6945](https://cve.now/CVE-2008-6945.md): Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote att (no CVSS)
- [CVE-2008-6946](https://cve.now/CVE-2008-6946.md): Cross-site scripting (XSS) vulnerability in manageproject.php in Collabtive 0.4.8 allows user-assisted remote attackers to inject arbitrary (no CVSS)
- [CVE-2008-6947](https://cve.now/CVE-2008-6947.md): Collabtive 0.4.8 allows remote attackers to bypass authentication and create new users, including administrators, via unspecified vectors as (no CVSS)
- [CVE-2008-6948](https://cve.now/CVE-2008-6948.md): Unrestricted file upload vulnerability in Collabtive 0.4.8 allows remote authenticated users to execute arbitrary code by uploading a file w (no CVSS)
- [CVE-2008-6949](https://cve.now/CVE-2008-6949.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Collabtive 0.4.8 allow remote attackers to hijack the authentication of admini (no CVSS)
- [CVE-2008-6950](https://cve.now/CVE-2008-6950.md): Multiple SQL injection vulnerabilities in login.asp in Bankoi WebHosting Control Panel 1.20 allow remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2008-6951](https://cve.now/CVE-2008-6951.md): MauryCMS 0.53.2 and earlier does not require administrative authentication for Editors/fckeditor/editor/filemanager/browser/default/browser. (no CVSS)
- [CVE-2008-6952](https://cve.now/CVE-2008-6952.md): SQL injection vulnerability in Rss.php in MauryCMS 0.53.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c pa (no CVSS)
- [CVE-2008-6953](https://cve.now/CVE-2008-6953.md): Buffer overflow in oovoo.exe in ooVoo 1.7.1.35, and possibly other versions before 1.7.1.59, allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2008-6954](https://cve.now/CVE-2008-6954.md): The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by edi (no CVSS, cobbler)
- [CVE-2008-6955](https://cve.now/CVE-2008-6955.md): mxCamArchive 2.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain c (no CVSS)
- [CVE-2008-6956](https://cve.now/CVE-2008-6956.md): Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PH (no CVSS)
- [CVE-2008-6957](https://cve.now/CVE-2008-6957.md): member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted (1) lostpasswd and (2) getpas (no CVSS)
- [CVE-2008-6958](https://cve.now/CVE-2008-6958.md): wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote authenticated users to execute arbitrary PHP code via the creditsformula p (no CVSS)
- [CVE-2008-6959](https://cve.now/CVE-2008-6959.md): Insecure method vulnerability in the Chilkat Socket ActiveX control (ChilkatSocket.ChilkatSocket.1) in ChilkatSocket.dll 2.3.1.1 allows remo (no CVSS)
- [CVE-2008-6960](https://cve.now/CVE-2008-6960.md): download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an enc (no CVSS)
- [CVE-2009-1427](https://cve.now/CVE-2009-1427.md): Unspecified vulnerability in HP-UX B.11.31 allows local users to cause a denial of service (system crash) via unknown vectors related to the (no CVSS)
- [CVE-2009-2726](https://cve.now/CVE-2009-2726.md): The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1 (no CVSS)
- [CVE-2009-2730](https://cve.now/CVE-2009-2730.md): libgnutls in GnuTLS before 2.8.2 does not properly handle a '\\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Sub (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.