# CVEs published 2009-08-13 25 CVEs were published on August 13, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2008-6973](https://cve.now/CVE-2008-6973.md): Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 before 6.0.0.7 have unknown impact and attack vectors. (no CVSS) - [CVE-2009-0906](https://cve.now/CVE-2009-0906.md): The Service Component Architecture (SCA) feature pack for IBM WebSphere Application Server (WAS) SCA 1.0 before 1.0.0.3 allows remote authen (no CVSS) - [CVE-2009-2085](https://cve.now/CVE-2009-2085.md): The Security component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5 does not properly handle use of (no CVSS) - [CVE-2009-2087](https://cve.now/CVE-2009-2087.md): The Web Services functionality in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, in certain circumstance (no CVSS) - [CVE-2009-2088](https://cve.now/CVE-2009-2088.md): The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when SPNEGO (no CVSS) - [CVE-2009-2089](https://cve.now/CVE-2009-2089.md): The Migration component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.25 and 7.0 before 7.0.0.5, when tracing is enabled and a (no CVSS) - [CVE-2009-2090](https://cve.now/CVE-2009-2090.md): Unspecified vulnerability in wsadmin in the System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0. (no CVSS) - [CVE-2009-2091](https://cve.now/CVE-2009-2091.md): The System Management/Repository component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 on z/OS uses weak file permissions f (no CVSS) - [CVE-2009-2092](https://cve.now/CVE-2009-2092.md): IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.5 does not properly read the portletServingEnabled parameter in ibm-portlet-ext.xmi, (no CVSS) - [CVE-2009-2093](https://cve.now/CVE-2009-2093.md): SQL injection vulnerability in the console in IBM WebSphere Partner Gateway (WPG) Enterprise 6.0 before FP8, 6.1 before FP3, 6.1.1 before FP (no CVSS) - [CVE-2009-2094](https://cve.now/CVE-2009-2094.md): Unspecified vulnerability in IBM WebSphere Commerce 6.0 Enterprise before 6.0.0.8, when trace is enabled, allows local users to obtain sensi (no CVSS) - [CVE-2008-6961](https://cve.now/CVE-2008-6961.md): mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before 1.1.13, when JavaScript is enabled in mail, allows remote attackers to (no CVSS) - [CVE-2008-6962](https://cve.now/CVE-2008-6962.md): Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, and AntiVir Personal - FREE allows local users to execute arbitrary cod (no CVSS) - [CVE-2008-6963](https://cve.now/CVE-2008-6963.md): admin.php in TurnkeyForms Text Link Sales allows remote attackers to bypass authentication and gain administrative privileges via a direct r (no CVSS) - [CVE-2008-6964](https://cve.now/CVE-2008-6964.md): SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows remote attackers to execute arbitrary SQL commands via the password fi (no CVSS) - [CVE-2008-6965](https://cve.now/CVE-2008-6965.md): AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, and Web 2.0 send a redirect but do not exit when certain scripts are (no CVSS) - [CVE-2008-6966](https://cve.now/CVE-2008-6966.md): AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does not exit when it is called directly, which allows remote attackers to by (no CVSS) - [CVE-2008-6967](https://cve.now/CVE-2008-6967.md): Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon before 10.02 have unknown impact and attack vectors, probably related t (no CVSS) - [CVE-2008-6968](https://cve.now/CVE-2008-6968.md): Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the (1) (no CVSS) - [CVE-2008-6969](https://cve.now/CVE-2008-6969.md): Multiple cross-site scripting (XSS) vulnerabilities in checkout.php in Avactis Shopping Cart 1.8.0 and 1.8.1 allow remote attackers to injec (no CVSS) - [CVE-2008-6970](https://cve.now/CVE-2008-6970.md): SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 and earlier allows remote attackers to execute arbitrary SQL commands v (no CVSS) - [CVE-2008-6971](https://cve.now/CVE-2008-6971.md): The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes (no CVSS) - [CVE-2008-6972](https://cve.now/CVE-2008-6972.md): Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated (no CVSS) - [CVE-2009-2761](https://cve.now/CVE-2009-2761.md): Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiV (no CVSS) - [CVE-2009-2762](https://cve.now/CVE-2009-2762.md): wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly t (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-08-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.