# CVEs published 2009-08-18

47 CVEs were published on August 18, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1872](https://cve.now/CVE-2009-1872.md): Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion Server 8.0.1, 8, and earlier allow remote attackers to inject arbitr (no CVSS)
- [CVE-2009-1873](https://cve.now/CVE-2009-1873.md): Directory traversal vulnerability in logging/logviewer.jsp in the Management Console in Adobe JRun Application Server 4 Updater 7 allows rem (no CVSS)
- [CVE-2009-1874](https://cve.now/CVE-2009-1874.md): Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Adobe JRun 4.0 allow remote attackers to inject arbitrary w (no CVSS)
- [CVE-2009-1875](https://cve.now/CVE-2009-1875.md): Multiple cross-site scripting (XSS) vulnerabilities in Adobe ColdFusion 8.0.1 and earlier allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2009-1876](https://cve.now/CVE-2009-1876.md): Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encod (no CVSS)
- [CVE-2009-1877](https://cve.now/CVE-2009-1877.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTM (no CVSS)
- [CVE-2009-1878](https://cve.now/CVE-2009-1878.md): Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors. (no CVSS)
- [CVE-2009-2856](https://cve.now/CVE-2009-2856.md): Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding is enabled, does not properly handle a client's attempt to establish an (no CVSS)
- [CVE-2009-2844](https://cve.now/CVE-2009-2844.md): cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and other versions before 2.6.31-rc6 allows remote attackers to cause a denia (no CVSS)
- [CVE-2009-2846](https://cve.now/CVE-2009-2846.md): The eisa\_eeprom\_read function in the parisc isa-eeprom component (drivers/parisc/eisa\_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows (no CVSS)
- [CVE-2009-2847](https://cve.now/CVE-2009-2847.md): The do\_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, (no CVSS)
- [CVE-2009-2848](https://cve.now/CVE-2009-2848.md): The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current-\>clear\_child\_tid pointer, whic (no CVSS)
- [CVE-2009-2849](https://cve.now/CVE-2009-2849.md): The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer deref (no CVSS)
- [CVE-2009-2850](https://cve.now/CVE-2009-2850.md): Multiple buffer overflows in NASA Common Data Format (CDF) allow context-dependent attackers to execute arbitrary code, as demonstrated usin (no CVSS)
- [CVE-2009-2851](https://cve.now/CVE-2009-2851.md): Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2009-2852](https://cve.now/CVE-2009-2852.md): WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register\_globals enabled, allows remote attackers to execute arbitrary PHP code via t (no CVSS)
- [CVE-2009-2853](https://cve.now/CVE-2009-2853.md): Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (no CVSS)
- [CVE-2009-2854](https://cve.now/CVE-2009-2854.md): Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or addition (no CVSS)
- [CVE-2009-2855](https://cve.now/CVE-2009-2855.md): The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth he (no CVSS)
- [CVE-2008-6976](https://cve.now/CVE-2008-6976.md): MikroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows remote attackers to modify Network Management System (NMS) settings via a c (no CVSS)
- [CVE-2008-6977](https://cve.now/CVE-2008-6977.md): Cross-site scripting (XSS) vulnerability in album.asp in Full Revolution aspWebAlbum 3.2 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-6978](https://cve.now/CVE-2008-6978.md): Unrestricted file upload vulnerability in Full Revolution aspWebAlbum 3.2 allows remote attackers to execute arbitrary code by uploading a f (no CVSS)
- [CVE-2008-6979](https://cve.now/CVE-2008-6979.md): Cross-site scripting (XSS) vulnerability in as\_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2008-6980](https://cve.now/CVE-2008-6980.md): SQL injection vulnerability in as\_archives.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2008-6981](https://cve.now/CVE-2008-6981.md): index.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers to obtain the full installation path via an invalid results\_per\_page (no CVSS)
- [CVE-2008-6982](https://cve.now/CVE-2008-6982.md): Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2008-6983](https://cve.now/CVE-2008-6983.md): modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target (no CVSS)
- [CVE-2008-6984](https://cve.now/CVE-2008-6984.md): Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, allows remote attackers to bypass authentication and send spam e-mail via (no CVSS)
- [CVE-2008-6985](https://cve.now/CVE-2008-6985.md): Multiple SQL injection vulnerabilities in includes/classes/shopping\_cart.php in Zen Cart 1.2.0 through 1.3.8a, when magic\_quotes\_gpc is disa (no CVSS)
- [CVE-2008-6986](https://cve.now/CVE-2008-6986.md): SQL injection vulnerability in the actionMultipleAddProduct function in includes/classes/shopping\_cart.php in Zen Cart 1.3.0 through 1.3.8a, (no CVSS)
- [CVE-2008-6987](https://cve.now/CVE-2008-6987.md): Unrestricted file upload vulnerability in eZoneScripts Dating Website script allows remote attackers to execute arbitrary code via unknown v (no CVSS)
- [CVE-2008-6988](https://cve.now/CVE-2008-6988.md): Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo Gallery (aka Ezphotogallery) 2.1 allow remote attackers to inject arbitrar (no CVSS)
- [CVE-2008-6989](https://cve.now/CVE-2008-6989.md): SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2008-6990](https://cve.now/CVE-2008-6990.md): SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka Ezphotogallery) 2.1 allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2008-6991](https://cve.now/CVE-2008-6991.md): SQL injection vulnerability in public/page.php in Websens CMSbright allows remote attackers to execute arbitrary SQL commands via the id\_rub (no CVSS)
- [CVE-2008-6992](https://cve.now/CVE-2008-6992.md): GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, allows remote attackers to bypass the SQL injection protection mechanism vi (no CVSS)
- [CVE-2008-6993](https://cve.now/CVE-2008-6993.md): Siemens Gigaset WLAN Camera 1.27 has an insecure default password, which allows remote attackers to conduct unauthorized activities. (no CVSS)
- [CVE-2008-6994](https://cve.now/CVE-2008-6994.md): Stack-based buffer overflow in the SaveAs feature (SaveFileAsWithFilter function) in win\_util.cc in Google Chrome 0.2.149.27 allows user-ass (no CVSS)
- [CVE-2008-6995](https://cve.now/CVE-2008-6995.md): Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome 0.2.149.27 allows remote attackers to cause a denial of service (brow (no CVSS)
- [CVE-2008-6996](https://cve.now/CVE-2008-6996.md): Google Chrome BETA (0.2.149.27) does not prompt the user before saving an executable file, which makes it easier for remote attackers or mal (no CVSS)
- [CVE-2008-6997](https://cve.now/CVE-2008-6997.md): Google Chrome 0.2.149.27 allows user-assisted remote attackers to cause a denial of service (browser crash) via an IMG tag with a long src a (no CVSS)
- [CVE-2008-6998](https://cve.now/CVE-2008-6998.md): Stack-based buffer overflow in chrome/common/gfx/url\_elider.cc in Google Chrome 0.2.149.27 and other versions before 0.2.149.29 might allow (no CVSS)
- [CVE-2008-6999](https://cve.now/CVE-2008-6999.md): phpAuction 3.2, and possibly 3.3.0 GPL Basic edition, allows remote attackers to obtain configuration information via a direct request to ph (no CVSS)
- [CVE-2008-7000](https://cve.now/CVE-2008-7000.md): PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 allows remote attackers to execute arbitrary PHP code via a URL in th (no CVSS)
- [CVE-2008-7001](https://cve.now/CVE-2008-7001.md): Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary cod (no CVSS)
- [CVE-2008-7002](https://cve.now/CVE-2008-7002.md): PHP 5.2.5 does not enforce (a) open\_basedir and (b) safe\_mode\_exec\_dir restrictions for certain functions, which might allow local users to (no CVSS)
- [CVE-2008-7003](https://cve.now/CVE-2008-7003.md): Multiple SQL injection vulnerabilities in login.php in The Rat CMS Alpha 2 allow remote attackers to execute arbitrary SQL commands via the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.