# CVEs published 2009-08-21

38 CVEs were published on August 21, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2926](https://cve.now/CVE-2009-2926.md): Multiple SQL injection vulnerabilities in PHP Competition System BETA 0.84 and earlier allow remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2009-2927](https://cve.now/CVE-2009-2927.md): SQL injection vulnerability in DetailFile.php in DigitalSpinners DS CMS 1.0 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2009-2928](https://cve.now/CVE-2009-2928.md): Cross-site scripting (XSS) vulnerability in login.php in TGS Content Management 0.x allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2009-2929](https://cve.now/CVE-2009-2929.md): Multiple SQL injection vulnerabilities in TGS Content Management 0.x allow remote attackers to execute arbitrary SQL commands via the (1) tg (no CVSS)
- [CVE-2009-2930](https://cve.now/CVE-2009-2930.md): Cross-site scripting (XSS) vulnerability in the Search feature in elka CMS (aka Elkapax) allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2009-2931](https://cve.now/CVE-2009-2931.md): Directory traversal vulnerability in p.php in SlideShowPro Director 1.1 through 1.3.8 allows remote attackers to read arbitrary files via di (no CVSS)
- [CVE-2009-2932](https://cve.now/CVE-2009-2932.md): Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remo (no CVSS)
- [CVE-2009-2933](https://cve.now/CVE-2009-2933.md): SQL injection vulnerability in comments.php in Piwigo before 2.0.3 allows remote attackers to execute arbitrary SQL commands via the items\_n (no CVSS)
- [CVE-2009-2934](https://cve.now/CVE-2009-2934.md): Multiple stack-based buffer overflows in xaudio.dll in Programmed Integration PIPL 2.5.0 and 2.5.0D allow remote attackers to execute arbitr (no CVSS)
- [CVE-2009-1154](https://cve.now/CVE-2009-1154.md): Cisco IOS XR 3.8.1 and earlier allows remote attackers to cause a denial of service (process crash) via a long BGP UPDATE message, as demons (no CVSS)
- [CVE-2009-1879](https://cve.now/CVE-2009-1879.md): Cross-site scripting (XSS) vulnerability in index.template.html in the express-install templates in the SDK in Adobe Flex before 3.4, when t (no CVSS)
- [CVE-2009-2056](https://cve.now/CVE-2009-2056.md): Cisco IOS XR 3.8.1 and earlier allows remote authenticated users to cause a denial of service (process crash) via vectors involving a BGP UP (no CVSS)
- [CVE-2009-2473](https://cve.now/CVE-2009-2473.md): neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers (no CVSS)
- [CVE-2009-2474](https://cve.now/CVE-2009-2474.md): neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (no CVSS)
- [CVE-2008-7016](https://cve.now/CVE-2008-7016.md): tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forg (no CVSS)
- [CVE-2008-7017](https://cve.now/CVE-2008-7017.md): Cross-site scripting (XSS) vulnerability in analyse.php in CAcert 20080921, and possibly other versions before 20080928, allows remote attac (no CVSS)
- [CVE-2008-7018](https://cve.now/CVE-2008-7018.md): Cross-site scripting (XSS) vulnerability in NashTech Easy PHP Calendar 6.3.25 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2008-7019](https://cve.now/CVE-2008-7019.md): Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass authentication and gain privileges via modified (1) enombre and (2) euri cook (no CVSS)
- [CVE-2008-7020](https://cve.now/CVE-2008-7020.md): McAfee SafeBoot Device Encryption 4 build 4750 and earlier stores pre-boot authentication passwords in the BIOS Keyboard buffer and does not (no CVSS)
- [CVE-2008-7021](https://cve.now/CVE-2008-7021.md): Unrestricted file upload vulnerability in editlogo.php in AvailScript Jobs Portal Script allows remote authenticated users to execute arbitr (no CVSS)
- [CVE-2008-7022](https://cve.now/CVE-2008-7022.md): Insecure method vulnerability in ChilkatMail\_v7\_9.dll in the Chilkat Software IMAP ActiveX control (ChilkatMail2.ChilkatMailMan2.1) allows r (no CVSS)
- [CVE-2008-7023](https://cve.now/CVE-2008-7023.md): Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509 certificate for all install (no CVSS)
- [CVE-2008-7024](https://cve.now/CVE-2008-7024.md): admin.php in Arz Development The Gemini Portal 4.7 and earlier allows remote attackers to bypass authentication and gain administrator privi (no CVSS)
- [CVE-2008-7025](https://cve.now/CVE-2008-7025.md): TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service (crash) and (no CVSS)
- [CVE-2008-7026](https://cve.now/CVE-2008-7026.md): Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2008-7027](https://cve.now/CVE-2008-7027.md): Libra File Manager 1.18 and earlier allows remote attackers to bypass authentication and gain privileges by setting the user and pass cookie (no CVSS)
- [CVE-2008-7028](https://cve.now/CVE-2008-7028.md): RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass authentication and gain privileges by setting the keep4u cookie to a certa (no CVSS)
- [CVE-2009-2915](https://cve.now/CVE-2009-2915.md): SQL injection vulnerability in 2fly\_gift.php in 2FLY Gift Delivery System 6.0 allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2009-2916](https://cve.now/CVE-2009-2916.md): Format string vulnerability in the CNS\_AddTxt function in logs.dll in 2K Games Vietcong 2 1.10 and earlier might allow remote attackers to e (no CVSS)
- [CVE-2009-2917](https://cve.now/CVE-2009-2917.md): Stack-based buffer overflow in ImTOO MPEG Encoder 3.1.53 allows remote attackers to cause a denial of service (crash) or possibly execute ar (no CVSS)
- [CVE-2009-2918](https://cve.now/CVE-2009-2918.md): The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service (NULL pointer dereference and (no CVSS)
- [CVE-2009-2919](https://cve.now/CVE-2009-2919.md): Cross-site scripting (XSS) vulnerability in Boonex Orca 2.0 and 2.0.2 allows remote authenticated users to inject arbitrary web script or HT (no CVSS)
- [CVE-2009-2920](https://cve.now/CVE-2009-2920.md): Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) (no CVSS)
- [CVE-2009-2921](https://cve.now/CVE-2009-2921.md): Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP News 1.1 allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2009-2922](https://cve.now/CVE-2009-2922.md): Absolute path traversal vulnerability in pixaria.image.php in Pixaria Gallery 2.0.0 through 2.3.5 allows remote attackers to read arbitrary (no CVSS)
- [CVE-2009-2923](https://cve.now/CVE-2009-2923.md): Multiple directory traversal vulnerabilities in BitmixSoft PHP-Lance 1.52 allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-2924](https://cve.now/CVE-2009-2924.md): Multiple SQL injection vulnerabilities in Videos Broadcast Yourself 2 allow remote attackers to execute arbitrary SQL commands via the (1) U (no CVSS)
- [CVE-2009-2925](https://cve.now/CVE-2009-2925.md): Directory traversal vulnerability in DJcalendar.cgi in DJCalendar allows remote attackers to read arbitrary files via a .. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.