# CVEs published 2009-08-25

29 CVEs were published on August 25, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2959](https://cve.now/CVE-2009-2959.md): Cross-site scripting (XSS) vulnerability in the waterfall web status view (status/web/waterfall.py) in Buildbot 0.7.6 through 0.7.11p1 allow (no CVSS, buildbot)
- [CVE-2009-2960](https://cve.now/CVE-2009-2960.md): CuteFlow 2.10.3 and 2.11.0\_c does not properly restrict access to pages/edituser.php, which allows remote attackers to modify usernames and (no CVSS)
- [CVE-2009-2961](https://cve.now/CVE-2009-2961.md): Stack-based buffer overflow in Thaddy de Konng KOL Player 1.0 allows remote attackers to cause a denial of service (crash) or execute arbitr (no CVSS)
- [CVE-2009-2963](https://cve.now/CVE-2009-2963.md): Unspecified vulnerability in the update feature in Toolbar Uninstaller 1.0.2 allows remote attackers to force the download and execution of (no CVSS)
- [CVE-2009-2964](https://cve.now/CVE-2009-2964.md): Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attacker (no CVSS)
- [CVE-2009-2965](https://cve.now/CVE-2009-2965.md): Cross-site scripting (XSS) vulnerability in entry/index.jsp in Radvision Scopia 5.7, and possibly other versions before SD 7.0.100, allows r (no CVSS)
- [CVE-2009-2966](https://cve.now/CVE-2009-2966.md): avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus 9.0.0.463 allows remote attackers to cause a denial of service (CPU consumpt (no CVSS)
- [CVE-2008-7062](https://cve.now/CVE-2008-7062.md): Unrestricted file upload vulnerability in admin/index.php in Download Manager module 1.0 for LoveCMS 1.6.2 Final allows remote attackers to (no CVSS)
- [CVE-2008-7063](https://cve.now/CVE-2008-7063.md): Ocean12 FAQ Manager Pro stores sensitive data under the web root with insufficient access control, which allows remote attackers to download (no CVSS)
- [CVE-2008-7064](https://cve.now/CVE-2008-7064.md): Directory traversal vulnerability in the get\_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal befo (no CVSS)
- [CVE-2008-7065](https://cve.now/CVE-2008-7065.md): Siemens C450 IP and C475 IP VoIP devices allow remote attackers to cause a denial of service (disconnected calls and device reboot) via a cr (no CVSS)
- [CVE-2008-7066](https://cve.now/CVE-2008-7066.md): OpenForum 0.66 Beta allows remote attackers to bypass authentication and reset passwords of other users via a direct request with the update (no CVSS)
- [CVE-2008-7067](https://cve.now/CVE-2008-7067.md): PHP remote file inclusion vulnerability in admin/plugins/Online\_Users/main.php in PageTree CMS 0.0.2 BETA 0001 allows remote attackers to ex (no CVSS)
- [CVE-2008-7068](https://cve.now/CVE-2008-7068.md): The dba\_replace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service (file truncation) via a key wi (no CVSS)
- [CVE-2008-7069](https://cve.now/CVE-2008-7069.md): All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information under the web root with insufficient access control, which allows remote (no CVSS)
- [CVE-2008-7070](https://cve.now/CVE-2008-7070.md): Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quot (no CVSS)
- [CVE-2008-7071](https://cve.now/CVE-2008-7071.md): SQL injection vulnerability in authenticate.php in Chipmunk Topsites allows remote attackers to execute arbitrary SQL commands via the usern (no CVSS)
- [CVE-2008-7072](https://cve.now/CVE-2008-7072.md): Cross-site scripting (XSS) vulnerability in index.php in Chipmunk Topsites allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2008-7073](https://cve.now/CVE-2008-7073.md): PHP remote file inclusion vulnerability in lib/action/rss.php in RSS module 0.1 for Pie Web M{a,e}sher, when register\_globals is enabled, al (no CVSS)
- [CVE-2008-7074](https://cve.now/CVE-2008-7074.md): Format string vulnerability in MemeCode Software i.Scribe 1.88 through 2.00 before Beta9 allows remote SMTP servers to cause a denial of ser (no CVSS)
- [CVE-2008-7075](https://cve.now/CVE-2008-7075.md): Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. (no CVSS)
- [CVE-2008-7076](https://cve.now/CVE-2008-7076.md): Unrestricted file upload vulnerability in user.modify.profile.php in Kalptaru Infotech Ltd. (no CVSS)
- [CVE-2008-7077](https://cve.now/CVE-2008-7077.md): Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow remote attackers to execute arbitrary SQL commands via the (1) username and (no CVSS)
- [CVE-2008-7078](https://cve.now/CVE-2008-7078.md): Multiple buffer overflows in Rumpus before 6.0.1 allow remote attackers to (1) cause a denial of service (segmentation fault) via a long HTT (no CVSS)
- [CVE-2008-7079](https://cve.now/CVE-2008-7079.md): Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code v (no CVSS)
- [CVE-2008-7080](https://cve.now/CVE-2008-7080.md): Team PHP PHP Classifieds Script stores sensitive information under the web root with insufficient access control, which allows remote attack (no CVSS)
- [CVE-2008-7081](https://cve.now/CVE-2008-7081.md): userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 allows remote attackers to bypass authentication and gain administrator pr (no CVSS)
- [CVE-2008-7082](https://cve.now/CVE-2008-7082.md): MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my\_post\_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, (no CVSS)
- [CVE-2008-7083](https://cve.now/CVE-2008-7083.md): Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter clone allow remote attackers to execute arbitrary SQL commands via th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.