# CVEs published 2009-08-28

25 CVEs were published on August 28, 2009: 1 critical, 0 high. Days are UTC.

- [CVE-2008-7107](https://cve.now/CVE-2008-7107.md): easdrv.sys in ESET Smart Security 3.0.667.0 allows local users to cause a denial of service (crash) via a crafted IOCTL 0x222003 request to (no CVSS)
- [CVE-2008-7108](https://cve.now/CVE-2008-7108.md): Multiple cross-site scripting (XSS) vulnerabilities in Carmosa phpCart 3.4 through 4.6.4 allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2008-7109](https://cve.now/CVE-2008-7109.md): The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to bypass authorization and upload arbitrary fi (CVSS 9.8)
- [CVE-2008-7110](https://cve.now/CVE-2008-7110.md): Directory traversal vulnerability in the Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to upload (no CVSS)
- [CVE-2008-7111](https://cve.now/CVE-2008-7111.md): The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 does not restrict the filenames or extensions of uploaded files, which (no CVSS)
- [CVE-2008-7112](https://cve.now/CVE-2008-7112.md): The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to cause a denial of service (hang or crash) vi (no CVSS)
- [CVE-2008-7113](https://cve.now/CVE-2008-7113.md): The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 uses a small space of predictable user identification numbers for acces (no CVSS)
- [CVE-2008-7114](https://cve.now/CVE-2008-7114.md): SQL injection vulnerability in members\_search.php in iFusion Services iFdate 2.0.3 and earlier allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2008-7115](https://cve.now/CVE-2008-7115.md): The web interface to the Belkin Wireless G router and ADSL2 modem F5D7632-4V6 with firmware 6.01.08 allows remote attackers to bypass authen (no CVSS)
- [CVE-2008-7116](https://cve.now/CVE-2008-7116.md): SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2008-7117](https://cve.now/CVE-2008-7117.md): eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain requ (no CVSS)
- [CVE-2008-7118](https://cve.now/CVE-2008-7118.md): WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers t (no CVSS)
- [CVE-2008-7119](https://cve.now/CVE-2008-7119.md): SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id p (no CVSS)
- [CVE-2008-7120](https://cve.now/CVE-2008-7120.md): SQL injection vulnerability in Mr. (no CVSS)
- [CVE-2008-7121](https://cve.now/CVE-2008-7121.md): Cross-site scripting (XSS) vulnerability in Mr. (no CVSS)
- [CVE-2009-2695](https://cve.now/CVE-2009-2695.md): The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which all (no CVSS)
- [CVE-2009-3000](https://cve.now/CVE-2009-3000.md): The sockfs module in the kernel in Sun Solaris 10 and OpenSolaris snv\_41 through snv\_122, when Network Cache Accelerator (NCA) logging is en (no CVSS)
- [CVE-2009-3001](https://cve.now/CVE-2009-3001.md): The llc\_ui\_getname function in net/llc/af\_llc.c in the Linux kernel 2.6.31-rc7 and earlier does not initialize a certain data structure, whi (no CVSS)
- [CVE-2009-3002](https://cve.now/CVE-2009-3002.md): The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read th (no CVSS)
- [CVE-2009-3003](https://cve.now/CVE-2009-3003.md): Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an ar (no CVSS)
- [CVE-2009-3004](https://cve.now/CVE-2009-3004.md): Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitr (no CVSS)
- [CVE-2009-3005](https://cve.now/CVE-2009-3005.md): Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on (no CVSS)
- [CVE-2009-3006](https://cve.now/CVE-2009-3006.md): Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary (no CVSS)
- [CVE-2009-3007](https://cve.now/CVE-2009-3007.md): Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow context-dependent attackers to spoof the address bar, via window.open wit (no CVSS)
- [CVE-2009-3008](https://cve.now/CVE-2009-3008.md): K-Meleon 1.5.3 allows context-dependent attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary file: (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.