# CVEs published 2009-08-31

28 CVEs were published on August 31, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2944](https://cve.now/CVE-2009-2944.md): Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers (no CVSS)
- [CVE-2009-3021](https://cve.now/CVE-2009-3021.md): Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' plugin 2.0.0 through 2.0.6, as used in the Japanese extended package of (no CVSS)
- [CVE-2009-3022](https://cve.now/CVE-2009-3022.md): Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and earlier allows remote attackers to hijack the authentication of other u (CVSS 6.5)
- [CVE-2009-3023](https://cve.now/CVE-2009-3023.md): Buffer overflow in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 6.0 allows remote authenticated users to exe (no CVSS)
- [CVE-2009-3024](https://cve.now/CVE-2009-3024.md): The verify\_hostname\_of\_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches t (no CVSS)
- [CVE-2009-3025](https://cve.now/CVE-2009-3025.md): Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to cause a denial of service (crash) via a link in a Yahoo IM. (no CVSS)
- [CVE-2009-3026](https://cve.now/CVE-2009-3026.md): protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly other versions, does not follow the "require TLS/SSL" preference when con (no CVSS)
- [CVE-2009-3010](https://cve.now/CVE-2009-3010.md): Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly block d (no CVSS)
- [CVE-2009-3011](https://cve.now/CVE-2009-3011.md): Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HT (no CVSS)
- [CVE-2009-3012](https://cve.now/CVE-2009-3012.md): Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre does not properly block data: URIs in Location headers in HTTP responses (no CVSS)
- [CVE-2009-3013](https://cve.now/CVE-2009-3013.md): Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly block data: URIs in Location headers in HTTP responses, which allows (no CVSS)
- [CVE-2009-3014](https://cve.now/CVE-2009-3014.md): Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier do not properly handle (no CVSS)
- [CVE-2009-3015](https://cve.now/CVE-2009-3015.md): QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and data: URIs in Refresh and Location headers in HTTP responses, which all (no CVSS)
- [CVE-2009-3016](https://cve.now/CVE-2009-3016.md): Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to (no CVSS)
- [CVE-2009-3017](https://cve.now/CVE-2009-3017.md): Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers (no CVSS)
- [CVE-2009-3018](https://cve.now/CVE-2009-3018.md): Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, whic (no CVSS)
- [CVE-2009-3019](https://cve.now/CVE-2009-3019.md): Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet Explorer 7 on Vista, allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2009-3020](https://cve.now/CVE-2009-3020.md): win32k.sys in Microsoft Windows Server 2003 SP2 allows remote attackers to cause a denial of service (system crash) by referencing a crafted (no CVSS)
- [CVE-2008-7122](https://cve.now/CVE-2008-7122.md): Multiple insecure method vulnerabilities in an ActiveX control in (epRegPro.ocx) in Evans Programming Registry Pro allow remote attackers to (no CVSS)
- [CVE-2008-7123](https://cve.now/CVE-2008-7123.md): Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitr (no CVSS)
- [CVE-2008-7124](https://cve.now/CVE-2008-7124.md): zKup CMS 2.0 through 2.3 does not require administrative authentication for admin/configuration/modifier.php, which allows remote attackers (no CVSS)
- [CVE-2008-7125](https://cve.now/CVE-2008-7125.md): pphoto in Ariadne before 2.6 allows remote authenticated users with certain privileges to execute arbitrary shell commands via vectors relat (no CVSS)
- [CVE-2008-7126](https://cve.now/CVE-2008-7126.md): Integer overflow in osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2008-7127](https://cve.now/CVE-2008-7127.md): osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and earlier allows remote attackers to cause a denial of service (crash) via a (no CVSS)
- [CVE-2008-7128](https://cve.now/CVE-2008-7128.md): The ssl\_parse\_client\_key\_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen cipherte (no CVSS)
- [CVE-2008-7129](https://cve.now/CVE-2008-7129.md): XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA si (no CVSS)
- [CVE-2008-7130](https://cve.now/CVE-2008-7130.md): Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors. (no CVSS)
- [CVE-2008-7131](https://cve.now/CVE-2008-7131.md): Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-08-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.