# CVEs published 2009-09-01 26 CVEs were published on September 1, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-3040](https://cve.now/CVE-2009-3040.md): Multiple SQL injection vulnerabilities in Open Computer and Software (OCS) Inventory NG 1.02 for Unix allow remote attackers to execute arbi (no CVSS) - [CVE-2009-3041](https://cve.now/CVE-2009-3041.md): SPIP 1.9 before 1.9.2i and 2.0.x through 2.0.8 does not use proper access control for (1) ecrire/exec/install.php and (2) ecrire/index.php, (no CVSS) - [CVE-2009-3042](https://cve.now/CVE-2009-3042.md): SQL injection vulnerability in machine.php in Open Computer and Software (OCS) Inventory NG 1.02.1 allows remote attackers to execute arbitr (no CVSS) - [CVE-2008-7132](https://cve.now/CVE-2008-7132.md): Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.3 beta allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2008-7133](https://cve.now/CVE-2008-7133.md): Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary w (no CVSS) - [CVE-2008-7134](https://cve.now/CVE-2008-7134.md): Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attacker (no CVSS) - [CVE-2008-7135](https://cve.now/CVE-2008-7135.md): toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the (no CVSS) - [CVE-2008-7136](https://cve.now/CVE-2008-7136.md): toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the (no CVSS) - [CVE-2008-7137](https://cve.now/CVE-2008-7137.md): WS-Proxy in Eye-Fi 1.1.2 allows remote attackers to cause a denial of service (crash) via an empty query string to port 59278 and other unsp (no CVSS) - [CVE-2008-7138](https://cve.now/CVE-2008-7138.md): The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day, which allows remote attackers to bypass authentica (no CVSS) - [CVE-2008-7139](https://cve.now/CVE-2008-7139.md): Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy in Eye-Fi 1.1.2 allow remote attackers to hijack the authentication o (no CVSS) - [CVE-2008-7140](https://cve.now/CVE-2008-7140.md): Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web scrip (no CVSS) - [CVE-2008-7141](https://cve.now/CVE-2008-7141.md): Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS) - [CVE-2008-7142](https://cve.now/CVE-2008-7142.md): Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers t (no CVSS) - [CVE-2008-7143](https://cve.now/CVE-2008-7143.md): phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote atta (no CVSS) - [CVE-2008-7144](https://cve.now/CVE-2008-7144.md): Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ (no CVSS) - [CVE-2008-7145](https://cve.now/CVE-2008-7145.md): Multiple SQL injection vulnerabilities in index.php in CoronaMatrix phpAddressBook 2.0 allow remote attackers to execute arbitrary SQL comma (no CVSS) - [CVE-2008-7146](https://cve.now/CVE-2008-7146.md): IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allows remote attackers to obtain sensitive information via a (no CVSS) - [CVE-2008-7147](https://cve.now/CVE-2008-7147.md): Multiple cross-site scripting (XSS) vulnerabilities in IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allow r (no CVSS) - [CVE-2008-7148](https://cve.now/CVE-2008-7148.md): Unspecified vulnerability in Synfig Animation Studio before 0.61.08 allows attackers to execute arbitrary code via a crafted .sif file. (no CVSS) - [CVE-2008-7149](https://cve.now/CVE-2008-7149.md): Unspecified vulnerability in AgileWiki before 0.10.1 has unknown impact and attack vectors related to passwords. (no CVSS) - [CVE-2008-7150](https://cve.now/CVE-2008-7150.md): Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject ar (no CVSS) - [CVE-2008-7151](https://cve.now/CVE-2008-7151.md): Cross-site request forgery (CSRF) vulnerability in Live 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to hijack the authe (no CVSS) - [CVE-2008-7152](https://cve.now/CVE-2008-7152.md): Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database (SID), when register\_globals is enabled, allow remote attacker (no CVSS) - [CVE-2009-3037](https://cve.now/CVE-2009-3037.md): Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer (aka File Viewer for Excel), as used in IBM Lotus Notes 5.x through 8.5.x, S (no CVSS) - [CVE-2009-3038](https://cve.now/CVE-2009-3038.md): A certain ActiveX control in lnresobject.dll 7.1.1.119 in the Research In Motion (RIM) Lotus Notes connector for BlackBerry Desktop Manager (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-09-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.