# CVEs published 2009-09-08

64 CVEs were published on September 8, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-7183](https://cve.now/CVE-2008-7183.md): PHP remote file inclusion vulnerability in eva/index.php in EVA CMS 2.3.1, when register\_globals is enabled, allows remote attackers to exec (no CVSS)
- [CVE-2008-7184](https://cve.now/CVE-2008-7184.md): Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet allows remote attackers to inject arbitrary web script or HTML via a (no CVSS)
- [CVE-2008-7185](https://cve.now/CVE-2008-7185.md): GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of service (segmentation fault and crash) via a playlist (.pls) file with a (no CVSS)
- [CVE-2009-0627](https://cve.now/CVE-2009-0627.md): Unspecified vulnerability in Cisco NX-OS before 4.0(1a)N2(1), when running on Nexus 5000 platforms, allows remote attackers to cause a denia (no CVSS)
- [CVE-2009-2139](https://cve.now/CVE-2009-2139.md): Heap-based buffer overflow in svtools/source/filter.vcl/wmf/enhwmf.cxx in Go-oo 2.x and 3.x before 3.0.1, previously named ooo-build and rel (no CVSS)
- [CVE-2009-2632](https://cve.now/CVE-2009-2632.md): Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1 (no CVSS)
- [CVE-2009-3107](https://cve.now/CVE-2009-3107.md): Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 does not properly restrict access to the listening port for the DBManage (no CVSS)
- [CVE-2009-3108](https://cve.now/CVE-2009-3108.md): The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 installs a client executable with insecure permission (no CVSS)
- [CVE-2009-3109](https://cve.now/CVE-2009-3109.md): Unspecified vulnerability in the AClient agent in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430, when key-based authen (no CVSS)
- [CVE-2009-3110](https://cve.now/CVE-2009-3110.md): Race condition in the file transfer functionality in Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 allows remote attac (no CVSS)
- [CVE-2009-0199](https://cve.now/CVE-2009-0199.md): Heap-based buffer overflow in the VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x b (no CVSS)
- [CVE-2009-1132](https://cve.now/CVE-2009-1132.md): Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold, SP1, and SP2 and Server 200 (no CVSS)
- [CVE-2009-1920](https://cve.now/CVE-2009-1920.md): The JScript scripting engine 5.1, 5.6, 5.7, and 5.8 in JScript.dll in Microsoft Windows, as used in Internet Explorer, does not properly loa (no CVSS)
- [CVE-2009-1925](https://cve.now/CVE-2009-1925.md): The TCP/IP implementation in Microsoft Windows Vista Gold, SP1, and SP2 and Server 2008 Gold and SP2 does not properly manage state informat (no CVSS)
- [CVE-2009-1926](https://cve.now/CVE-2009-1926.md): Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers t (no CVSS)
- [CVE-2009-2498](https://cve.now/CVE-2009-2498.md): Microsoft Windows Media Format Runtime 9.0, 9.5, and 11 and Windows Media Services 9.1 and 2008 do not properly parse malformed headers in A (no CVSS)
- [CVE-2009-2499](https://cve.now/CVE-2009-2499.md): Microsoft Windows Media Format Runtime 9.0, 9.5, and 11; and Microsoft Media Foundation on Windows Vista Gold, SP1, and SP2 and Server 2008; (no CVSS)
- [CVE-2009-2519](https://cve.now/CVE-2009-2519.md): The DHTML Editing Component ActiveX control in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 does not properly format HTML (no CVSS)
- [CVE-2009-2628](https://cve.now/CVE-2009-2628.md): The VMnc media codec in vmnc.dll in VMware Movie Decoder before 6.5.3 build 185404, VMware Workstation 6.5.x before 6.5.3 build 185404, VMwa (no CVSS)
- [CVE-2009-3103](https://cve.now/CVE-2009-3103.md): Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold a (no CVSS)
- [CVE-2009-3104](https://cve.now/CVE-2009-3104.md): Unspecified vulnerability in Symantec Norton AntiVirus 2005 through 2008; Norton Internet Security 2005 through 2008; AntiVirus Corporate Ed (no CVSS)
- [CVE-2009-3105](https://cve.now/CVE-2009-3105.md): Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka Domino Web Access or DWA) before 211.241 for Domino 8.0.1 allows remote at (no CVSS)
- [CVE-2009-3106](https://cve.now/CVE-2009-3106.md): The Servlet Engine/Web Container component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.37 does not properly implement secur (no CVSS)
- [CVE-2009-2346](https://cve.now/CVE-2009-2346.md): The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x be (no CVSS)
- [CVE-2009-2701](https://cve.now/CVE-2009-2701.md): Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 (no CVSS, zodb3)
- [CVE-2009-2702](https://cve.now/CVE-2009-2702.md): KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\\0' character in a domain name in the Subject Alternative Name field o (no CVSS)
- [CVE-2009-2703](https://cve.now/CVE-2009-2703.md): libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of (no CVSS)
- [CVE-2009-3009](https://cve.now/CVE-2009-3009.md): Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitr (no CVSS, actionpack · activesupport)
- [CVE-2009-3083](https://cve.now/CVE-2009-3083.md): The msn\_slp\_sip\_recv function in libpurple/protocols/msn/slp.c in the MSN protocol plugin in libpurple in Pidgin before 2.6.2 allows remote (no CVSS)
- [CVE-2009-3084](https://cve.now/CVE-2009-3084.md): The msn\_slp\_process\_msg function in libpurple/protocols/msn/slpcall.c in the MSN protocol plugin in libpurple 2.6.0 and 2.6.1, as used in Pi (no CVSS)
- [CVE-2009-3085](https://cve.now/CVE-2009-3085.md): The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not properly handle an error IQ stanza during an attempted fetch of a cust (no CVSS)
- [CVE-2009-3086](https://cve.now/CVE-2009-3086.md): A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest s (no CVSS, actionpack · activesupport)
- [CVE-2009-3087](https://cve.now/CVE-2009-3087.md): Unspecified vulnerability in nserver.exe in the server in IBM Lotus Domino 8.0 on Windows Server 2003 allows remote attackers to cause a den (no CVSS)
- [CVE-2009-3088](https://cve.now/CVE-2009-3088.md): Heap-based buffer overflow in ibmdiradm in IBM Tivoli Directory Server (TDS) 6.0 on Linux allows remote attackers to have an unspecified imp (no CVSS)
- [CVE-2009-3089](https://cve.now/CVE-2009-3089.md): IBM Tivoli Directory Server (TDS) 6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via u (no CVSS)
- [CVE-2009-3090](https://cve.now/CVE-2009-3090.md): Unspecified vulnerability in IBM Tivoli Directory Server (TDS) 6.0 on Linux allows remote attackers to cause a denial of service via unknown (no CVSS)
- [CVE-2009-3091](https://cve.now/CVE-2009-3091.md): Unspecified vulnerability on the ASUS WL-330gE has unknown impact and remote attack vectors, as demonstrated by a certain module in VulnDisc (no CVSS)
- [CVE-2009-3092](https://cve.now/CVE-2009-3092.md): Buffer overflow on the ASUS WL-500W wireless router has unknown impact and remote attack vectors, as demonstrated by a certain module in Vul (no CVSS)
- [CVE-2009-3093](https://cve.now/CVE-2009-3093.md): Unspecified vulnerability on the ASUS WL-500W wireless router has unknown impact and remote attack vectors, as demonstrated by a certain mod (no CVSS)
- [CVE-2009-3094](https://cve.now/CVE-2009-3094.md): The ap\_proxy\_ftp\_handler function in modules/proxy/proxy\_ftp.c in the mod\_proxy\_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13 allow (no CVSS)
- [CVE-2009-3095](https://cve.now/CVE-2009-3095.md): The mod\_proxy\_ftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary command (no CVSS)
- [CVE-2009-3096](https://cve.now/CVE-2009-3096.md): Multiple unspecified vulnerabilities in HP Performance Insight 5.3 allow remote attackers to have an unknown impact, related to (1) a "Remot (no CVSS)
- [CVE-2009-3097](https://cve.now/CVE-2009-3097.md): Multiple unspecified vulnerabilities in HP Performance Insight 5.3 on Windows allow attackers to obtain sensitive information via unknown ve (no CVSS)
- [CVE-2009-3098](https://cve.now/CVE-2009-3098.md): Unspecified vulnerability in the Portal in HP Operations Dashboard 2.1 on Windows Server 2003 SP2 allows remote attackers to have an unknown (no CVSS)
- [CVE-2009-3099](https://cve.now/CVE-2009-3099.md): Unspecified vulnerability in HP OpenView Operations Manager 8.1 on Windows Server 2003 SP2 allows remote attackers to have an unknown impact (no CVSS)
- [CVE-2009-3100](https://cve.now/CVE-2009-3100.md): xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 9 and 10, OpenSolaris snv\_109 through snv\_122, and X11 6.4.1 on Solaris 8 does not prop (no CVSS)
- [CVE-2009-3101](https://cve.now/CVE-2009-3101.md): xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 10, and OpenSolaris snv\_109 through snv\_122, does not properly handle Trusted Extension (no CVSS)
- [CVE-2009-3102](https://cve.now/CVE-2009-3102.md): The doHotCopy subroutine in socket-server.pl in Zmanda Recovery Manager (ZRM) for MySQL 2.x before 2.1.1 allows remote attackers to execute (no CVSS)
- [CVE-2008-7167](https://cve.now/CVE-2008-7167.md): Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploadi (no CVSS)
- [CVE-2008-7168](https://cve.now/CVE-2008-7168.md): Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download (no CVSS)
- [CVE-2008-7169](https://cve.now/CVE-2008-7169.md): SQL injection vulnerability in Jabode horoscope extension (com\_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2008-7170](https://cve.now/CVE-2008-7170.md): GSC build 2067 and earlier relies on the client to enforce administrator privileges, which allows remote attackers to execute arbitrary admi (no CVSS)
- [CVE-2008-7171](https://cve.now/CVE-2008-7171.md): Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2008-7172](https://cve.now/CVE-2008-7172.md): Lightweight news portal (LNP) 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain a (no CVSS)
- [CVE-2008-7173](https://cve.now/CVE-2008-7173.md): The Jura Internet Connection Kit for the Jura Impressa F90 coffee maker does not properly restrict access to privileged functions, which all (no CVSS)
- [CVE-2008-7174](https://cve.now/CVE-2008-7174.md): Multiple buffer overflows in the Jura Internet Connection Kit for the Jura Impressa F90 coffee maker allow remote attackers to cause a denia (no CVSS)
- [CVE-2008-7175](https://cve.now/CVE-2008-7175.md): Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attack (no CVSS)
- [CVE-2008-7176](https://cve.now/CVE-2008-7176.md): Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-7177](https://cve.now/CVE-2008-7177.md): Buffer overflow in the listing module in Netwide Assembler (NASM) before 2.03.01 has unknown impact and attack vectors, a different vulnerab (no CVSS)
- [CVE-2008-7178](https://cve.now/CVE-2008-7178.md): Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-7179](https://cve.now/CVE-2008-7179.md): OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN\_Hora, ADMIN\_Logado (no CVSS)
- [CVE-2008-7180](https://cve.now/CVE-2008-7180.md): del\_query1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request with a modified id vari (no CVSS)
- [CVE-2008-7181](https://cve.now/CVE-2008-7181.md): Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.p (no CVSS)
- [CVE-2008-7182](https://cve.now/CVE-2008-7182.md): Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote authenticated users to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.