# CVEs published 2009-09-09

24 CVEs were published on September 9, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2205](https://cve.now/CVE-2009-2205.md): Stack-based buffer overflow in the Java Web Start command launcher in Java for Mac OS X 10.5 before Update 5 allows attackers to execute arb (no CVSS)
- [CVE-2009-3114](https://cve.now/CVE-2009-3114.md): The RSS reader widget in IBM Lotus Notes 8.0 and 8.5 saves items from an RSS feed as local HTML documents, which allows remote attackers to (no CVSS)
- [CVE-2009-3115](https://cve.now/CVE-2009-3115.md): SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via a crafted Option Acknow (no CVSS)
- [CVE-2009-3116](https://cve.now/CVE-2009-3116.md): SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the year parame (no CVSS)
- [CVE-2009-3117](https://cve.now/CVE-2009-3117.md): SQL injection vulnerability in category.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via th (no CVSS)
- [CVE-2009-3118](https://cve.now/CVE-2009-3118.md): SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute ar (no CVSS)
- [CVE-2009-3119](https://cve.now/CVE-2009-3119.md): SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitr (no CVSS)
- [CVE-2009-3120](https://cve.now/CVE-2009-3120.md): Cross-site scripting (XSS) vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-3121](https://cve.now/CVE-2009-3121.md): Cross-site scripting (XSS) vulnerability in the Ajax Table module 5.x for Drupal allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2009-3122](https://cve.now/CVE-2009-3122.md): The Ajax Table module 5.x for Drupal does not perform access control, which allows remote attackers to delete arbitrary users and nodes via (no CVSS)
- [CVE-2009-3123](https://cve.now/CVE-2009-3123.md): Directory traversal vulnerability in gallery/gallery.php in Wap-Motor before 18.1 allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-3124](https://cve.now/CVE-2009-3124.md): Directory traversal vulnerability in get\_message.cgi in QuarkMail allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2008-7192](https://cve.now/CVE-2008-7192.md): Cross-site request forgery (CSRF) vulnerability in index.php in WoltLab Burning Board (wBB) 3.0.1, and possibly other 3.x versions, allows r (no CVSS)
- [CVE-2008-7193](https://cve.now/CVE-2008-7193.md): PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks by r (no CVSS)
- [CVE-2009-3112](https://cve.now/CVE-2009-3112.md): Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition before 4.1.0 allows remote attackers to gain adminis (no CVSS)
- [CVE-2009-3113](https://cve.now/CVE-2009-3113.md): Unspecified vulnerability in OXID eShop Professional, Enterprise, and Community Edition before 4.1.2, 3.x, and 2.x allows remote attackers t (no CVSS)
- [CVE-2009-3111](https://cve.now/CVE-2009-3111.md): The rad\_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunn (no CVSS)
- [CVE-2008-7186](https://cve.now/CVE-2008-7186.md): Coppermine Photo Gallery (CPG) 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information (no CVSS)
- [CVE-2008-7187](https://cve.now/CVE-2008-7187.md): Coppermine Photo Gallery (CPG) 1.4.14 allows remote attackers to obtain sensitive information via a direct request to include/slideshow.inc. (no CVSS)
- [CVE-2008-7188](https://cve.now/CVE-2008-7188.md): ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the profile of arbitrary u (no CVSS)
- [CVE-2008-7189](https://cve.now/CVE-2008-7189.md): Multiple unspecified vulnerabilities in Local Media Browser before 0.1 have unknown impact and attack vectors related to "Security holes." (no CVSS)
- [CVE-2008-7190](https://cve.now/CVE-2008-7190.md): Unspecified vulnerability in Adium before 1.2 has unknown impact and attack vectors related to javascript: URLs, possibly cross-site scripti (no CVSS)
- [CVE-2008-7191](https://cve.now/CVE-2008-7191.md): Unspecified vulnerability in Polipo before 1.0.4 allows remote attackers to cause a denial of service (crash) via a long request URL. (no CVSS)
- [CVE-2009-2266](https://cve.now/CVE-2009-2266.md): OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.