# CVEs published 2009-09-11

31 CVEs were published on September 11, 2009: 0 critical, 1 high. Days are UTC.

- [CVE-2009-3168](https://cve.now/CVE-2009-3168.md): Mevin Productions Basic PHP Events Lister 2.0 does not properly restrict access to (1) admin/reset.php and (2) admin/user\_add.php, which all (CVSS 7.2)
- [CVE-2009-3169](https://cve.now/CVE-2009-3169.md): Multiple unspecified vulnerabilities in Hitachi JP1/File Transmission Server/FTP before 09-00 allow remote attackers to execute arbitrary co (no CVSS)
- [CVE-2009-3170](https://cve.now/CVE-2009-3170.md): Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) and earlier allows remote attackers to cause a denial of service (cras (no CVSS)
- [CVE-2009-3171](https://cve.now/CVE-2009-3171.md): Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft Gazelle CMS 1.0 and earlier allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2009-3172](https://cve.now/CVE-2009-3172.md): Unspecified vulnerability in Hitachi Groupmax Groupware Server 07-00 through 07-50-/A, Groupmax Server Set 03-00 through 06-52, Groupware Se (no CVSS)
- [CVE-2009-3173](https://cve.now/CVE-2009-3173.md): Unrestricted file upload vulnerability in admin/add\_album.php in The Rat CMS Alpha 2 allows remote attackers to execute arbitrary code by up (no CVSS)
- [CVE-2009-3174](https://cve.now/CVE-2009-3174.md): PHP remote file inclusion vulnerability in fonctions\_racine.php in OBOphiX 2.7.0 and earlier allows remote attackers to execute arbitrary PH (no CVSS)
- [CVE-2009-3175](https://cve.now/CVE-2009-3175.md): Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attacke (no CVSS)
- [CVE-2009-3176](https://cve.now/CVE-2009-3176.md): Buffer overflow in the ActiveX control in Novell iPrint Client 4.38 allows remote attackers to cause a denial of service (crash) and possibl (no CVSS)
- [CVE-2009-3177](https://cve.now/CVE-2009-3177.md): Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown impact and attack vectors, as demonstrated by a certain module in Vuln (no CVSS)
- [CVE-2009-3178](https://cve.now/CVE-2009-3178.md): Unspecified vulnerability in mm.exe in Symantec Altiris Deployment Solution 6.9 allows remote attackers to cause a denial of service via unk (no CVSS)
- [CVE-2009-3179](https://cve.now/CVE-2009-3179.md): Multiple unspecified vulnerabilities in Symantec Altiris Deployment Solution 6.9 might allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2009-3180](https://cve.now/CVE-2009-3180.md): Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a password reset for other users via a modified user parameter to renew.php. (no CVSS)
- [CVE-2009-3181](https://cve.now/CVE-2009-3181.md): Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows remote attackers to overwrite arbitrary files via a .. (no CVSS)
- [CVE-2009-3182](https://cve.now/CVE-2009-3182.md): Unrestricted file upload vulnerability in admin/editor/filemanager/browser.html in Anantasoft Gazelle CMS 1.0 allows remote attackers to exe (no CVSS)
- [CVE-2009-2800](https://cve.now/CVE-2009-2800.md): Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of servic (no CVSS)
- [CVE-2009-3167](https://cve.now/CVE-2009-3167.md): Directory traversal vulnerability in index.php in Anantasoft Gazelle CMS 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to (no CVSS)
- [CVE-2008-7203](https://cve.now/CVE-2008-7203.md): Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to cause a denial of service (crash) via multiple crafted login packets. (no CVSS)
- [CVE-2008-7204](https://cve.now/CVE-2008-7204.md): Cross-site request forgery (CSRF) vulnerability in VirtueMart 1.0.13a and earlier allows remote attackers to hijack the authentication of ad (no CVSS)
- [CVE-2008-7205](https://cve.now/CVE-2008-7205.md): Unspecified vulnerability in the product view functionality in VirtueMart 1.0.13a and earlier allows remote attackers to read arbitrary file (no CVSS)
- [CVE-2008-7206](https://cve.now/CVE-2008-7206.md): Unspecified vulnerability in Electronic Logbook (ELOG) before 2.7.2 has unknown impact and attack vectors when the "logbook contains HTML co (no CVSS)
- [CVE-2008-7207](https://cve.now/CVE-2008-7207.md): RivetTracker before 1.0 stores passwords in cleartext in config.php, which allows local users to discover passwords by reading config.php. (no CVSS)
- [CVE-2008-7208](https://cve.now/CVE-2008-7208.md): Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2008-7209](https://cve.now/CVE-2008-7209.md): Unrestricted file upload vulnerability in the add2 action in a\_upload.php in OneCMS 2.4, and possibly earlier, allows remote attackers to ex (no CVSS)
- [CVE-2008-7210](https://cve.now/CVE-2008-7210.md): directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter wi (no CVSS)
- [CVE-2008-7211](https://cve.now/CVE-2008-7211.md): CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as used in Ensoniq PCI 1371 sound cards and when running on Windows Vista, does not c (no CVSS)
- [CVE-2008-7212](https://cve.now/CVE-2008-7212.md): MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mam (no CVSS)
- [CVE-2008-7213](https://cve.now/CVE-2008-7213.md): Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny\_mce/filemanager/connectors/php/connector.php in MOStlyCE (no CVSS)
- [CVE-2008-7214](https://cve.now/CVE-2008-7214.md): Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allo (no CVSS)
- [CVE-2008-7215](https://cve.now/CVE-2008-7215.md): The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a (no CVSS)
- [CVE-2008-7216](https://cve.now/CVE-2008-7216.md): Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.