# CVEs published 2009-09-18

39 CVEs were published on September 18, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2008-7244](https://cve.now/CVE-2008-7244.md): Mozilla Firefox 3.0.1 and earlier allows remote attackers to cause a denial of service (browser hang) by calling the window.print function i (no CVSS)
- [CVE-2008-7245](https://cve.now/CVE-2008-7245.md): Opera 9.52 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print function in a loo (no CVSS)
- [CVE-2008-7246](https://cve.now/CVE-2008-7246.md): Google Chrome 0.2.149.29 and earlier allows remote attackers to cause a denial of service (unusable browser) by calling the window.print fun (no CVSS)
- [CVE-2009-2741](https://cve.now/CVE-2009-2741.md): Unspecified vulnerability in the wberuntimeear application in the test servlet in IBM WebSphere Business Events 6.1 and 6.2 allows remote at (no CVSS)
- [CVE-2009-2793](https://cve.now/CVE-2009-2793.md): The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, wh (no CVSS)
- [CVE-2009-3263](https://cve.now/CVE-2009-3263.md): Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x before 3.0.195.21 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2009-3264](https://cve.now/CVE-2009-3264.md): The getSVGDocument method in Google Chrome before 3.0.195.21 omits an unspecified "access check," which allows remote web servers to bypass (no CVSS)
- [CVE-2009-3265](https://cve.now/CVE-2009-3265.md): Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows remote attackers to inject arbitrary web script or HTML via a (1) RSS or ( (no CVSS)
- [CVE-2009-3266](https://cve.now/CVE-2009-3266.md): Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) Atom feed, which allows remote attackers to conduct cross-site script (no CVSS)
- [CVE-2009-3267](https://cve.now/CVE-2009-3267.md): Microsoft Internet Explorer 6 through 6.0.2900.2180, and 7.0.6000.16711, allows remote attackers to cause a denial of service (CPU consumpti (no CVSS)
- [CVE-2009-3268](https://cve.now/CVE-2009-3268.md): Google Chrome 1.0.154.48 and earlier allows remote attackers to cause a denial of service (CPU consumption) via an automatically submitted f (no CVSS)
- [CVE-2009-3269](https://cve.now/CVE-2009-3269.md): Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a series of automatic submissions of a for (no CVSS)
- [CVE-2009-3270](https://cve.now/CVE-2009-3270.md): Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote attackers to cause a denial of service (unusable browser) by calling the (no CVSS)
- [CVE-2009-3257](https://cve.now/CVE-2009-3257.md): vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the (1) Account Billing Address and (2) Shipping Addr (no CVSS)
- [CVE-2009-3258](https://cve.now/CVE-2009-3258.md): vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete (1) attachments, (2) reports, (3) filters (no CVSS)
- [CVE-2009-3259](https://cve.now/CVE-2009-3259.md): Multiple SQL injection vulnerabilities in RASH Quote Management System (RQMS) 1.2.2 allow remote attackers to execute arbitrary SQL commands (no CVSS)
- [CVE-2009-3260](https://cve.now/CVE-2009-3260.md): Cross-site scripting (XSS) vulnerability in LiveStreet 0.2 allows remote attackers to inject arbitrary web script or HTML via the header of (no CVSS)
- [CVE-2009-3261](https://cve.now/CVE-2009-3261.md): update/update\_0.1.2\_to\_0.2.php in LiveStreet 0.2 does not require administrative authentication, which allows remote attackers to perform DR (no CVSS)
- [CVE-2009-3262](https://cve.now/CVE-2009-3262.md): Cross-site scripting (XSS) vulnerability in the Self Service UI (SSUI) in IBM Tivoli Identity Manager (ITIM) 5.0.0.5 allows remote authentic (no CVSS)
- [CVE-2009-3246](https://cve.now/CVE-2009-3246.md): SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL commands via the id parame (no CVSS)
- [CVE-2009-3247](https://cve.now/CVE-2009-3247.md): Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2009-3248](https://cve.now/CVE-2009-3248.md): Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication o (no CVSS)
- [CVE-2009-3249](https://cve.now/CVE-2009-3249.md): Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to include and execute arbitrary local files via a . (no CVSS)
- [CVE-2009-3250](https://cve.now/CVE-2009-3250.md): The saveForwardAttachments procedure in the Compose Mail functionality in vtiger CRM 5.0.4 allows remote authenticated users to execute arbi (no CVSS)
- [CVE-2009-3251](https://cve.now/CVE-2009-3251.md): include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows remote authenticated users to bypass intended access restrictions and read (no CVSS)
- [CVE-2009-3252](https://cve.now/CVE-2009-3252.md): Multiple SQL injection vulnerabilities in news.php in Rock Band CMS 0.10 allow remote attackers to execute arbitrary SQL commands via the (1 (no CVSS)
- [CVE-2009-3253](https://cve.now/CVE-2009-3253.md): Stack-based buffer overflow in TriceraSoft Swift Ultralite 1.032 allows remote attackers to cause a denial of service (crash) or execute arb (no CVSS)
- [CVE-2009-3254](https://cve.now/CVE-2009-3254.md): Multiple stack-based buffer overflows in Ultimate Player 1.56 beta allow remote attackers to execute arbitrary code via a long string in a ( (no CVSS)
- [CVE-2009-3255](https://cve.now/CVE-2009-3255.md): SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic\_quotes\_gpc is disabled, allows remote attac (no CVSS)
- [CVE-2009-3256](https://cve.now/CVE-2009-3256.md): Cross-site scripting (XSS) vulnerability in include/ajax/blogInfo.php in LiveStreet 0.2 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2009-1883](https://cve.now/CVE-2009-1883.md): The z90crypt\_unlocked\_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE (no CVSS)
- [CVE-2009-2707](https://cve.now/CVE-2009-2707.md): Unspecified vulnerability in ia32el (aka the IA 32 emulation functionality) before 7042\_7022-0.4.2 in SUSE Linux Enterprise (SLE) 10 SP2 on (no CVSS)
- [CVE-2009-2937](https://cve.now/CVE-2009-2937.md): Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2009-3238](https://cve.now/CVE-2009-3238.md): The get\_random\_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows (no CVSS)
- [CVE-2009-3240](https://cve.now/CVE-2009-3240.md): Cross-site scripting (XSS) vulnerability in the Happy Linux XF-Section module 1.12a for XOOPS allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2009-3241](https://cve.now/CVE-2009-3241.md): Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers (no CVSS)
- [CVE-2009-3242](https://cve.now/CVE-2009-3242.md): Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of se (no CVSS)
- [CVE-2009-3243](https://cve.now/CVE-2009-3243.md): Unspecified vulnerability in the TLS dissector in Wireshark 1.2.0 and 1.2.1, when running on Windows, allows remote attackers to cause a den (no CVSS)
- [CVE-2009-3244](https://cve.now/CVE-2009-3244.md): Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to caus (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.