# CVEs published 2009-09-22

11 CVEs were published on September 22, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3283](https://cve.now/CVE-2009-3283.md): Cross-site scripting (XSS) vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP\_RSS\_Builder, and webshot, (no CVSS)
- [CVE-2009-3284](https://cve.now/CVE-2009-3284.md): Directory traversal vulnerability in phpspot PHP BBS, PHP Image Capture BBS, PHP & CSS BBS, PHP BBS CE, PHP\_RSS\_Builder, and webshot, dated (no CVSS)
- [CVE-2009-3286](https://cve.now/CVE-2009-3286.md): NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O\_EXCL create fails, which causes (no CVSS)
- [CVE-2009-3287](https://cve.now/CVE-2009-3287.md): lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which (no CVSS, thin)
- [CVE-2009-3288](https://cve.now/CVE-2009-3288.md): The sg\_build\_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing (no CVSS)
- [CVE-2009-3289](https://cve.now/CVE-2009-3289.md): The g\_file\_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-as (no CVSS)
- [CVE-2009-3290](https://cve.now/CVE-2009-3290.md): The kvm\_emulate\_hypercall function in arch/x86/kvm/x86.c in KVM in the Linux kernel 2.6.25-rc1, and other versions before 2.6.31, when runni (no CVSS)
- [CVE-2009-3291](https://cve.now/CVE-2009-3291.md): The php\_openssl\_apply\_verification\_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown (no CVSS)
- [CVE-2009-3292](https://cve.now/CVE-2009-3292.md): Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity che (no CVSS)
- [CVE-2009-3293](https://cve.now/CVE-2009-3293.md): Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an inc (no CVSS)
- [CVE-2009-3294](https://cve.now/CVE-2009-3294.md): The popen API function in TSRM/tsrm\_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.