# CVEs published 2009-09-24

39 CVEs were published on September 24, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2682](https://cve.now/CVE-2009-2682.md): Unspecified vulnerability in Role-Based Access Control (RBAC) in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access r (no CVSS)
- [CVE-2009-2817](https://cve.now/CVE-2009-2817.md): Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application cra (no CVSS)
- [CVE-2009-3390](https://cve.now/CVE-2009-3390.md): Multiple unspecified vulnerabilities in the (1) iscsiadm and (2) iscsitadm programs in Sun Solaris 10, and OpenSolaris snv\_28 through snv\_10 (no CVSS)
- [CVE-2009-2680](https://cve.now/CVE-2009-2680.md): Unspecified vulnerability in the Remote Management Interface (RMI) for MSL Tape Libraries and 1/8 G2 Tape Autoloaders in HP StorageWorks 1/8 (no CVSS)
- [CVE-2009-3335](https://cve.now/CVE-2009-3335.md): SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the N (no CVSS)
- [CVE-2009-3336](https://cve.now/CVE-2009-3336.md): SQL injection vulnerability in auction\_details.php in PHP Pro Bid allows remote attackers to execute arbitrary SQL commands via the auction\_ (no CVSS)
- [CVE-2009-3337](https://cve.now/CVE-2009-3337.md): SQL injection vulnerability in the Freetag (serendipity\_event\_freetag) plugin before 3.09 for Serendipity (S9Y) allows remote attackers to e (no CVSS)
- [CVE-2009-3338](https://cve.now/CVE-2009-3338.md): Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b allows remote attackers to execute arbitrary code via a long string in (no CVSS)
- [CVE-2009-3339](https://cve.now/CVE-2009-3339.md): Unspecified vulnerability in McAfee Email and Web Security Appliance 5.1 VMtrial allows remote attackers to read arbitrary files via unknown (no CVSS)
- [CVE-2009-3340](https://cve.now/CVE-2009-3340.md): Unspecified vulnerability in FreeSSHD 1.2.4 allows remote attackers to cause a denial of service via unknown vectors, as demonstrated by a c (no CVSS)
- [CVE-2009-3341](https://cve.now/CVE-2009-3341.md): Buffer overflow on the Linksys WRT54GL wireless router allows remote attackers to execute arbitrary code via unspecified vectors, as demonst (no CVSS)
- [CVE-2009-3342](https://cve.now/CVE-2009-3342.md): SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints (com\_alphauserpoints) component 1.5.2 for Jooml (no CVSS)
- [CVE-2009-3343](https://cve.now/CVE-2009-3343.md): SQL injection vulnerability in details.asp in HotWeb Rentals allows remote attackers to execute arbitrary SQL commands via the PropId parame (no CVSS)
- [CVE-2009-3344](https://cve.now/CVE-2009-3344.md): Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service (infinite loop) via (no CVSS)
- [CVE-2009-3345](https://cve.now/CVE-2009-3345.md): Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in (no CVSS)
- [CVE-2009-3346](https://cve.now/CVE-2009-3346.md): Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demon (no CVSS)
- [CVE-2009-3347](https://cve.now/CVE-2009-3347.md): Buffer overflow on the D-Link DIR-400 wireless router allows remote attackers to execute arbitrary code via unspecified vectors, as demonstr (no CVSS)
- [CVE-2009-3348](https://cve.now/CVE-2009-3348.md): Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or HTML via the cid par (no CVSS)
- [CVE-2009-3349](https://cve.now/CVE-2009-3349.md): SQL injection vulnerability in Datavore Gyro 5.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a cat ac (no CVSS)
- [CVE-2009-3350](https://cve.now/CVE-2009-3350.md): Multiple unspecified vulnerabilities in the Subdomain Manager module for Drupal have unknown impact and attack vectors. (no CVSS)
- [CVE-2009-3351](https://cve.now/CVE-2009-3351.md): Multiple unspecified vulnerabilities in the Node Browser module for Drupal have unknown impact and attack vectors. (no CVSS)
- [CVE-2009-3352](https://cve.now/CVE-2009-3352.md): Multiple unspecified vulnerabilities in the quota\_by\_role (Quota by role) module for Drupal have unknown impact and attack vectors. (no CVSS)
- [CVE-2009-3353](https://cve.now/CVE-2009-3353.md): Multiple unspecified vulnerabilities in the Node2Node module for Drupal have unknown impact and attack vectors. (no CVSS)
- [CVE-2009-3354](https://cve.now/CVE-2009-3354.md): Multiple unspecified vulnerabilities in the Rest API module for Drupal have unknown impact and attack vectors. (no CVSS)
- [CVE-2009-3355](https://cve.now/CVE-2009-3355.md): Cross-site scripting (XSS) vulnerability in profile.php in Datetopia Buy Dating Site 1.0 allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2009-3356](https://cve.now/CVE-2009-3356.md): SQL injection vulnerability in index.php in Image voting 1.0 allows remote attackers to execute arbitrary SQL commands via the show paramete (no CVSS)
- [CVE-2009-3357](https://cve.now/CVE-2009-3357.md): Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com\_hbssearch) component for Joomla! allow remote (no CVSS)
- [CVE-2009-3358](https://cve.now/CVE-2009-3358.md): SQL injection vulnerability in profile.php in Tourism Scripts Adult Portal escort listing allows remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2009-3359](https://cve.now/CVE-2009-3359.md): Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2009-3360](https://cve.now/CVE-2009-3360.md): Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1 (no CVSS)
- [CVE-2009-3361](https://cve.now/CVE-2009-3361.md): SQL injection vulnerability in index.php in PHP-IPNMonitor allows remote attackers to execute arbitrary SQL commands via the maincat\_id para (no CVSS)
- [CVE-2009-3362](https://cve.now/CVE-2009-3362.md): PHP remote file inclusion vulnerability in printnews.php3 in SZNews 2.7 allows remote attackers to execute arbitrary PHP code via a URL in t (no CVSS)
- [CVE-2009-3363](https://cve.now/CVE-2009-3363.md): Cross-site scripting (XSS) vulnerability in the BUEditor module 5.x before 5.x-1.2 and 6.x before 6.x-1.4, a module for Drupal, allows remot (no CVSS)
- [CVE-2009-3364](https://cve.now/CVE-2009-3364.md): Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote FTP servers to execute arbitrary code via a long response to a PASV com (no CVSS)
- [CVE-2009-3365](https://cve.now/CVE-2009-3365.md): PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 allows remote attackers (no CVSS)
- [CVE-2009-3366](https://cve.now/CVE-2009-3366.md): Directory traversal vulnerability in navigation.php in An image gallery 1.0 allows remote attackers to list arbitrary directories via a .. (no CVSS)
- [CVE-2009-3367](https://cve.now/CVE-2009-3367.md): Multiple cross-site scripting (XSS) vulnerabilities in An image gallery 1.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2009-3368](https://cve.now/CVE-2009-3368.md): Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or com\_hbssearch) component for Joomla! allows rem (no CVSS)
- [CVE-2009-3369](https://cve.now/CVE-2009-3369.md): CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does not restrict users from the Client (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.