# CVEs published 2009-10-09

17 CVEs were published on October 9, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3642](https://cve.now/CVE-2009-3642.md): Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL c (no CVSS)
- [CVE-2009-3643](https://cve.now/CVE-2009-3643.md): Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to cause a denial of service via a long argument to the (1) LIST and (2) N (no CVSS)
- [CVE-2009-3644](https://cve.now/CVE-2009-3644.md): SQL injection vulnerability in the Soundset (com\_soundset) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL comman (no CVSS)
- [CVE-2009-3645](https://cve.now/CVE-2009-3645.md): SQL injection vulnerability in the JoomlaCache CB Resume Builder (com\_cbresumebuilder) component for Joomla! allows remote attackers to exec (no CVSS)
- [CVE-2009-3646](https://cve.now/CVE-2009-3646.md): InterVations NaviCOPA Web Server 3.01 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition (no CVSS)
- [CVE-2009-3647](https://cve.now/CVE-2009-3647.md): Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft Mega File Hosting Script (aka MFH or MFHS) 1.2 allows remote attackers (no CVSS)
- [CVE-2009-3648](https://cve.now/CVE-2009-3648.md): Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a module for Drupal, allows remote authenticated users, with 'administer (no CVSS)
- [CVE-2009-3649](https://cve.now/CVE-2009-3649.md): Cross-site scripting (XSS) vulnerability in forums/index.php in Power Bulletin Board (PBBoard) 2.0.2 and possibly earlier allows remote atta (no CVSS)
- [CVE-2009-3650](https://cve.now/CVE-2009-3650.md): Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier and 6.x-1.0-rc1 and earlier, a module for Drupal, allows remote attacker (no CVSS)
- [CVE-2009-3651](https://cve.now/CVE-2009-3651.md): Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allo (no CVSS)
- [CVE-2009-3652](https://cve.now/CVE-2009-3652.md): Cross-site scripting (XSS) vulnerability in Organic Groups (OG) 5.x-7.x before 5.x-7.4, 5.x-8.x before 5.x-8.1, and 6.x-1.x before 6.x-1.4, (no CVSS)
- [CVE-2009-3653](https://cve.now/CVE-2009-3653.md): Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authen (no CVSS)
- [CVE-2009-3654](https://cve.now/CVE-2009-3654.md): Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote attackers to create new webroot directories via unkno (no CVSS)
- [CVE-2009-3655](https://cve.now/CVE-2009-3655.md): Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server crash) via unspecified vectors re (no CVSS)
- [CVE-2009-3656](https://cve.now/CVE-2009-3656.md): Cross-site request forgery (CSRF) vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack the au (no CVSS)
- [CVE-2009-3657](https://cve.now/CVE-2009-3657.md): Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack web sessions via unspec (no CVSS)
- [CVE-2009-3658](https://cve.now/CVE-2009-3658.md): Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control (sb.dll) in America Online (AOL) 9.5.0.1 allows remote attackers to trig (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.