# CVEs published 2009-10-16

23 CVEs were published on October 16, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3704](https://cve.now/CVE-2009-3704.md): ZoIPer 2.22, and possibly other versions before 2.24 Library 5324, allows remote attackers to cause a denial of service (crash) via a SIP IN (no CVSS)
- [CVE-2009-2733](https://cve.now/CVE-2009-2733.md): Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2009-2734](https://cve.now/CVE-2009-2734.md): SQL injection vulnerability in the get\_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute a (no CVSS)
- [CVE-2009-2874](https://cve.now/CVE-2009-2874.md): The TimesTenD process in Cisco Unified Presence 1.x, 6.x before 6.0(6), and 7.x before 7.0(4) allows remote attackers to cause a denial of s (no CVSS)
- [CVE-2009-3281](https://cve.now/CVE-2009-3281.md): The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to g (no CVSS)
- [CVE-2009-3282](https://cve.now/CVE-2009-3282.md): Integer overflow in the vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 allows host OS users to cause a denial of service (no CVSS)
- [CVE-2009-3696](https://cve.now/CVE-2009-3696.md): Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows remote attackers to inject arbit (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2009-3697](https://cve.now/CVE-2009-3697.md): SQL injection vulnerability in the PDF schema generator functionality in phpMyAdmin 2.11.x before 2.11.9.6 and 3.x before 3.2.2.1 allows rem (no CVSS)
- [CVE-2009-3705](https://cve.now/CVE-2009-3705.md): PHP remote file inclusion vulnerability in debugger.php in Achievo before 1.4.0 allows remote attackers to execute arbitrary PHP code via a (no CVSS)
- [CVE-2009-3706](https://cve.now/CVE-2009-3706.md): Unspecified vulnerability in the ZFS filesystem in Sun Solaris 10, and OpenSolaris snv\_100 through snv\_117, allows local users to bypass int (no CVSS)
- [CVE-2009-3707](https://cve.now/CVE-2009-3707.md): VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 (no CVSS)
- [CVE-2009-3708](https://cve.now/CVE-2009-3708.md): Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attac (no CVSS)
- [CVE-2009-3709](https://cve.now/CVE-2009-3709.md): Stack-based buffer overflow in the Meta Content Optimizer in Konae Technologies Alleycode HTML Editor 2.21 allows user-assisted remote attac (no CVSS)
- [CVE-2009-3710](https://cve.now/CVE-2009-3710.md): RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username (dbadmin) and password (sq!us3r) for an SSH tunnel, which allows remot (no CVSS)
- [CVE-2009-3711](https://cve.now/CVE-2009-3711.md): Stack-based buffer overflow in the h\_handlepeer function in http.cpp in httpdx 1.4, and possibly 1.4.3, allows remote attackers to cause a d (no CVSS)
- [CVE-2009-3712](https://cve.now/CVE-2009-3712.md): Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via the (1) user\_id param (no CVSS)
- [CVE-2009-3713](https://cve.now/CVE-2009-3713.md): SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and earlier allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-3714](https://cve.now/CVE-2009-3714.md): Cross-site scripting (XSS) vulnerability in admin\_login.php in MCshoutbox 1.1 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-3715](https://cve.now/CVE-2009-3715.md): Multiple SQL injection vulnerabilities in scr\_login.php in MCshoutbox 1.1, when magic\_quotes\_gpc is disabled, allow remote attackers to exec (no CVSS)
- [CVE-2009-3716](https://cve.now/CVE-2009-3716.md): Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploadi (no CVSS)
- [CVE-2009-3717](https://cve.now/CVE-2009-3717.md): Heap-based buffer overflow in LucVil PatPlayer 3.9 allows remote attackers to cause a denial of service (crash) or execute arbitrary code vi (no CVSS)
- [CVE-2009-3718](https://cve.now/CVE-2009-3718.md): SQL injection vulnerability in admin/authenticate.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-3719](https://cve.now/CVE-2009-3719.md): Cross-site scripting (XSS) vulnerability in comment.asp in Battle Blog 1.25 and 1.30 build 2 allows remote attackers to inject arbitrary web (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-10-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.