# CVEs published 2010-07-09

25 CVEs were published on July 9, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2010-2489](https://cve.now/CVE-2010-2489.md): Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace\_mode value (no CVSS)
- [CVE-2010-2680](https://cve.now/CVE-2010-2680.md): Directory traversal vulnerability in the JExtensions JE Section/Property Finder (jesectionfinder) component for Joomla! allows remote attack (no CVSS)
- [CVE-2010-2681](https://cve.now/CVE-2010-2681.md): PHP remote file inclusion vulnerability in the SEF404x (com\_sef) component for Joomla! allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2010-2682](https://cve.now/CVE-2010-2682.md): Directory traversal vulnerability in the Realtyna Translator (com\_realtyna) component 1.0.15 for Joomla! allows remote attackers to read arb (no CVSS)
- [CVE-2010-2683](https://cve.now/CVE-2010-2683.md): SQL injection vulnerability in result.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands vi (no CVSS)
- [CVE-2010-2684](https://cve.now/CVE-2010-2684.md): SQL injection vulnerability in index.php in Customer Paradigm PageDirector CMS allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2010-2685](https://cve.now/CVE-2010-2685.md): siteadmin/adduser.php in Customer Paradigm PageDirector CMS does not properly restrict access, which allows remote attackers to bypass inten (no CVSS)
- [CVE-2010-2686](https://cve.now/CVE-2010-2686.md): Multiple SQL injection vulnerabilities in clientes.asp in the TopManage OLK module 1.91.30 for SAP allow remote attackers to execute arbitra (no CVSS)
- [CVE-2010-2687](https://cve.now/CVE-2010-2687.md): SQL injection vulnerability in printdetail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via t (no CVSS)
- [CVE-2010-2688](https://cve.now/CVE-2010-2688.md): SQL injection vulnerability in detail.asp in Site2Nite Boat Classifieds allows remote attackers to execute arbitrary SQL commands via the ID (no CVSS)
- [CVE-2010-2689](https://cve.now/CVE-2010-2689.md): SQL injection vulnerability in cont\_form.php in Internet DM WebDM CMS allows remote attackers to execute arbitrary SQL commands via the cf\_i (no CVSS)
- [CVE-2010-2690](https://cve.now/CVE-2010-2690.md): SQL injection vulnerability in the JOOFORGE Gamesbox (com\_gamesbox) component 1.0.2, and possibly earlier, for Joomla! allows remote attacke (no CVSS)
- [CVE-2010-2691](https://cve.now/CVE-2010-2691.md): Multiple SQL injection vulnerabilities in 2daybiz Custom T-Shirt Design Script allow remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2010-2692](https://cve.now/CVE-2010-2692.md): Cross-site scripting (XSS) vulnerability in 2daybiz Custom T-Shirt Design Script allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2009-4925](https://cve.now/CVE-2009-4925.md): Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16, when magic\_quotes\_gp (no CVSS)
- [CVE-2009-4926](https://cve.now/CVE-2009-4926.md): Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote attackers to inject a (no CVSS)
- [CVE-2009-4927](https://cve.now/CVE-2009-4927.md): WB News 2.1.2 allows remote attackers to bypass authentication and gain administrative access via a modified WBNEWS cookie, as demonstrated (no CVSS)
- [CVE-2009-4928](https://cve.now/CVE-2009-4928.md): PHP remote file inclusion vulnerability in config.php in TotalCalendar 2.4 allows remote attackers to execute arbitrary PHP code via a URL i (no CVSS)
- [CVE-2009-4929](https://cve.now/CVE-2009-4929.md): admin/manage\_users.php in TotalCalendar 2.4 does not require administrative authentication, which allows remote attackers to change arbitrar (no CVSS)
- [CVE-2009-4930](https://cve.now/CVE-2009-4930.md): Cross-site scripting (XSS) vulnerability in the twbkwbis.P\_SecurityQuestion (aka Change Security Question) page in SunGard Banner Student Sy (no CVSS)
- [CVE-2009-4931](https://cve.now/CVE-2009-4931.md): Stack-based buffer overflow in Groovy Media Player 1.1.0 allows remote attackers to cause a denial of service (application crash) or possibl (no CVSS)
- [CVE-2009-4932](https://cve.now/CVE-2009-4932.md): Stack-based buffer overflow in 1by1 1.67 (aka 1.6.7.0) allows remote attackers to cause a denial of service (application crash) or possibly (no CVSS)
- [CVE-2009-4933](https://cve.now/CVE-2009-4933.md): Multiple SQL injection vulnerabilities in login.php in EZ Webitor allow remote attackers to execute arbitrary SQL commands via the (1) txtUs (no CVSS)
- [CVE-2009-4934](https://cve.now/CVE-2009-4934.md): Cross-site scripting (XSS) vulnerability in index.php in Online Photo Pro 2.0 allows remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-4935](https://cve.now/CVE-2009-4935.md): SQL injection vulnerability in ogp\_show.php in Online Guestbook Pro allows remote attackers to execute arbitrary SQL commands via the displa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-07-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.