# CVEs published 2011-09-13

12 CVEs were published on September 13, 2011: 0 critical, 0 high. Days are UTC.

- [CVE-2010-4834](https://cve.now/CVE-2010-4834.md): Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticat (no CVSS)
- [CVE-2010-4835](https://cve.now/CVE-2010-4835.md): Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary f (no CVSS)
- [CVE-2010-4836](https://cve.now/CVE-2010-4836.md): Cross-site scripting (XSS) vulnerability in register.html in PHPShop 2.1 EE and earlier allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2010-4837](https://cve.now/CVE-2010-4837.md): Cross-site scripting (XSS) vulnerability in the JSupport (com\_jsupport) component 1.5.6 for Joomla! allows remote attackers to inject arbitr (no CVSS)
- [CVE-2010-4838](https://cve.now/CVE-2010-4838.md): SQL injection vulnerability in the JSupport (com\_jsupport) component 1.5.6 for Joomla! allows remote authenticated users, with Public Back-e (no CVSS)
- [CVE-2010-4839](https://cve.now/CVE-2010-4839.md): SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL (no CVSS)
- [CVE-2009-5096](https://cve.now/CVE-2009-5096.md): Cross-site scripting (XSS) vulnerability in the Flag Content module 5.x-2.x before 5.x-2.10 for Drupal allows remote attackers to inject arb (no CVSS)
- [CVE-2009-5097](https://cve.now/CVE-2009-5097.md): Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as dem (no CVSS)
- [CVE-2009-5098](https://cve.now/CVE-2009-5098.md): The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a d (no CVSS)
- [CVE-2009-5099](https://cve.now/CVE-2009-5099.md): Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitra (no CVSS)
- [CVE-2009-5100](https://cve.now/CVE-2009-5100.md): Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow phy (no CVSS)
- [CVE-2009-5101](https://cve.now/CVE-2009-5101.md): Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session h (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2011-09-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.