# CVEs published 2009-11-27

21 CVEs were published on November 27, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4082](https://cve.now/CVE-2009-4082.md): PHP remote file inclusion vulnerability in forums/Forum\_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earlier allows remote… (no CVSS)
- [CVE-2009-4083](https://cve.now/CVE-2009-4083.md): Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or… (no CVSS)
- [CVE-2009-4084](https://cve.now/CVE-2009-4084.md): SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2009-4085](https://cve.now/CVE-2009-4085.md): PHP remote file inclusion vulnerability in assets/plugins/mp3\_id/mp3\_id.php in PHP Traverser 0.8.0 allows remote attackers to execute… (no CVSS)
- [CVE-2009-4086](https://cve.now/CVE-2009-4086.md): CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP… (no CVSS)
- [CVE-2009-4087](https://cve.now/CVE-2009-4087.md): Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki 2.4.23 and earlier allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2009-4088](https://cve.now/CVE-2009-4088.md): Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via… (no CVSS)
- [CVE-2009-4089](https://cve.now/CVE-2009-4089.md): telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a modified pageID… (no CVSS)
- [CVE-2009-4090](https://cve.now/CVE-2009-4090.md): Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to… (no CVSS)
- [CVE-2009-4091](https://cve.now/CVE-2009-4091.md): comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete… (no CVSS)
- [CVE-2009-4092](https://cve.now/CVE-2009-4092.md): Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack… (no CVSS)
- [CVE-2009-4093](https://cve.now/CVE-2009-4093.md): Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to… (no CVSS)
- [CVE-2009-4094](https://cve.now/CVE-2009-4094.md): PHP remote file inclusion vulnerability in class/php/d4m\_ajax\_pagenav.php in the D4J eZine (com\_ezine) component 2.1 for Joomla! allows… (no CVSS)
- [CVE-2009-4095](https://cve.now/CVE-2009-4095.md): myPhile 1.2.1 allows remote attackers to bypass authentication via an empty password. (no CVSS)
- [CVE-2009-3736](https://cve.now/CVE-2009-3736.md): ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products… (no CVSS)
- [CVE-2009-3894](https://cve.now/CVE-2009-3894.md): Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module… (no CVSS)
- [CVE-2009-4080](https://cve.now/CVE-2009-4080.md): Multiple unspecified vulnerabilities in ldap\_cachemgr (aka the LDAP client configuration cache daemon) in Sun Solaris 9 and 10, and… (no CVSS)
- [CVE-2009-4081](https://cve.now/CVE-2009-4081.md): Untrusted search path vulnerability in dstat before r3199 allows local users to gain privileges via a Trojan horse Python module in the… (no CVSS)
- [CVE-2009-4018](https://cve.now/CVE-2009-4018.md): The proc\_open function in ext/standard/proc\_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1)… (no CVSS)
- [CVE-2009-4031](https://cve.now/CVE-2009-4031.md): The do\_insn\_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before… (no CVSS)
- [CVE-2009-4032](https://cve.now/CVE-2009-4032.md): Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2009-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.