# CVEs published 2009-12-31 29 CVEs were published on December 31, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-4512](https://cve.now/CVE-2009-4512.md): Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and… (no CVSS) - [CVE-2009-4513](https://cve.now/CVE-2009-4513.md): Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal… (no CVSS) - [CVE-2009-4514](https://cve.now/CVE-2009-4514.md): Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal… (no CVSS) - [CVE-2009-4515](https://cve.now/CVE-2009-4515.md): The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote… (no CVSS) - [CVE-2009-4516](https://cve.now/CVE-2009-4516.md): Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to… (no CVSS) - [CVE-2009-4517](https://cve.now/CVE-2009-4517.md): Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote… (no CVSS) - [CVE-2009-4518](https://cve.now/CVE-2009-4518.md): Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject… (no CVSS) - [CVE-2009-4519](https://cve.now/CVE-2009-4519.md): Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors. (no CVSS) - [CVE-2009-4520](https://cve.now/CVE-2009-4520.md): The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass… (no CVSS) - [CVE-2009-4521](https://cve.now/CVE-2009-4521.md): Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as… (no CVSS) - [CVE-2009-4522](https://cve.now/CVE-2009-4522.md): Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or… (no CVSS) - [CVE-2009-4523](https://cve.now/CVE-2009-4523.md): Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS) - [CVE-2009-4524](https://cve.now/CVE-2009-4524.md): Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject… (no CVSS) - [CVE-2009-4525](https://cve.now/CVE-2009-4525.md): Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before… (no CVSS) - [CVE-2009-4526](https://cve.now/CVE-2009-4526.md): The Send by e-mail sub-module in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a… (no CVSS) - [CVE-2009-4527](https://cve.now/CVE-2009-4527.md): The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically… (no CVSS) - [CVE-2009-4528](https://cve.now/CVE-2009-4528.md): The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended… (no CVSS) - [CVE-2009-4529](https://cve.now/CVE-2009-4529.md): InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing… (no CVSS) - [CVE-2009-4530](https://cve.now/CVE-2009-4530.md): Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI. (no CVSS) - [CVE-2009-4531](https://cve.now/CVE-2009-4531.md): httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (no CVSS) - [CVE-2009-4532](https://cve.now/CVE-2009-4532.md): Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows… (no CVSS) - [CVE-2009-4533](https://cve.now/CVE-2009-4533.md): The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token… (no CVSS) - [CVE-2009-4534](https://cve.now/CVE-2009-4534.md): Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect… (no CVSS) - [CVE-2009-4535](https://cve.now/CVE-2009-4535.md): Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI. (no CVSS) - [CVE-2009-4498](https://cve.now/CVE-2009-4498.md): The node\_process\_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. (no CVSS) - [CVE-2009-4499](https://cve.now/CVE-2009-4499.md): SQL injection vulnerability in the get\_history\_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote… (no CVSS) - [CVE-2009-4500](https://cve.now/CVE-2009-4500.md): The process\_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash)… (no CVSS) - [CVE-2009-4501](https://cve.now/CVE-2009-4501.md): The zbx\_get\_next\_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service… (no CVSS) - [CVE-2009-4502](https://cve.now/CVE-2009-4502.md): The NET\_TCP\_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass… (no CVSS) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2009-12-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.