# CVEs published 2009-09-28 27 CVEs were published on September 28, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-3434](https://cve.now/CVE-2009-3434.md): SQL injection vulnerability in the Tupinambis (com\_tupinambis) component 1.0 for Mambo and Joomla! allows remote attackers to execute arbitr (no CVSS) - [CVE-2009-3435](https://cve.now/CVE-2009-3435.md): Cross-site scripting (XSS) vulnerability in the variable editor in the Devel module 5.x before 5.x-1.2 and 6.x before 6.x-1.18, a module for (no CVSS) - [CVE-2009-3436](https://cve.now/CVE-2009-3436.md): Multiple SQL injection vulnerabilities in forum.asp in MaxWebPortal allow remote attackers to execute arbitrary SQL commands via the (1) FOR (no CVSS) - [CVE-2009-3437](https://cve.now/CVE-2009-3437.md): Cross-site scripting (XSS) vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers t (no CVSS) - [CVE-2009-3438](https://cve.now/CVE-2009-3438.md): SQL injection vulnerability in the JoomlaFacebook (com\_facebook) component for Joomla! allows remote attackers to execute arbitrary SQL comm (no CVSS) - [CVE-2009-3439](https://cve.now/CVE-2009-3439.md): Multiple SQL injection vulnerabilities in Open Source Security Information Management (OSSIM) before 2.1.2 allow remote authenticated users (no CVSS) - [CVE-2009-3440](https://cve.now/CVE-2009-3440.md): Cross-site scripting (XSS) vulnerability in Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to inje (no CVSS) - [CVE-2009-3441](https://cve.now/CVE-2009-3441.md): Open Source Security Information Management (OSSIM) before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infras (no CVSS) - [CVE-2009-3442](https://cve.now/CVE-2009-3442.md): The Meta tags (aka Nodewords) module before 6.x-1.1 for Drupal does not properly follow permissions during assignment of node meta tags, whi (no CVSS) - [CVE-2009-3443](https://cve.now/CVE-2009-3443.md): SQL injection vulnerability in the Fastball (com\_fastball) component 1.1.0 through 1.2 for Joomla! allows remote attackers to execute arbitr (no CVSS) - [CVE-2009-3444](https://cve.now/CVE-2009-3444.md): Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or H (no CVSS) - [CVE-2009-3445](https://cve.now/CVE-2009-3445.md): Unspecified vulnerability in Code-Crafters Ability Mail Server before 2.70 allows remote attackers to cause a denial of service (daemon cras (no CVSS) - [CVE-2009-3446](https://cve.now/CVE-2009-3446.md): SQL injection vulnerability in the MyRemote Video Gallery (com\_mytube) component 1.0 Beta for Joomla! allows remote attackers to execute arb (no CVSS) - [CVE-2009-2862](https://cve.now/CVE-2009-2862.md): The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows r (no CVSS) - [CVE-2009-2863](https://cve.now/CVE-2009-2863.md): Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication, (no CVSS) - [CVE-2009-2864](https://cve.now/CVE-2009-2864.md): Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7.0.x before 7.0(2a)su1, and 7. (no CVSS) - [CVE-2009-2865](https://cve.now/CVE-2009-2865.md): Buffer overflow in the login implementation in the Extension Mobility feature in the Unified Communications Manager Express (CME) component (no CVSS) - [CVE-2009-2866](https://cve.now/CVE-2009-2866.md): Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted (no CVSS) - [CVE-2009-2867](https://cve.now/CVE-2009-2867.md): Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4T, 12.4XZ, and 12.4YA, when Zone-Based Policy Firewall SIP In (no CVSS) - [CVE-2009-2868](https://cve.now/CVE-2009-2868.md): Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers (no CVSS) - [CVE-2009-2869](https://cve.now/CVE-2009-2869.md): Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to caus (no CVSS) - [CVE-2009-2870](https://cve.now/CVE-2009-2870.md): Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when the Cisco Unified Border Element feature is enabled, allows remote attackers (no CVSS) - [CVE-2009-2871](https://cve.now/CVE-2009-2871.md): Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN sessions, SSH sessions, or IKE encrypted nonces are enabled, allows remote (no CVSS) - [CVE-2009-2872](https://cve.now/CVE-2009-2872.md): Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a (no CVSS) - [CVE-2009-2873](https://cve.now/CVE-2009-2873.md): Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco Express Forwarding feature are enabled, allows remote attackers to cause a (no CVSS) - [CVE-2009-3432](https://cve.now/CVE-2009-3432.md): Unspecified vulnerability in xscreensaver in Sun Solaris 10, and OpenSolaris before snv\_112, when Xorg or Xnewt is used and RandR is enabled (no CVSS) - [CVE-2009-3433](https://cve.now/CVE-2009-3433.md): Unspecified vulnerability in clsetup in the configuration utility in Sun Solaris Cluster 3.2 allows local users to gain privileges via unkno (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-09-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.