# CVEs published 2009-09-29

24 CVEs were published on September 29, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3474](https://cve.now/CVE-2009-3474.md): OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow (no CVSS)
- [CVE-2009-3475](https://cve.now/CVE-2009-3475.md): Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly (no CVSS)
- [CVE-2009-3476](https://cve.now/CVE-2009-3476.md): Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before (no CVSS)
- [CVE-2009-3477](https://cve.now/CVE-2009-3477.md): The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 befor (no CVSS)
- [CVE-2009-3478](https://cve.now/CVE-2009-3478.md): Argument injection vulnerability in (1) src/content/js/connection/sftp.js and (2) src/content/js/connection/controlSocket.js.in in FireFTP E (no CVSS)
- [CVE-2009-3470](https://cve.now/CVE-2009-3470.md): IBM Informix Dynamic Server (IDS) 10.00 before 10.00.xC11, 11.10 before 11.10.xC4, and 11.50 before 11.50.xC5 allows remote attackers to cau (no CVSS)
- [CVE-2009-3471](https://cve.now/CVE-2009-3471.md): IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and 9.7 before FP2 does not perform the expected drops of certain table functions upo (no CVSS)
- [CVE-2009-3472](https://cve.now/CVE-2009-3472.md): IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 allows remote authenticated users to bypass intended access restrictions, and upda (no CVSS)
- [CVE-2009-3473](https://cve.now/CVE-2009-3473.md): IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impa (no CVSS)
- [CVE-2009-2905](https://cve.now/CVE-2009-2905.md): Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application cras (no CVSS)
- [CVE-2009-3468](https://cve.now/CVE-2009-3468.md): Multiple unspecified vulnerabilities in Common Desktop Environment (CDE) in Sun Solaris 10, when Trusted Extensions is enabled, allow local (no CVSS)
- [CVE-2009-3469](https://cve.now/CVE-2009-3469.md): Cross-site scripting (XSS) vulnerability in profiles/html/simpleSearch.do in IBM Lotus Connections 2.0.1 allows remote attackers to inject a (no CVSS)
- [CVE-2009-2681](https://cve.now/CVE-2009-2681.md): Unspecified vulnerability in HP ProCurve Identity Driven Manager (IDM) A.02.x through A.02.03 and A.03.x through A.03.00, on Windows Server (no CVSS)
- [CVE-2009-2683](https://cve.now/CVE-2009-2683.md): Unspecified vulnerability in the Sender module in HP Remote Graphics Software (RGS) 5.1.3 through 5.2.6 allows remote authenticated users to (no CVSS)
- [CVE-2009-3453](https://cve.now/CVE-2009-3453.md): Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Quickr 8.1.0 services for WebSphere Portal allow remote attackers to inject (no CVSS)
- [CVE-2009-3455](https://cve.now/CVE-2009-3455.md): Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN (no CVSS)
- [CVE-2009-3456](https://cve.now/CVE-2009-3456.md): Google Chrome, possibly 3.0.195.21 and earlier, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) (no CVSS)
- [CVE-2009-3457](https://cve.now/CVE-2009-3457.md): Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) before 6.1 allow remote attackers to obtain sensitive information via an (no CVSS)
- [CVE-2009-3447](https://cve.now/CVE-2009-3447.md): Unrestricted file upload vulnerability in RADactive I-Load before 2008.2.5.0 allows remote attackers to execute arbitrary code by uploading (no CVSS)
- [CVE-2009-3448](https://cve.now/CVE-2009-3448.md): npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote attackers to cause a denial of service (daemon crash) via a packet to (1) (no CVSS)
- [CVE-2009-3449](https://cve.now/CVE-2009-3449.md): MP3 Collector 2.3 allows remote attackers to cause a denial of service (application crash) via a long URL in a .m3u playlist file. (no CVSS)
- [CVE-2009-3450](https://cve.now/CVE-2009-3450.md): Multiple cross-site scripting (XSS) vulnerabilities in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allow remote attackers to in (no CVSS)
- [CVE-2009-3451](https://cve.now/CVE-2009-3451.md): Directory traversal vulnerability in WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to read arbitrary file (no CVSS)
- [CVE-2009-3452](https://cve.now/CVE-2009-3452.md): WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote attackers to obtain sensitive information via unspecified requests th (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.