# CVEs published 2009-11-09 24 CVEs were published on November 9, 2009: 1 critical, 0 high. Days are UTC. - [CVE-2009-3726](https://cve.now/CVE-2009-3726.md): The nfs4\_proc\_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to caus (no CVSS) - [CVE-2009-3728](https://cve.now/CVE-2009-3728.md): Directory traversal vulnerability in the ICC\_Profile.getInstance method in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 2 (no CVSS) - [CVE-2009-3729](https://cve.now/CVE-2009-3729.md): Unspecified vulnerability in the TrueType font parsing functionality in Sun Java SE 5.0 before Update 22 and 6 before Update 17 allows remot (no CVSS) - [CVE-2009-3879](https://cve.now/CVE-2009-3879.md): Multiple unspecified vulnerabilities in the (1) X11 and (2) Win32GraphicsDevice subsystems in Sun Java SE 5.0 before Update 22 and 6 before (no CVSS) - [CVE-2009-3880](https://cve.now/CVE-2009-3880.md): The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, (no CVSS) - [CVE-2009-3881](https://cve.now/CVE-2009-3881.md): Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoade (no CVSS) - [CVE-2009-3882](https://cve.now/CVE-2009-3882.md): Multiple unspecified vulnerabilities in the Swing implementation in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, ha (no CVSS) - [CVE-2009-3883](https://cve.now/CVE-2009-3883.md): Multiple unspecified vulnerabilities in the Windows Pluggable Look and Feel (PL&F) feature in the Swing implementation in Sun Java SE 5.0 be (no CVSS) - [CVE-2009-3884](https://cve.now/CVE-2009-3884.md): The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determin (no CVSS) - [CVE-2009-3885](https://cve.now/CVE-2009-3885.md): Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows allows remote attackers to cause a denial of service via a BMP file conta (no CVSS) - [CVE-2009-3886](https://cve.now/CVE-2009-3886.md): The Java Web Start implementation in Sun Java SE 6 before Update 17 does not properly handle the interaction between a signed JAR file and a (no CVSS) - [CVE-2009-3555](https://cve.now/CVE-2009-3555.md): The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod\_ssl in th (CVSS 9.8, org.apache.tomcat:tomcat) - [CVE-2009-3911](https://cve.now/CVE-2009-3911.md): Cross-site scripting (XSS) vulnerability in settings.php in TFTgallery 0.13 allows remote attackers to inject arbitrary web script or HTML v (no CVSS) - [CVE-2009-3912](https://cve.now/CVE-2009-3912.md): Directory traversal vulnerability in index.php in TFTgallery 0.13 allows remote attackers to read arbitrary files via a ..%2F (encoded dot d (no CVSS) - [CVE-2009-3913](https://cve.now/CVE-2009-3913.md): SQL injection vulnerability in summary.php in Xerox Fiery Webtools allows remote attackers to execute arbitrary SQL commands via the select (no CVSS) - [CVE-2009-3914](https://cve.now/CVE-2009-3914.md): Cross-site scripting (XSS) vulnerability in the Temporary Invitation module 5.x before 5.x-2.3 for Drupal allows remote attackers to inject (no CVSS) - [CVE-2009-3915](https://cve.now/CVE-2009-3915.md): Cross-site scripting (XSS) vulnerability in the "Separate title and URL" formatter in the Link module 5.x before 5.x-2.6 and 6.x before 6.x- (no CVSS) - [CVE-2009-3916](https://cve.now/CVE-2009-3916.md): Cross-site scripting (XSS) vulnerability in the Node Hierarchy module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows (no CVSS) - [CVE-2009-3917](https://cve.now/CVE-2009-3917.md): Cross-site scripting (XSS) vulnerability in the S5 Presentation Player module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to i (no CVSS) - [CVE-2009-3918](https://cve.now/CVE-2009-3918.md): Cross-site scripting (XSS) vulnerability in the Zoomify module 5.x before 5.x-2.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote (no CVSS) - [CVE-2009-3919](https://cve.now/CVE-2009-3919.md): Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attacke (no CVSS) - [CVE-2009-3920](https://cve.now/CVE-2009-3920.md): An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access co (no CVSS) - [CVE-2009-3921](https://cve.now/CVE-2009-3921.md): The Smartqueue\_og module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-rc3, a module for Drupal, does not verify group-node privileges in certai (no CVSS) - [CVE-2009-3922](https://cve.now/CVE-2009-3922.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module fo (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-11-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.