# CVEs published 2009-11-20 20 CVEs were published on November 20, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2005-4882](https://cve.now/CVE-2005-4882.md): tftpd in Philippe Jounin Tftpd32 2.74 and earlier, as used in Wyse Simple Imager (WSI) and other products, allows remote attackers to cause (no CVSS) - [CVE-2005-4883](https://cve.now/CVE-2005-4883.md): Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote attackers to cause a denial of service (daemon crash) via invalid "conne (no CVSS) - [CVE-2009-4037](https://cve.now/CVE-2009-4037.md): Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7, and 2.2.x before 2.2 RC, allow remote attackers to execute arbi (no CVSS) - [CVE-2009-4038](https://cve.now/CVE-2009-4038.md): Multiple cross-site scripting (XSS) vulnerabilities in NCH Software Axon Virtual PBX 2.10 and 2.11 allow remote attackers to inject arbitrar (no CVSS) - [CVE-2009-4039](https://cve.now/CVE-2009-4039.md): Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecifi (no CVSS) - [CVE-2009-4040](https://cve.now/CVE-2009-4040.md): Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and 2.5.x before 2.5.2, when used with Internet Explorer 6 or 7, allows r (no CVSS) - [CVE-2009-4041](https://cve.now/CVE-2009-4041.md): UseBB 1.0.9 before 1.0.10 allows remote attackers to cause a denial of service (infinite loop) via crafted BBCode tags. (no CVSS) - [CVE-2009-4042](https://cve.now/CVE-2009-4042.md): Cross-site scripting (XSS) vulnerability in the RootCandy theme 6.x before 6.x-1.5 for Drupal allows remote attackers to inject arbitrary we (no CVSS) - [CVE-2009-4043](https://cve.now/CVE-2009-4043.md): Cross-site scripting (XSS) vulnerability in the AddToAny module 5.x before 5.x-2.4 and 6.x before 6.x-2.4 for Drupal allows remote attackers (no CVSS) - [CVE-2009-4044](https://cve.now/CVE-2009-4044.md): The Web Services module 6.x for Drupal does not perform the expected access control, which allows remote attackers to make unspecified use o (no CVSS) - [CVE-2009-4045](https://cve.now/CVE-2009-4045.md): Multiple SQL injection vulnerabilities in FrontAccounting (FA) before 2.1.7 allow remote attackers to execute arbitrary SQL commands via uns (no CVSS) - [CVE-2009-4046](https://cve.now/CVE-2009-4046.md): Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x before 2.2 RC allow remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2009-3895](https://cve.now/CVE-2009-3895.md): Heap-based buffer overflow in the exif\_entry\_fix function (aka the tag fixup routine) in libexif/exif-entry.c in libexif 0.6.18 allows remot (no CVSS) - [CVE-2009-3080](https://cve.now/CVE-2009-3080.md): Array index error in the gdth\_read\_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a (no CVSS) - [CVE-2009-3386](https://cve.now/CVE-2009-3386.md): Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the alias of a private bug by reading (no CVSS) - [CVE-2009-3842](https://cve.now/CVE-2009-3842.md): Unspecified vulnerability on the HP Color LaserJet M3530 Multifunction Printer with firmware 05.058.4 and the Color LaserJet CP3525 Printer (no CVSS) - [CVE-2009-4006](https://cve.now/CVE-2009-4006.md): Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5, and other versions before 9.1.0.0 (no CVSS) - [CVE-2009-3553](https://cve.now/CVE-2009-3553.md): Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the s (no CVSS) - [CVE-2009-4004](https://cve.now/CVE-2009-4004.md): Buffer overflow in the kvm\_vcpu\_ioctl\_x86\_setup\_mce function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc (no CVSS) - [CVE-2009-4005](https://cve.now/CVE-2009-4005.md): The collect\_rx\_frame function in drivers/isdn/hisax/hfc\_usb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-11-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.