# CVEs published 2009-11-23

10 CVEs were published on November 23, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3557](https://cve.now/CVE-2009-3557.md): The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe\_mo (no CVSS)
- [CVE-2009-3558](https://cve.now/CVE-2009-3558.md): The posix\_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open (no CVSS)
- [CVE-2009-4047](https://cve.now/CVE-2009-4047.md): Multiple cross-site scripting (XSS) vulnerabilities in PHD Help Desk 1.43 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2009-4048](https://cve.now/CVE-2009-4048.md): Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (daemon outage) via an APPE command (no CVSS)
- [CVE-2009-4049](https://cve.now/CVE-2009-4049.md): Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in avast! Home and Professional 4.8.1356.0 allows local users to cause a d (no CVSS)
- [CVE-2009-4050](https://cve.now/CVE-2009-4050.md): Directory traversal vulnerability in get\_file.php in phpMyBackupPro 2.1 allows remote attackers to read arbitrary files via directory traver (no CVSS)
- [CVE-2009-4051](https://cve.now/CVE-2009-4051.md): Home FTP Server 1.10.1.139 allows remote attackers to cause a denial of service (daemon outage) via multiple invalid SITE INDEX commands. (no CVSS)
- [CVE-2009-4052](https://cve.now/CVE-2009-4052.md): Multiple cross-site scripting (XSS) vulnerabilities in the JSF Widget Library Runtime in IBM Rational Application Developer for WebSphere So (no CVSS)
- [CVE-2009-4053](https://cve.now/CVE-2009-4053.md): Multiple directory traversal vulnerabilities in Home FTP Server 1.10.1.139 allow remote authenticated users to (1) create arbitrary director (no CVSS)
- [CVE-2009-3559](https://cve.now/CVE-2009-3559.md): main/streams/plain\_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe\_mode\_include\_dir directive, which allows context-dependen (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.