# CVEs published 2009-11-24 25 CVEs were published on November 24, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-3303](https://cve.now/CVE-2009-3303.md): Cross-site scripting (XSS) vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbi (no CVSS) - [CVE-2009-3576](https://cve.now/CVE-2009-3576.md): Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Sc (no CVSS) - [CVE-2009-3577](https://cve.now/CVE-2009-3577.md): Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a M (no CVSS) - [CVE-2009-3578](https://cve.now/CVE-2009-3578.md): Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) (no CVSS) - [CVE-2009-3896](https://cve.now/CVE-2009-3896.md): src/http/ngx\_http\_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0 (no CVSS) - [CVE-2009-3897](https://cve.now/CVE-2009-3897.md): Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to ac (no CVSS) - [CVE-2009-3898](https://cve.now/CVE-2009-3898.md): Directory traversal vulnerability in src/http/modules/ngx\_http\_dav\_module.c in nginx (aka Engine X) before 0.7.63, and 0.8.x before 0.8.17, (no CVSS) - [CVE-2009-4069](https://cve.now/CVE-2009-4069.md): Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject ar (no CVSS) - [CVE-2009-4070](https://cve.now/CVE-2009-4070.md): SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands v (no CVSS) - [CVE-2009-4071](https://cve.now/CVE-2009-4071.md): Opera before 10.10, when exception stacktraces are enabled, places scripting error messages from a web site into variables that can be read (no CVSS) - [CVE-2009-4072](https://cve.now/CVE-2009-4072.md): Unspecified vulnerability in Opera before 10.10 has unknown impact and attack vectors, related to a "moderately severe issue." (no CVSS) - [CVE-2009-4073](https://cve.now/CVE-2009-4073.md): The printing functionality in Microsoft Internet Explorer 8 allows remote attackers to discover a local pathname, and possibly a local usern (no CVSS) - [CVE-2009-4056](https://cve.now/CVE-2009-4056.md): Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 allows remote attackers to include and execute arbitrary local files v (no CVSS) - [CVE-2009-4057](https://cve.now/CVE-2009-4057.md): SQL injection vulnerability in the inertialFATE iF Portfolio Nexus (com\_if\_nexus) component 1.1 for Joomla! allows remote attackers to execu (no CVSS) - [CVE-2009-4058](https://cve.now/CVE-2009-4058.md): SQL injection vulnerability in allauctions.php in Telebid Auction Script allows remote attackers to execute arbitrary SQL commands via the a (no CVSS) - [CVE-2009-4059](https://cve.now/CVE-2009-4059.md): SQL injection vulnerability in the JoomClip (com\_joomclip) component for Joomla! allows remote attackers to execute arbitrary SQL commands v (no CVSS) - [CVE-2009-4060](https://cve.now/CVE-2009-4060.md): SQL injection vulnerability in includes/content/viewProd.inc.php in CubeCart before 4.3.7 remote attackers to execute arbitrary SQL commands (no CVSS) - [CVE-2009-4061](https://cve.now/CVE-2009-4061.md): Multiple cross-site scripting (XSS) vulnerabilities in the Agreement module 6.x before 6.x-1.2 for Drupal allow remote attackers to inject a (no CVSS) - [CVE-2009-4062](https://cve.now/CVE-2009-4062.md): Multiple cross-site scripting (XSS) vulnerabilities in the Printfriendly module 6.x before 6.x-1.6 for Drupal allow remote attackers to inje (no CVSS) - [CVE-2009-4063](https://cve.now/CVE-2009-4063.md): Cross-site scripting (XSS) vulnerability in the Subgroups for Organic Groups (OG) module 5.x before 5.x-4.0 and 5.x before 5.x-3.4 for Drupa (no CVSS) - [CVE-2009-4064](https://cve.now/CVE-2009-4064.md): Cross-site scripting (XSS) vulnerability in the Gallery Assist module 6.x before 6.x-1.7 for Drupal allows remote attackers to inject arbitr (no CVSS) - [CVE-2009-4065](https://cve.now/CVE-2009-4065.md): Cross-site scripting (XSS) vulnerability in the settings page in the Strongarm module 6.x before 6.x-1.1 for Drupal allows remote attackers (no CVSS) - [CVE-2009-4066](https://cve.now/CVE-2009-4066.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 (no CVSS) - [CVE-2009-3843](https://cve.now/CVE-2009-3843.md): HP Operations Manager 8.10 on Windows contains a "hidden account" in the XML file that specifies Tomcat users, which allows remote attackers (no CVSS) - [CVE-2009-4017](https://cve.now/CVE-2009-4017.md): PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST re (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-11-24 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.