# CVEs published 2009-11-27

21 CVEs were published on November 27, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4082](https://cve.now/CVE-2009-4082.md): PHP remote file inclusion vulnerability in forums/Forum\_Include/index.php in Outreach Project Tool (OPT) 1.2.7 and earlier allows remote att (no CVSS)
- [CVE-2009-4083](https://cve.now/CVE-2009-4083.md): Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML (no CVSS)
- [CVE-2009-4084](https://cve.now/CVE-2009-4084.md): SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via u (no CVSS)
- [CVE-2009-4085](https://cve.now/CVE-2009-4085.md): PHP remote file inclusion vulnerability in assets/plugins/mp3\_id/mp3\_id.php in PHP Traverser 0.8.0 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2009-4086](https://cve.now/CVE-2009-4086.md): CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP r (no CVSS)
- [CVE-2009-4087](https://cve.now/CVE-2009-4087.md): Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki 2.4.23 and earlier allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2009-4088](https://cve.now/CVE-2009-4088.md): Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via director (no CVSS)
- [CVE-2009-4089](https://cve.now/CVE-2009-4089.md): telepark.wiki 2.4.23 and earlier allows remote attackers to bypass authorization and (1) delete arbitrary pages via a modified pageID parame (no CVSS)
- [CVE-2009-4090](https://cve.now/CVE-2009-4090.md): Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute (no CVSS)
- [CVE-2009-4091](https://cve.now/CVE-2009-4091.md): comments.php in Simplog 0.9.3.2, and possibly earlier, does not properly restrict access, which allows remote attackers to edit or delete co (no CVSS)
- [CVE-2009-4092](https://cve.now/CVE-2009-4092.md): Cross-site request forgery (CSRF) vulnerability in user.php in Simplog 0.9.3.2, and possibly earlier, allows remote attackers to hijack the (no CVSS)
- [CVE-2009-4093](https://cve.now/CVE-2009-4093.md): Multiple cross-site scripting (XSS) vulnerabilities in comments.php in Simplog 0.9.3.2, and possibly earlier, allow remote attackers to inje (no CVSS)
- [CVE-2009-4094](https://cve.now/CVE-2009-4094.md): PHP remote file inclusion vulnerability in class/php/d4m\_ajax\_pagenav.php in the D4J eZine (com\_ezine) component 2.1 for Joomla! allows remo (no CVSS)
- [CVE-2009-4095](https://cve.now/CVE-2009-4095.md): myPhile 1.2.1 allows remote attackers to bypass authentication via an empty password. (no CVSS)
- [CVE-2009-3736](https://cve.now/CVE-2009-3736.md): ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, att (no CVSS)
- [CVE-2009-3894](https://cve.now/CVE-2009-3894.md): Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module i (no CVSS)
- [CVE-2009-4080](https://cve.now/CVE-2009-4080.md): Multiple unspecified vulnerabilities in ldap\_cachemgr (aka the LDAP client configuration cache daemon) in Sun Solaris 9 and 10, and OpenSola (no CVSS)
- [CVE-2009-4081](https://cve.now/CVE-2009-4081.md): Untrusted search path vulnerability in dstat before r3199 allows local users to gain privileges via a Trojan horse Python module in the curr (no CVSS)
- [CVE-2009-4018](https://cve.now/CVE-2009-4018.md): The proc\_open function in ext/standard/proc\_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe\_mode\_allowed\_en (no CVSS)
- [CVE-2009-4031](https://cve.now/CVE-2009-4031.md): The do\_insn\_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-200 (no CVSS)
- [CVE-2009-4032](https://cve.now/CVE-2009-4032.md): Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vector (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-11-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.