# CVEs published 2009-11-28 19 CVEs were published on November 28, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-4111](https://cve.now/CVE-2009-4111.md): Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remot (no CVSS) - [CVE-2009-4023](https://cve.now/CVE-2009-4023.md): Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for (no CVSS) - [CVE-2009-4024](https://cve.now/CVE-2009-4024.md): Argument injection vulnerability in the ping function in Ping.php in the Net\_Ping package before 2.4.5 for PEAR allows remote attackers to e (no CVSS) - [CVE-2009-4025](https://cve.now/CVE-2009-4025.md): Argument injection vulnerability in the traceroute function in Traceroute.php in the Net\_Traceroute package before 0.21.2 for PEAR allows re (no CVSS) - [CVE-2009-4096](https://cve.now/CVE-2009-4096.md): RADIO istek scripti 2.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to o (no CVSS) - [CVE-2009-4097](https://cve.now/CVE-2009-4097.md): Stack-based buffer overflow in the MplayInputFile function in Serenity Audio Player 3.2.3 and earlier allows remote attackers to execute arb (no CVSS) - [CVE-2009-4098](https://cve.now/CVE-2009-4098.md): Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner (no CVSS) - [CVE-2009-4099](https://cve.now/CVE-2009-4099.md): SQL injection vulnerability in the Google Calendar GCalendar (com\_gcalendar) component 1.1.2, 2.1.4, and possibly earlier versions for Jooml (no CVSS) - [CVE-2009-4100](https://cve.now/CVE-2009-4100.md): Yoono extension before 6.1.1 for Firefox performs certain operations with chrome privileges, which allows user-assisted remote attackers to (no CVSS) - [CVE-2009-4101](https://cve.now/CVE-2009-4101.md): infoRSS 1.1.4.2 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execu (no CVSS) - [CVE-2009-4102](https://cve.now/CVE-2009-4102.md): Sage 1.4.3 and earlier extension for Firefox performs certain operations with chrome privileges, which allows remote attackers to execute ar (no CVSS) - [CVE-2009-4103](https://cve.now/CVE-2009-4103.md): Buffer overflow in Robo-FTP 3.6.17, and possibly other versions, allows remote FTP servers to cause a denial of service and possibly execute (no CVSS) - [CVE-2009-4104](https://cve.now/CVE-2009-4104.md): SQL injection vulnerability in Lyften Designs LyftenBloggie (com\_lyftenbloggie) component 1.0.4 for Joomla! allows remote attackers to execu (no CVSS) - [CVE-2009-4105](https://cve.now/CVE-2009-4105.md): TYPSoft FTP Server 1.10 allows remote authenticated users to cause a denial of service (crash) by sending an APPE (append) command immediate (no CVSS) - [CVE-2009-4106](https://cve.now/CVE-2009-4106.md): Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execu (no CVSS) - [CVE-2009-4107](https://cve.now/CVE-2009-4107.md): Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted remote attackers to execute arbitrary code via a crafted .ibkey file conta (no CVSS) - [CVE-2009-4108](https://cve.now/CVE-2009-4108.md): XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to cause a denial of service (crash) by uploading or creating a large nu (no CVSS) - [CVE-2009-4109](https://cve.now/CVE-2009-4109.md): The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent anonymous users from accessing functionality related to determination of (no CVSS) - [CVE-2009-4110](https://cve.now/CVE-2009-4110.md): Cross-site scripting (XSS) vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbit (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-11-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.