# CVEs published 2009-12-01

7 CVEs were published on December 1, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-2626](https://cve.now/CVE-2009-2626.md): The zend\_restore\_ini\_entry\_cb function in zend\_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain (no CVSS)
- [CVE-2009-4120](https://cve.now/CVE-2009-4120.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.Cart 3.4 allow remote attackers to hijack the authentication of the admi (no CVSS)
- [CVE-2009-4121](https://cve.now/CVE-2009-4121.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Quick.CMS 2.4 and Quick.CMS.Lite 2.4 allow remote attackers to hijack the auth (no CVSS)
- [CVE-2009-4117](https://cve.now/CVE-2009-4117.md): Multiple stack-based buffer overflows in pdf\_shade4.c in MuPDF before commit 20091125231942, as used in SumatraPDF before 1.0.1, allow remot (no CVSS)
- [CVE-2009-4118](https://cve.now/CVE-2009-4118.md): The StartServiceCtrlDispatcher function in the cvpnd service (cvpnd.exe) in Cisco VPN client for Windows before 5.0.06.0100 does not properl (no CVSS)
- [CVE-2009-4119](https://cve.now/CVE-2009-4119.md): Cross-site scripting (XSS) vulnerability in Feed Element Mapper module 5.x before 5.x-1.3, 6.x before 6.x-1.3, and 6.x-2.0-alpha before 6.x- (no CVSS)
- [CVE-2009-4128](https://cve.now/CVE-2009-4128.md): GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.