# CVEs published 2009-12-04

21 CVEs were published on December 4, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4211](https://cve.now/CVE-2009-4211.md): The U.S. (no CVSS)
- [CVE-2009-3560](https://cve.now/CVE-2009-3560.md): The big2\_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attac (no CVSS)
- [CVE-2009-4020](https://cve.now/CVE-2009-4020.md): Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a craf (no CVSS)
- [CVE-2009-3304](https://cve.now/CVE-2009-3304.md): GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized\_keys files in users' ho (no CVSS)
- [CVE-2009-4148](https://cve.now/CVE-2009-4148.md): DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers to execute arbitrary JavaScript code via a (1) .ds, (2) .dsa, (3) .ds (no CVSS)
- [CVE-2009-4198](https://cve.now/CVE-2009-4198.md): SQL injection vulnerability in my\_orders.php in MyMiniBill allows remote authenticated users to execute arbitrary SQL commands via the order (no CVSS)
- [CVE-2009-4199](https://cve.now/CVE-2009-4199.md): Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos Res or com\_mosres) component 1.0f for Mambo and Joomla!, when magic\_qu (no CVSS)
- [CVE-2009-4200](https://cve.now/CVE-2009-4200.md): SQL injection vulnerability in the Seminar (com\_seminar) component 1.28 for Joomla! allows remote attackers to execute arbitrary SQL command (no CVSS)
- [CVE-2009-4201](https://cve.now/CVE-2009-4201.md): Multiple stack-based buffer overflows in Mp3 Tag Assistant Professional 2.92 build 300 allow remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2009-4202](https://cve.now/CVE-2009-4202.md): Directory traversal vulnerability in the Omilen Photo Gallery (com\_omphotogallery) component Beta 0.5 for Joomla! allows remote attackers to (no CVSS)
- [CVE-2009-4203](https://cve.now/CVE-2009-4203.md): Multiple SQL injection vulnerabilities in admin/aclass/admin\_func.php in Arab Portal 2.2 allow remote attackers to execute arbitrary SQL com (no CVSS)
- [CVE-2009-4204](https://cve.now/CVE-2009-4204.md): SQL injection vulnerability in read.php in Flashlight Free Edition allows remote attackers to execute arbitrary SQL commands via the id para (no CVSS)
- [CVE-2009-4205](https://cve.now/CVE-2009-4205.md): Directory traversal vulnerability in admin.php in Flashlight Free Edition allows remote attackers to include and execute arbitrary local fil (no CVSS)
- [CVE-2009-4206](https://cve.now/CVE-2009-4206.md): SQL injection vulnerability in admin.link.modify.php in Million Dollar Text Links 1.0 and earlier allows remote attackers to execute arbitra (no CVSS)
- [CVE-2009-4207](https://cve.now/CVE-2009-4207.md): Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.7 and 6.x before 6.x-2.7, a module for Drupal, allows remote (no CVSS)
- [CVE-2009-4208](https://cve.now/CVE-2009-4208.md): SQL injection vulnerability in the os\_news module in Open-school (OS) 1.0 allows remote attackers to execute arbitrary SQL commands via the (no CVSS)
- [CVE-2009-4209](https://cve.now/CVE-2009-4209.md): Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in moziloCMS 1.11.1 allow remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2009-2631](https://cve.now/CVE-2009-2631.md): Clientless SSL VPN products break web browser domain-based security models (no CVSS, Cisco Adaptive Security Appliance Web SSL VPN · Palo Alto P…)
- [CVE-2009-4195](https://cve.now/CVE-2009-4195.md): Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code vi (no CVSS)
- [CVE-2009-4196](https://cve.now/CVE-2009-4196.md): Multiple cross-site scripting (XSS) vulnerabilities in multiple scripts in Forms/ in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9. (no CVSS)
- [CVE-2009-4197](https://cve.now/CVE-2009-4197.md): rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware 3.7.9.98 contains a form that does not disable the autocomplete setting f (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.