# CVEs published 2009-12-07

11 CVEs were published on December 7, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4214](https://cve.now/CVE-2009-4214.md): Cross-site scripting (XSS) vulnerability in the strip\_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote att (no CVSS, rails)
- [CVE-2009-4215](https://cve.now/CVE-2009-4215.md): Panda Global Protection 2010, Internet Security 2010, and Antivirus Pro 2010 use weak permissions (Everyone: Full Control) for the product f (no CVSS)
- [CVE-2009-4216](https://cve.now/CVE-2009-4216.md): Directory traversal vulnerability in funzioni/lib/menulast.php in klinza professional cms 5.0.1 and earlier allows remote attackers to inclu (no CVSS)
- [CVE-2009-4217](https://cve.now/CVE-2009-4217.md): SQL injection vulnerability in the Itamar Elharar MusicGallery (com\_musicgallery) component for Joomla! allows remote attackers to execute a (no CVSS)
- [CVE-2009-4218](https://cve.now/CVE-2009-4218.md): Multiple SQL injection vulnerabilities in files/login.asp in JiRo's Banner System eXperience (JBSX) allow remote attackers to execute arbitr (no CVSS)
- [CVE-2009-4219](https://cve.now/CVE-2009-4219.md): Stack-based buffer overflow in the MYACTIVEX.MyActiveXCtrl.1 ActiveX control in MyActiveX.ocx 1.4.8.0 in Haihaisoft Universal Player allows (no CVSS)
- [CVE-2009-4220](https://cve.now/CVE-2009-4220.md): PHP remote file inclusion vulnerability in includes/classes/pctemplate.php in PointComma 3.8b2 and earlier allows remote attackers to execut (no CVSS)
- [CVE-2009-4221](https://cve.now/CVE-2009-4221.md): SQL injection vulnerability in classified.php in phpBazar 2.1.1fix and earlier allows remote attackers to execute arbitrary SQL commands via (no CVSS)
- [CVE-2009-4222](https://cve.now/CVE-2009-4222.md): phpBazar 2.1.1fix and earlier does not require administrative authentication for admin/admin.php, which allows remote attackers to obtain ac (no CVSS)
- [CVE-2009-4223](https://cve.now/CVE-2009-4223.md): PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web 1.1b2 and earlier allows remote attackers to execute arbitrary PHP code (no CVSS)
- [CVE-2009-4224](https://cve.now/CVE-2009-4224.md): Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, 0.5.3, and earlier allow remote attackers to execute arbitrary PHP co (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.