# CVEs published 2009-12-14

12 CVEs were published on December 14, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4320](https://cve.now/CVE-2009-4320.md): Cross-site scripting (XSS) vulnerability in searchform.php in The Next Generation of Genealogy Sitebuilding (TNG) 7.1.2 allows remote attack (no CVSS)
- [CVE-2009-4321](https://cve.now/CVE-2009-4321.md): extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// (no CVSS)
- [CVE-2009-4322](https://cve.now/CVE-2009-4322.md): extras/ipn\_test\_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the insta (no CVSS)
- [CVE-2009-4323](https://cve.now/CVE-2009-4323.md): The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc\_install folders, (no CVSS)
- [CVE-2009-4315](https://cve.now/CVE-2009-4315.md): Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic\_quotes\_gpc is disabled, allows remote attackers to cr (no CVSS)
- [CVE-2009-4316](https://cve.now/CVE-2009-4316.md): Cross-site scripting (XSS) vulnerability in searchresults\_main.php in ZeeLyrics 3x allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-4317](https://cve.now/CVE-2009-4317.md): Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Cart allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2009-4318](https://cve.now/CVE-2009-4318.md): Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-4319](https://cve.now/CVE-2009-4319.md): PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register\_globals is enabled, all (no CVSS)
- [CVE-2009-4129](https://cve.now/CVE-2009-4129.md): Race condition in Mozilla Firefox allows remote attackers to produce a JavaScript message with a spoofed domain association by writing the m (no CVSS)
- [CVE-2009-4130](https://cve.now/CVE-2009-4130.md): Visual truncation vulnerability in the MakeScriptDialogTitle function in nsGlobalWindow.cpp in Mozilla Firefox allows remote attackers to sp (no CVSS)
- [CVE-2009-4314](https://cve.now/CVE-2009-4314.md): Sun Ray Server Software 4.1 on Solaris 10, when Automatic Multi-Group Hotdesking (AMGH) is enabled, responds to a logout action by immediate (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.