# CVEs published 2009-12-16 23 CVEs were published on December 16, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-4138](https://cve.now/CVE-2009-4138.md): drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of (no CVSS) - [CVE-2009-3731](https://cve.now/CVE-2009-3731.md): Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMw (no CVSS) - [CVE-2009-4325](https://cve.now/CVE-2009-4325.md): The Client Interfaces component in IBM DB2 8.2 before FP18, 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not validate an unspecif (no CVSS) - [CVE-2009-4326](https://cve.now/CVE-2009-4326.md): The RAND scalar function in the Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1, when the Database Partiti (no CVSS) - [CVE-2009-4327](https://cve.now/CVE-2009-4327.md): The Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1 does not properly validate the size of a memory pool d (no CVSS) - [CVE-2009-4328](https://cve.now/CVE-2009-4328.md): Unspecified vulnerability in the DRDA Services component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of se (no CVSS) - [CVE-2009-4329](https://cve.now/CVE-2009-4329.md): Unspecified vulnerability in the Engine Utilities component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of (no CVSS) - [CVE-2009-4330](https://cve.now/CVE-2009-4330.md): Unspecified vulnerability in db2licm in the Engine Utilities component in IBM DB2 9.5 before FP5 has unknown impact and local attack vectors (no CVSS) - [CVE-2009-4331](https://cve.now/CVE-2009-4331.md): The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permiss (no CVSS) - [CVE-2009-4332](https://cve.now/CVE-2009-4332.md): db2pd in the Problem Determination component in IBM DB2 9.1 before FP7 and 9.5 before FP5 allows attackers to cause a denial of service (NUL (no CVSS) - [CVE-2009-4333](https://cve.now/CVE-2009-4333.md): The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PA (no CVSS) - [CVE-2009-4334](https://cve.now/CVE-2009-4334.md): The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the (no CVSS) - [CVE-2009-4335](https://cve.now/CVE-2009-4335.md): Multiple unspecified vulnerabilities in bundled stored procedures in the Spatial Extender component in IBM DB2 9.5 before FP5 have unknown i (no CVSS) - [CVE-2008-7248](https://cve.now/CVE-2008-7248.md): Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote at (no CVSS, actionpack) - [CVE-2009-4297](https://cve.now/CVE-2009-4297.md): Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allow remote attackers to hijack (no CVSS) - [CVE-2009-4298](https://cve.now/CVE-2009-4298.md): The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields (no CVSS) - [CVE-2009-4299](https://cve.now/CVE-2009-4299.md): mod/glossary/showentry.php in the Glossary module for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not properly perform access control (no CVSS) - [CVE-2009-4300](https://cve.now/CVE-2009-4300.md): Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user (no CVSS) - [CVE-2009-4301](https://cve.now/CVE-2009-4301.md): mnet/lib.php in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, when MNET services are enabled, does not properly check permissions, which al (no CVSS) - [CVE-2009-4302](https://cve.now/CVE-2009-4302.md): login/index\_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served (no CVSS) - [CVE-2009-4303](https://cve.now/CVE-2009-4303.md): Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow at (no CVSS) - [CVE-2009-4304](https://cve.now/CVE-2009-4304.md): Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to cond (no CVSS) - [CVE-2009-4305](https://cve.now/CVE-2009-4305.md): SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execut (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-12-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.