# CVEs published 2009-12-17 30 CVEs were published on December 17, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-4351](https://cve.now/CVE-2009-4351.md): SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, when magic\_quotes\_gpc is disabled, allows remote attackers to execute (no CVSS) - [CVE-2009-4352](https://cve.now/CVE-2009-4352.md): Multiple cross-site scripting (XSS) vulnerabilities in TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other vers (no CVSS) - [CVE-2009-4353](https://cve.now/CVE-2009-4353.md): The Mobile Edition of TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0911, does (no CVSS) - [CVE-2009-4354](https://cve.now/CVE-2009-4354.md): TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session ID in a session cookie, which allows remot (no CVSS) - [CVE-2009-3388](https://cve.now/CVE-2009-3388.md): liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of ser (no CVSS) - [CVE-2009-3389](https://cve.now/CVE-2009-3389.md): Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used in Mozilla Firefox 3.5 before 3.5.6 and SeaMonkey before 2.0.1, allows (no CVSS) - [CVE-2009-3979](https://cve.now/CVE-2009-3979.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, SeaMonkey before 2.0.1, (no CVSS) - [CVE-2009-3980](https://cve.now/CVE-2009-3980.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird al (no CVSS) - [CVE-2009-3981](https://cve.now/CVE-2009-3981.md): Unspecified vulnerability in the browser engine in Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird allows remote atta (no CVSS) - [CVE-2009-3982](https://cve.now/CVE-2009-3982.md): Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird (no CVSS) - [CVE-2009-3983](https://cve.now/CVE-2009-3983.md): Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to (no CVSS) - [CVE-2009-3984](https://cve.now/CVE-2009-3984.md): Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to spoof an SSL indicator for an h (no CVSS) - [CVE-2009-3985](https://cve.now/CVE-2009-3985.md): Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to associate spoofed content with (no CVSS) - [CVE-2009-3986](https://cve.now/CVE-2009-3986.md): Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to execute arbitrary JavaScript wi (no CVSS) - [CVE-2009-3987](https://cve.now/CVE-2009-3987.md): The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, generates different exc (no CVSS) - [CVE-2009-4336](https://cve.now/CVE-2009-4336.md): Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth Calendar (pd\_calendar) extension 0.4.1 and earlier for TYPO3 allows re (no CVSS) - [CVE-2009-4337](https://cve.now/CVE-2009-4337.md): SQL injection vulnerability in the Diocese of Portsmouth Calendar (pd\_calendar) extension 0.4.1 and earlier for TYPO3 allows remote attacker (no CVSS) - [CVE-2009-4338](https://cve.now/CVE-2009-4338.md): SQL injection vulnerability in the Flash SlideShow (slideshow) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL co (no CVSS) - [CVE-2009-4339](https://cve.now/CVE-2009-4339.md): SQL injection vulnerability in the Subscription (mf\_subscription) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL (no CVSS) - [CVE-2009-4340](https://cve.now/CVE-2009-4340.md): Cross-site scripting (XSS) vulnerability in the No indexed Search (no\_indexed\_search) extension 0.2.0 for TYPO3 allows remote attackers to i (no CVSS) - [CVE-2009-4341](https://cve.now/CVE-2009-4341.md): SQL injection vulnerability in the No indexed Search (no\_indexed\_search) extension 0.2.0 for TYPO3 allows remote attackers to execute arbitr (no CVSS) - [CVE-2009-4342](https://cve.now/CVE-2009-4342.md): SQL injection vulnerability in the Job Exchange (jobexchange) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL com (no CVSS) - [CVE-2009-4343](https://cve.now/CVE-2009-4343.md): Cross-site scripting (XSS) vulnerability in the Training Company Database (trainincdb) extension 0.4.7 for TYPO3 allows remote attackers to (no CVSS) - [CVE-2009-4344](https://cve.now/CVE-2009-4344.md): Cross-site scripting (XSS) vulnerability in the ZID Linkliste (zid\_linklist) extension 1.0.0 for TYPO3 allows remote attackers to inject arb (no CVSS) - [CVE-2009-4345](https://cve.now/CVE-2009-4345.md): Cross-site scripting (XSS) vulnerability in the vShoutbox (vshoutbox) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary (no CVSS) - [CVE-2009-4346](https://cve.now/CVE-2009-4346.md): Cross-site scripting (XSS) vulnerability in the Frontend news submitter with RTE (fe\_rtenews) extension 1.4.1 and earlier for TYPO3 allows r (no CVSS) - [CVE-2009-4347](https://cve.now/CVE-2009-4347.md): Cross-site scripting (XSS) vulnerability in daloradius-users/login.php in daloRADIUS 0.9-8 and earlier allows remote attackers to inject arb (no CVSS) - [CVE-2009-4348](https://cve.now/CVE-2009-4348.md): Cross-site scripting (XSS) vulnerability in index.php in Harold Bakker's NewsScript (HB-NS) 1.3 allows remote attackers to inject arbitrary (no CVSS) - [CVE-2009-4349](https://cve.now/CVE-2009-4349.md): Cross-site request forgery (CSRF) vulnerability in administration/administrators.php in Link Up Gold 5.0 allows remote attackers to hijack t (no CVSS) - [CVE-2009-4350](https://cve.now/CVE-2009-4350.md): SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 allows remote attackers to execute arbitrary SQL commands via the (1) (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-12-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.