# CVEs published 2009-12-21 26 CVEs were published on December 21, 2009: 0 critical, 1 high. Days are UTC. - [CVE-2009-4035](https://cve.now/CVE-2009-4035.md): The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and ve (no CVSS) - [CVE-2009-4376](https://cve.now/CVE-2009-4376.md): Buffer overflow in the daintree\_sna\_read function in the Daintree SNA file parser in Wireshark 1.2.0 through 1.2.4 allows remote attackers t (no CVSS) - [CVE-2009-4377](https://cve.now/CVE-2009-4377.md): The (1) SMB and (2) SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 allow remote attackers to cause a denial of service (crash) via a craft (no CVSS) - [CVE-2009-4378](https://cve.now/CVE-2009-4378.md): The IPMI dissector in Wireshark 1.2.0 through 1.2.4 on Windows allows remote attackers to cause a denial of service (crash) via a crafted pa (no CVSS) - [CVE-2009-3701](https://cve.now/CVE-2009-3701.md): Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in Horde Application Framework before 3.3.6, Horde Group (no CVSS) - [CVE-2009-3791](https://cve.now/CVE-2009-3791.md): Unspecified vulnerability in Adobe Flash Media Server (FMS) before 3.5.3 allows attackers to cause a denial of service (resource exhaustion) (CVSS 7.5) - [CVE-2009-3792](https://cve.now/CVE-2009-3792.md): Directory traversal vulnerability in Adobe Flash Media Server (FMS) before 3.5.3 allows attackers to load arbitrary DLL files via unspecifie (no CVSS) - [CVE-2009-4142](https://cve.now/CVE-2009-4142.md): The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift\_JIS sequences, a (no CVSS) - [CVE-2009-4143](https://cve.now/CVE-2009-4143.md): PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption (no CVSS) - [CVE-2009-4261](https://cve.now/CVE-2009-4261.md): Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 befor (no CVSS) - [CVE-2009-4270](https://cve.now/CVE-2009-4270.md): Stack-based buffer overflow in the errprintf function in base/gsmisc.c in ghostscript 8.64 through 8.70 allows remote attackers to cause a d (no CVSS) - [CVE-2009-4361](https://cve.now/CVE-2009-4361.md): Multiple buffer overflows in qoslist in IBM AIX 6.1 allow local users to cause a denial of service (application crash) or possibly gain priv (no CVSS) - [CVE-2009-4362](https://cve.now/CVE-2009-4362.md): Multiple buffer overflows in qosmod in IBM AIX 6.1 allow local users to cause a denial of service (application crash) or possibly gain privi (no CVSS) - [CVE-2009-4363](https://cve.now/CVE-2009-4363.md): Text\_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Web (no CVSS) - [CVE-2009-4364](https://cve.now/CVE-2009-4364.md): Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog allows remote attackers to inject arbitrary web script or HTML vi (no CVSS) - [CVE-2009-4365](https://cve.now/CVE-2009-4365.md): Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ScriptsEz Ez Blog 1.0 allow remote attackers to hijack the authen (no CVSS) - [CVE-2009-4366](https://cve.now/CVE-2009-4366.md): Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Blog 1.0 allows remote attackers to inject arbitrary web script or HTM (no CVSS) - [CVE-2009-4367](https://cve.now/CVE-2009-4367.md): The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote a (no CVSS) - [CVE-2009-4368](https://cve.now/CVE-2009-4368.md): Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) traceroute to (no CVSS) - [CVE-2009-4369](https://cve.now/CVE-2009-4369.md): Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drup (no CVSS) - [CVE-2009-4370](https://cve.now/CVE-2009-4370.md): Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authe (no CVSS) - [CVE-2009-4371](https://cve.now/CVE-2009-4371.md): Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other version (no CVSS) - [CVE-2009-4372](https://cve.now/CVE-2009-4372.md): AlienVault Open Source Security Information Management (OSSIM) 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to (no CVSS) - [CVE-2009-4373](https://cve.now/CVE-2009-4373.md): Unrestricted file upload vulnerability in repository/repository\_attachment.php in AlienVault Open Source Security Information Management (OS (no CVSS) - [CVE-2009-4374](https://cve.now/CVE-2009-4374.md): Directory traversal vulnerability in repository/repository\_attachment.php in AlienVault Open Source Security Information Management (OSSIM) (no CVSS) - [CVE-2009-4375](https://cve.now/CVE-2009-4375.md): SQL injection vulnerability in repository/repository\_attachment.php in AlienVault Open Source Security Information Management (OSSIM) 2.1.5, (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-12-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.