# CVEs published 2009-12-23

16 CVEs were published on December 23, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4405](https://cve.now/CVE-2009-4405.md): Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in (no CVSS, trac)
- [CVE-2009-4406](https://cve.now/CVE-2009-4406.md): Cross-site scripting (XSS) vulnerability in Forms/login1 in American Power Conversion (APC) Switched Rack PDU AP7932 B2, running rpdu 3.3.3 (no CVSS)
- [CVE-2009-4407](https://cve.now/CVE-2009-4407.md): Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote (no CVSS)
- [CVE-2009-4408](https://cve.now/CVE-2009-4408.md): Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, al (no CVSS)
- [CVE-2009-4409](https://cve.now/CVE-2009-4409.md): The (1) CHAP and (2) MS-CHAP-V2 authentication capabilities in the PPP Access Concentrator (PPPAC) function in Internet Initiative Japan SEI (no CVSS)
- [CVE-2009-4144](https://cve.now/CVE-2009-4144.md): NetworkManager (NM) 0.7.2 does not ensure that the configured Certification Authority (CA) certificate file for a (1) WPA Enterprise or (2) (no CVSS)
- [CVE-2009-4145](https://cve.now/CVE-2009-4145.md): nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which all (no CVSS)
- [CVE-2009-3580](https://cve.now/CVE-2009-3580.md): Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitr (no CVSS)
- [CVE-2009-3581](https://cve.now/CVE-2009-3581.md): Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or (no CVSS)
- [CVE-2009-3582](https://cve.now/CVE-2009-3582.md): Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary S (no CVSS)
- [CVE-2009-3583](https://cve.now/CVE-2009-3583.md): Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary (no CVSS)
- [CVE-2009-3584](https://cve.now/CVE-2009-3584.md): SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to cap (no CVSS)
- [CVE-2009-4133](https://cve.now/CVE-2009-4133.md): Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for MRG, and Grid Execute Node for MRG, allows remote authenticated users (no CVSS)
- [CVE-2009-4402](https://cve.now/CVE-2009-4402.md): The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform unspecified administrative operations by providing an arbi (no CVSS)
- [CVE-2009-4403](https://cve.now/CVE-2009-4403.md): Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2009-4404](https://cve.now/CVE-2009-4404.md): Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 allows remote attackers to cause a denial of service via unspecified vector (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.