# CVEs published 2009-12-28

23 CVEs were published on December 28, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-1797](https://cve.now/CVE-2009-1797.md): Multiple cross-site request forgery (CSRF) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched (no CVSS)
- [CVE-2009-1798](https://cve.now/CVE-2009-1798.md): Multiple cross-site scripting (XSS) vulnerabilities on the Network Management Card (NMC) on American Power Conversion (APC) Switched Rack PD (no CVSS)
- [CVE-2009-4007](https://cve.now/CVE-2009-4007.md): Unspecified vulnerability in the NormaliseTrainConsist function in src/train\_cmd.cpp in OpenTTD before 0.7.5-RC1 allows remote attackers to (no CVSS)
- [CVE-2009-4438](https://cve.now/CVE-2009-4438.md): The Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not enforce privileg (no CVSS)
- [CVE-2009-4439](https://cve.now/CVE-2009-4439.md): Unspecified vulnerability in the Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.5 before FP5 allows remote authenticated user (no CVSS)
- [CVE-2009-4440](https://cve.now/CVE-2009-4440.md): Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly handle multiple clie (no CVSS)
- [CVE-2009-4441](https://cve.now/CVE-2009-4441.md): Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not enable the SO\_KEEPALIVE socke (no CVSS)
- [CVE-2009-4442](https://cve.now/CVE-2009-4442.md): Directory Proxy Server (DPS) in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 does not properly implement the max-cl (no CVSS)
- [CVE-2009-4443](https://cve.now/CVE-2009-4443.md): Unspecified vulnerability in the psearch (aka persistent search) functionality in Directory Proxy Server (DPS) in Sun Java System Directory (no CVSS)
- [CVE-2009-4424](https://cve.now/CVE-2009-4424.md): SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands v (no CVSS)
- [CVE-2009-4425](https://cve.now/CVE-2009-4425.md): Cross-site scripting (XSS) vulnerability in index.php in iDevCart 1.09 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2009-4426](https://cve.now/CVE-2009-4426.md): Multiple directory traversal vulnerabilities in Ignition 1.2, when magic\_quotes\_gpc is disabled, allow remote attackers to include and execu (no CVSS)
- [CVE-2009-4427](https://cve.now/CVE-2009-4427.md): Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 allows remote attackers to include and execute arbitrary local files vi (no CVSS)
- [CVE-2009-4428](https://cve.now/CVE-2009-4428.md): SQL injection vulnerability in the JoomPortfolio (com\_joomportfolio) component 1.0.0 for Joomla! allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2009-4429](https://cve.now/CVE-2009-4429.md): Cross-site scripting (XSS) vulnerability in the Sections module 5.x before 5.x-1.3 and 6.x before 6.x-1.3 for Drupal allows remote authentic (no CVSS)
- [CVE-2009-4430](https://cve.now/CVE-2009-4430.md): SQL injection vulnerability in index.php in VirtueMart 1.0 allows remote attackers to execute arbitrary SQL commands via the product\_id para (no CVSS)
- [CVE-2009-4431](https://cve.now/CVE-2009-4431.md): PHP remote file inclusion vulnerability in cal\_popup.php in the Anything Digital Development JCal Pro (aka com\_jcalpro or JCP) component 1.5 (no CVSS)
- [CVE-2009-4432](https://cve.now/CVE-2009-4432.md): SQL injection vulnerability in index.php in CodeMight VideoCMS 3.1 allows remote attackers to execute arbitrary SQL commands via the v param (no CVSS)
- [CVE-2009-4433](https://cve.now/CVE-2009-4433.md): Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot iSupport 1.8 and earlier allow remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2009-4434](https://cve.now/CVE-2009-4434.md): Directory traversal vulnerability in index.php in IDevSpot iSupport 1.8 and earlier allows remote attackers to read arbitrary files via a .. (no CVSS)
- [CVE-2009-4435](https://cve.now/CVE-2009-4435.md): Multiple directory traversal vulnerabilities in F3Site 2009 allow remote attackers to include and execute arbitrary local files via director (no CVSS)
- [CVE-2009-4436](https://cve.now/CVE-2009-4436.md): Multiple SQL injection vulnerabilities in Active Web Softwares eWebquiz 8 allow remote attackers to execute arbitrary SQL commands via the Q (no CVSS)
- [CVE-2009-4437](https://cve.now/CVE-2009-4437.md): Multiple SQL injection vulnerabilities in Active Auction House 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) cati (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.