# CVEs published 2009-12-31 29 CVEs were published on December 31, 2009: 0 critical, 0 high. Days are UTC. - [CVE-2009-4512](https://cve.now/CVE-2009-4512.md): Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and e (no CVSS) - [CVE-2009-4513](https://cve.now/CVE-2009-4513.md): Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, a (no CVSS) - [CVE-2009-4514](https://cve.now/CVE-2009-4514.md): Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows (no CVSS) - [CVE-2009-4515](https://cve.now/CVE-2009-4515.md): The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote atta (no CVSS) - [CVE-2009-4516](https://cve.now/CVE-2009-4516.md): Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to i (no CVSS) - [CVE-2009-4517](https://cve.now/CVE-2009-4517.md): Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attacke (no CVSS) - [CVE-2009-4518](https://cve.now/CVE-2009-4518.md): Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary (no CVSS) - [CVE-2009-4519](https://cve.now/CVE-2009-4519.md): Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors. (no CVSS) - [CVE-2009-4520](https://cve.now/CVE-2009-4520.md): The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended (no CVSS) - [CVE-2009-4521](https://cve.now/CVE-2009-4521.md): Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as use (no CVSS) - [CVE-2009-4522](https://cve.now/CVE-2009-4522.md): Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML (no CVSS) - [CVE-2009-4523](https://cve.now/CVE-2009-4523.md): Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the se (no CVSS) - [CVE-2009-4524](https://cve.now/CVE-2009-4524.md): Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrar (no CVSS) - [CVE-2009-4525](https://cve.now/CVE-2009-4525.md): Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1. (no CVSS) - [CVE-2009-4526](https://cve.now/CVE-2009-4526.md): The Send by e-mail sub-module in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module (no CVSS) - [CVE-2009-4527](https://cve.now/CVE-2009-4527.md): The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically gra (no CVSS) - [CVE-2009-4528](https://cve.now/CVE-2009-4528.md): The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended access (no CVSS) - [CVE-2009-4529](https://cve.now/CVE-2009-4529.md): InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded (no CVSS) - [CVE-2009-4530](https://cve.now/CVE-2009-4530.md): Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI. (no CVSS) - [CVE-2009-4531](https://cve.now/CVE-2009-4531.md): httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (no CVSS) - [CVE-2009-4532](https://cve.now/CVE-2009-4532.md): Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote (no CVSS) - [CVE-2009-4533](https://cve.now/CVE-2009-4533.md): The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token pl (no CVSS) - [CVE-2009-4534](https://cve.now/CVE-2009-4534.md): Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users (no CVSS) - [CVE-2009-4535](https://cve.now/CVE-2009-4535.md): Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI. (no CVSS) - [CVE-2009-4498](https://cve.now/CVE-2009-4498.md): The node\_process\_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request. (no CVSS) - [CVE-2009-4499](https://cve.now/CVE-2009-4499.md): SQL injection vulnerability in the get\_history\_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote atta (no CVSS) - [CVE-2009-4500](https://cve.now/CVE-2009-4500.md): The process\_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) vi (no CVSS) - [CVE-2009-4501](https://cve.now/CVE-2009-4501.md): The zbx\_get\_next\_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service ( (no CVSS) - [CVE-2009-4502](https://cve.now/CVE-2009-4502.md): The NET\_TCP\_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2009-12-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.