# CVEs published 2010-01-07

20 CVEs were published on January 7, 2010: 0 critical, 0 high. Days are UTC.

- [CVE-2009-3742](https://cve.now/CVE-2009-3742.md): Cross-site scripting (XSS) vulnerability in Liferay Portal before 5.3.0 allows remote attackers to inject arbitrary web script or HTML via t (no CVSS)
- [CVE-2009-4497](https://cve.now/CVE-2009-4497.md): Cross-site scripting (XSS) vulnerability in LXR Cross Referencer 0.9.5 and 0.9.6 allows remote attackers to inject arbitrary web script or H (no CVSS)
- [CVE-2010-0220](https://cve.now/CVE-2010-0220.md): The nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp in Mozilla Firefox before 3.5.7 allows remote attackers to cau (no CVSS)
- [CVE-2010-0221](https://cve.now/CVE-2010-0221.md): Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash d (no CVSS)
- [CVE-2010-0222](https://cve.now/CVE-2010-0222.md): Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash d (no CVSS)
- [CVE-2010-0223](https://cve.now/CVE-2010-0223.md): Kingston DataTraveler BlackBox (DTBB), DataTraveler Secure Privacy Edition (DTSP), and DataTraveler Elite Privacy Edition (DTEP) USB flash d (no CVSS)
- [CVE-2010-0224](https://cve.now/CVE-2010-0224.md): SanDisk Cruzer Enterprise USB flash drives validate passwords with a program running on the host computer rather than the device hardware, w (no CVSS)
- [CVE-2010-0225](https://cve.now/CVE-2010-0225.md): SanDisk Cruzer Enterprise USB flash drives use a fixed 256-bit key for obtaining access to the cleartext drive contents, which makes it easi (no CVSS)
- [CVE-2010-0226](https://cve.now/CVE-2010-0226.md): SanDisk Cruzer Enterprise USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the (no CVSS)
- [CVE-2010-0227](https://cve.now/CVE-2010-0227.md): Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives validate passwords with a program running on the host computer (no CVSS)
- [CVE-2010-0228](https://cve.now/CVE-2010-0228.md): Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives use a fixed 256-bit key for obtaining access to the cleartext d (no CVSS)
- [CVE-2010-0229](https://cve.now/CVE-2010-0229.md): Verbatim Corporate Secure and Corporate Secure FIPS Edition USB flash drives do not prevent password replay attacks, which allows physically (no CVSS)
- [CVE-2009-4586](https://cve.now/CVE-2009-4586.md): Multiple cross-site scripting (XSS) vulnerabilities in index.html in Wowd client before 1.3.1 allow remote attackers to inject arbitrary web (no CVSS)
- [CVE-2009-4587](https://cve.now/CVE-2009-4587.md): Cherokee Web Server 0.5.4 allows remote attackers to cause a denial of service (daemon crash) via an MS-DOS reserved word in a URI, as demon (no CVSS)
- [CVE-2009-4588](https://cve.now/CVE-2009-4588.md): Heap-based buffer overflow in the WindsPlayerIE.View.1 ActiveX control in WindsPly.ocx 3.5.0.0 Beta, 3.0.0.5, and earlier in AwingSoft Awake (no CVSS)
- [CVE-2009-4589](https://cve.now/CVE-2009-4589.md): Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaW (no CVSS)
- [CVE-2009-4590](https://cve.now/CVE-2009-4590.md): Cross-site scripting (XSS) vulnerability in base\_local\_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote att (no CVSS)
- [CVE-2009-4591](https://cve.now/CVE-2009-4591.md): SQL injection vulnerability in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to execute arbitrary SQL comma (no CVSS)
- [CVE-2009-4592](https://cve.now/CVE-2009-4592.md): Unspecified vulnerability in base\_local\_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to inclu (no CVSS)
- [CVE-2009-4593](https://cve.now/CVE-2009-4593.md): The bftpdutmp\_log function in bftpdutmp.c in Bftpd before 2.4 does not place a '\\0' character at the end of the string value of the ut.bu\_ho (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-01-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.