# CVEs published 2010-01-13

50 CVEs were published on January 13, 2010: 2 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2009-4487](https://cve.now/CVE-2009-4487.md): nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's (no CVSS)
- [CVE-2009-4488](https://cve.now/CVE-2009-4488.md): Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's (CVSS 9.8)
- [CVE-2009-4489](https://cve.now/CVE-2009-4489.md): header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attacker (no CVSS)
- [CVE-2009-4490](https://cve.now/CVE-2009-4490.md): mini\_httpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window (no CVSS)
- [CVE-2009-4492](https://cve.now/CVE-2009-4492.md): WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev write (no CVSS, webrick)
- [CVE-2009-4493](https://cve.now/CVE-2009-4493.md): Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to (no CVSS)
- [CVE-2009-4494](https://cve.now/CVE-2009-4494.md): AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window (no CVSS)
- [CVE-2009-4495](https://cve.now/CVE-2009-4495.md): Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's tit (no CVSS)
- [CVE-2009-4496](https://cve.now/CVE-2009-4496.md): Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window (no CVSS)
- [CVE-2009-4609](https://cve.now/CVE-2009-4609.md): The Dump Servlet in Mort Bay Jetty 6.x and 7.0.0 allows remote attackers to obtain sensitive information about internal variables and other (no CVSS)
- [CVE-2009-4610](https://cve.now/CVE-2009-4610.md): Multiple cross-site scripting (XSS) vulnerabilities in Mort Bay Jetty 6.x and 7.0.0 allow remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2009-4611](https://cve.now/CVE-2009-4611.md): Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote atta (no CVSS, org.mortbay.jetty:jetty)
- [CVE-2009-4612](https://cve.now/CVE-2009-4612.md): Multiple cross-site scripting (XSS) vulnerabilities in the WebApp JSP Snoop page in Mort Bay Jetty 6.1.x through 6.1.21 allow remote attacke (no CVSS)
- [CVE-2009-3953](https://cve.now/CVE-2009-3953.md): The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remot (CVSS 8.8, KEV)
- [CVE-2009-3954](https://cve.now/CVE-2009-3954.md): The 3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to execu (no CVSS)
- [CVE-2009-3955](https://cve.now/CVE-2009-3955.md): Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2009-3956](https://cve.now/CVE-2009-3956.md): The default configuration of Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, does not enable the Enhanc (no CVSS)
- [CVE-2009-3957](https://cve.now/CVE-2009-3957.md): Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, might allow attackers to cause a denial of service (NUL (no CVSS)
- [CVE-2009-3958](https://cve.now/CVE-2009-3958.md): Multiple stack-based buffer overflows in the NOS Microsystems getPlus Helper ActiveX control before 1.6.2.49 in gp.ocx in the Download Manag (no CVSS)
- [CVE-2009-3959](https://cve.now/CVE-2009-3959.md): Integer overflow in the U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows re (no CVSS)
- [CVE-2009-4212](https://cve.now/CVE-2009-4212.md): Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 throu (no CVSS)
- [CVE-2010-0018](https://cve.now/CVE-2010-0018.md): Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Ser (no CVSS)
- [CVE-2009-3637](https://cve.now/CVE-2009-3637.md): Stack-based buffer overflow in the M\_AddToServerList function in client/menu.c in Red Planet Arena Alien Arena 7.30 allows remote attackers (no CVSS)
- [CVE-2009-4606](https://cve.now/CVE-2009-4606.md): South River Technologies WebDrive 9.02 build 2232 installs the WebDrive Service without a security descriptor, which allows local users to ( (no CVSS)
- [CVE-2009-4607](https://cve.now/CVE-2009-4607.md): The command line interface in Overland Storage Snap Server 410 with GuardianOS 5.1.041 runs the "less" utility with a higher-privileged uid (no CVSS)
- [CVE-2009-4608](https://cve.now/CVE-2009-4608.md): Cross-site scripting (XSS) vulnerability in Canon IT Solutions Inc. (no CVSS)
- [CVE-2009-1996](https://cve.now/CVE-2009-1996.md): Unspecified vulnerability in the Logical Standby component in Oracle Database allows remote authenticated users to affect integrity via unkn (no CVSS)
- [CVE-2009-3410](https://cve.now/CVE-2009-3410.md): Unspecified vulnerability in the RDBMS component in Oracle Database 11.1.0.7, 10.2.0.3, 10.2.0.4, 10.1.0.5, 9.2.0.8, and 9.2.0.8DV allows re (no CVSS)
- [CVE-2009-3411](https://cve.now/CVE-2009-3411.md): Unspecified vulnerability in the Oracle Data Pump component in Oracle Database 11.1.0.7, 10.2.0.3, 10.2.0.4, 10.1.0.5, 9.2.0.8, and 9.2.0.8D (no CVSS)
- [CVE-2009-3412](https://cve.now/CVE-2009-3412.md): Unspecified vulnerability in the Unzip component in Oracle Database 9.2.0.8, 9.2.0.8DV, and 10.1.0.5; and Oracle Application Server 10.1.2.3 (no CVSS)
- [CVE-2009-3413](https://cve.now/CVE-2009-3413.md): Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authen (no CVSS)
- [CVE-2009-3414](https://cve.now/CVE-2009-3414.md): Unspecified vulnerability in the Oracle Spatial component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authen (no CVSS)
- [CVE-2009-3415](https://cve.now/CVE-2009-3415.md): Unspecified vulnerability in the Oracle OLAP component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, and 10.2.0.3 allows remote authentic (no CVSS)
- [CVE-2009-3416](https://cve.now/CVE-2009-3416.md): Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows (no CVSS)
- [CVE-2010-0066](https://cve.now/CVE-2010-0066.md): Unspecified vulnerability in the Access Manager Identity Server component in Oracle Application Server 7.0.4.3 and 10.1.4.2 allows remote at (no CVSS)
- [CVE-2010-0067](https://cve.now/CVE-2010-0067.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attac (no CVSS)
- [CVE-2010-0068](https://cve.now/CVE-2010-0068.md): Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP2, and 10.0 allows remote attackers to affect (no CVSS)
- [CVE-2010-0069](https://cve.now/CVE-2010-0069.md): Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0, SP7, 8.1SP6, 9.0, 9.1, 9.2MP3, 10.0MP1, and 10.3.0 allo (no CVSS)
- [CVE-2010-0070](https://cve.now/CVE-2010-0070.md): Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Application Server 10.1.2.3 and 10.1.3.4 allows remote attac (no CVSS)
- [CVE-2010-0071](https://cve.now/CVE-2010-0071.md): Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote at (no CVSS)
- [CVE-2010-0072](https://cve.now/CVE-2010-0072.md): Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confident (no CVSS)
- [CVE-2010-0074](https://cve.now/CVE-2010-0074.md): Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 7.0SP7, 8.1SP6, 9.0, 9.1, 9.2MP3, 10.0MP2, and 10.3.1 allows (no CVSS)
- [CVE-2010-0075](https://cve.now/CVE-2010-0075.md): Unspecified vulnerability in the Oracle HRMS (Self Service) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.1 allows remote (no CVSS)
- [CVE-2010-0076](https://cve.now/CVE-2010-0076.md): Unspecified vulnerability in the Application Express Application Builder component in Oracle Database 3.2.1.00.10 allows remote authenticate (no CVSS)
- [CVE-2010-0077](https://cve.now/CVE-2010-0077.md): Unspecified vulnerability in the CRM Technical Foundation (mobile) component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows (no CVSS)
- [CVE-2010-0078](https://cve.now/CVE-2010-0078.md): Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 9.0, 9.1, 9.2MP3, 10.0MP2, and 10.3.1 allows remote attacker (no CVSS)
- [CVE-2010-0079](https://cve.now/CVE-2010-0079.md): Multiple vulnerabilities in the JRockit component in BEA Product Suite R27.6.5 using JRE/JDK 1.4.2, 5, and 6 allow remote attackers to affec (no CVSS)
- [CVE-2010-0080](https://cve.now/CVE-2010-0080.md): Unspecified vulnerability in the PeopleSoft Enterprise HCM - eProfile component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne (no CVSS)
- [CVE-2010-0279](https://cve.now/CVE-2010-0279.md): Unrestricted file upload vulnerability in upload.php in BTS-GI Read excel 1.1 allows remote attackers to execute arbitrary code by uploading (no CVSS)
- [CVE-2009-4491](https://cve.now/CVE-2009-4491.md): thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2010-01-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.