CVEs published in November 2017
1,128 vulnerabilities, 173 critical, 2 exploited.
- dlink dwr-933 firmwareXSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi.6.1 Medium
- ansible, redhat openstack +1 moreAnsible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems6.6 Medium
- red hat ansibleAnsible fails to properly sanitize fact variables sent from the Ansible controller7.6 High
- django make app project make appdjango_make_app is vulnerable to Code Injection9.8 Critical
- confire project confireUnsafe deserialization in confire9.8 Critical
- sanic project sanicSanic arbitrary file read and directory traversal7.5 High
- inedo buildmasterAn Open Redirect vulnerability in Inedo BuildMaster before 5.8.2 allows remote attackers to...6.1 Medium
- inedo buildmasterInedo BuildMaster before 5.8.2 has XSS.6.1 Medium
- inedo buildmasterIn Inedo BuildMaster before 5.8.2, XslTransform was used where XslCompiledTransform should have...9.8 Critical
- librenmsLibreNMS Arbitrary File Read5.9 Medium
- ultimate instagram feed project instagram feedCross-site scripting (XSS) vulnerability in admin/partials/uif-access-token-display.php in the...4.8 Medium
- hola vpnHola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, which allows local users to...7.8 High
- savitech-ic savitech driverSavitech driver packages for Windows silently install a self-signed certificate into the Trusted...7.4 High
- netapp clustered data ontapNetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allow remote authenticated users to...5.7 Medium
- boltcms boltBolt Improper Access Control5.3 Medium
- joomla joomla\!In Joomla! before 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication...9.8 Critical
- joomla joomla\!In Joomla! before 3.8.2, a logic bug in com_fields exposed read-only information about a site's...4.3 Medium
- logitech media serverCross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers...5.4 Medium
- logitech media serverCross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers...5.4 Medium
- userproplugin userproThe UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username,...9.8 Critical
- brother dcp-j132w firmwareThe Debut embedded http server contains a remotely exploitable denial of service where a single...7.5 High
- avaya ip office contact centerBuffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center...8.8 High
- matroska mkcleanThe Node_ValidatePtr function in corec/corec/node/node.c in mkclean 0.8.9 allows remote attackers...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe EBML_IntegerValue function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe UpdateDataSize function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe EBML_FindNextElement function in ebmlmain.c in libebml2 through 2012-08-26 allows remote...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe ReadDataFloat function in ebmlnumber.c in libebml2 through 2012-08-26 allows remote attackers...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 allows remote attackers to...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe EBML_BufferToID function in ebmlelement.c in libebml2 through 2012-08-26 allows remote...6.5 Medium
- matroska libebml2, mkclean, mkvalidator +2 moreThe ReadData function in ebmlstring.c in libebml2 through 2012-08-26 allows remote attackers to...6.5 Medium
- matroska mkvalidatorThe Node_GetData function in corec/corec/node/node.c in mkvalidator 0.5.1 allows remote attackers...6.5 Medium
- netapp oncommand unified managerNetApp OnCommand Unified Manager for 7-mode (core package) versions prior to 5.2.1 are...4.3 Medium
- avaya ip officeBuffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers...9.6 Critical
- swftoolsThe swf_DefineLosslessBitsTagToImage function in lib/modules/swfbits.c in SWFTools 0.9.2...5.5 Medium
- red hat satelliteA cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red...4.3 Medium
- datto windows agentDatto Windows Agent allows unauthenticated remote command execution via a modified command in...8.0 High
- datto backup agentDatto Backup Agent 1.0.6.0 and earlier does not authenticate incoming connections. This allows an...5.3 Medium
- postgresqlThe Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the...5.5 Medium
- digium asterisk, certified asterisk +1 moreAn issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15...5.9 Medium
- digium asterisk, certified asterisk +1 moreA Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7...8.8 High
- graphicsmagick, debian linux +1 morecoders/wpg.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (heap...8.8 High
- roundcube webmail, debian linux +1 moreRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...7.8 High
- postgresql, debian linux +1 moreINSERT ... ON CONFLICT DO UPDATE commands in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, and...6.5 Medium
- postgresql, debian linux +1 moreInvalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x...8.1 High
- manageengine servicedesk, zoho manageengine servicedesk +1 moreThe ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper...7.5 High
- manageengine servicedesk, zoho manageengine servicedesk +1 moreThe ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper...7.5 High
- frroutingbgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3...7.5 High
- redhat gluster storage, red hat, inc. gluster storage for rhel 6 +1 moreIt was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017...7.5 High
- redhat gluster storage, red hat, inc. gluster storage for rhel 6 +1 moreIt was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017...7.4 High
- redhat gluster storage, red hat, inc. gluster storage for rhel 6 +1 moreIt was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017...5.9 Medium
- Show moreLoading…