CVEs published in November 2018
989 vulnerabilities, 150 critical, 5 exploited.
- nuuo nvrmini2, nvrmini2 firmware +1 more NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker... 8.8 High
- zoom Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116),... 9.8 Critical
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 more An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability... 8.8 High
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 more Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')... 7.5 High
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 more An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon... 9.8 Critical
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 more An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')... 6.1 Medium
- schneider electric se embedded web servers in all modicon m340, premium, quantum plcs and bmxnor0200, schneider-electric modicom bmxnor0200h firmware, modicom m340 firmware +2 more +4 more An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon... 9.8 Critical
- schneider electric se data center expert versions 7.5.0 and earlier, schneider-electric struxureware data center expert +1 more Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user... 8.8 High
- schneider electric se data center operation all versions, schneider-electric struxureware data center operation +1 more Data Center Operation allows for the upload of a zip file from its user interface to the server.... 8.8 High
- rails https://github.com/rails/rails, rubyonrails rails +1 more Exposure of Sensitive Information to an Unauthorized Actor in activestorage 6.5 Medium
- rails https://github.com/rails/rails, redhat cloudforms, rubyonrails rails +2 more Improper Access Control in activejob 7.5 High
- budabot In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote... 9.8 Critical
- invt vt-designer VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied... 8.8 High
- invt vt-designer VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which... 8.8 High
- switchvpn A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03... 7.8 High
- google android Android 1.0 through 9.0 has Insecure Permissions. The Android bug ID is 77286983. 7.5 High
- talos tp-link, tp-link tl-r600vpn firmware +1 more An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP... 7.5 High
- dell openmanage network manager Insecure MySQL Configuration Vulnerability 6.5 Medium
- dell openmanage network manager Improper Authorization Vulnerability 8.8 High
- ibm storediq IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was... 6.7 Medium
- ibm storediq IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to... 6.5 Medium
- ibm db2, db2 for linux, unix and windows +1 more IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack... 8.4 High
- lenovo lxci for vmware, xclarity integrator +1 more LXCI for VMware 6.5 Medium
- lenovo lxci for microsoft system center, lxci for vmware, xclarity integrator +2 more LXCI for VMware and LXCI for Microsoft System Center 6.5 Medium
- lenovo lxci for vmware, xclarity integrator +1 more LXCI for VMware 6.5 Medium
- qnap qsync central, qts +1 more Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2,... 6.1 Medium
- [unknown] keycloak Improper Authentication in Keycloak 6.1 Medium
- artifex mupdf, debian linux +1 more In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg_dev_end_tile in fitz/svg... 5.5 Medium
- saitoha libsixel There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8... 5.5 Medium
- saitoha libsixel There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel... 7.8 High
- saitoha libsixel There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1... 5.5 Medium
- libconfuse project libconfuse cfg_init in confuse.c in libConfuse 3.2.2 has a memory leak. 8.8 High
- saitoha libsixel There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in... 5.5 Medium
- saitoha libsixel There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in... 6.5 Medium
- saitoha libsixel There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8... 5.5 Medium
- nasm netwide assembler There is an illegal address access at asm/preproc.c (function: is_mmacro) in Netwide Assembler ... 5.5 Medium
- i4 ai si assistant i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings. 6.1 Medium
- sleuthkit the sleuth kit, debian linux, fedoraproject fedora +2 more In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly... 6.5 Medium
- domainmod DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar. 4.8 Medium
- domainmod DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL... 4.8 Medium
- domainmod DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field... 5.4 Medium
- domainmod DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field. 4.8 Medium
- advanced comment system project comment system internal/advanced_comment_system/admin.php in Advanced Comment System 1.0 is prone to an SQL... 9.8 Critical
- sdcms app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files... 7.5 High
- kde applications The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger... 7.5 High
- ocsinventory-ng ocsinventory ng Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a... 8.8 High
- adobe photoshop cc Adobe Photoshop CC versions 19.1.6 and earlier have an out-of-bounds read vulnerability.... 7.5 High
- adobe acrobat and reader, acrobat dc, acrobat reader dc +2 more Adobe Acrobat and Reader versions 2019.008.20080 and earlier, 2017.011.30105 and earlier, and... 7.5 High
- tp5cms project tp5cms An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the... 6.1 Medium
- tp5cms project tp5cms An issue was discovered in tp5cms through 2017-05-25. admin.php/upload/picture.html allows remote... 9.8 Critical
- Show olderLoading…