CVEs published in November 2018
989 vulnerabilities, 150 critical, 5 exploited.
- foxitsoftware foxit reader, u3d +1 moreThe u3d plugin 9.3.0.10809 (aka plugins\U3DBrowser.fpi) in FoxitReader.exe in Foxit Reader 9.3.0...9.1 Critical
- icu-project international components for unicode, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreInternational Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl...9.8 Critical
- publiccmsAn issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list "attached"...4.8 Medium
- gogsGogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as...9.8 Critical
- projeqtorThe image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by...8.8 High
- giteaGitea Remote Code Execution (RCE)9.8 Critical
- iiong wp editor.mdThe WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.4.8 Medium
- xiph icecast, debian linux +1 moreA buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4....8.1 High
- xheditorxhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within...6.1 Medium
lighttpdMageiaUpdated lighttpd packages fix security vulnerabilitiesNo scoreperl-Cookie-BakerMageia,perl-Dancer2Mageia,perl-HTTP-Entity-ParserMageia +7 more +9 moreUpdated perl-Dancer2 packages fix security vulnerabilitiesNo scorednsmasqMageiaUpdated dnsmasq packages fix security issueNo score- vanillaforums vanillaVanilla 2.6.x before 2.6.4 allows remote code execution.9.8 Critical
- exiv2There is an infinite loop in the Exiv2::Image::printIFDStructure function of image.cpp in Exiv2 0...6.5 Medium
- pivotal cloud foundry operations managerPivotal Operations Manager gives all users heightened privileges9.0 Critical
- dell emc integrated data protection appliance, integrated data protection appliance +1 moreDell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability8.8 High
- [unknown] openstack-mistralopenstack-mistral Discloses the presence of arbitrary files within the filesystem3.1 Low
- schneider electric se electric software update (sesu), all versions prior to v2.2.0, schneider-electric software update utility +1 moreA DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions...7.8 High
- schneider electric se modicon m221, all versions, schneider-electric somachine basic +1 moreA Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon...8.2 High
- yitechnology yi home, unknown yi technology, yi technology +1 more +3 moreAn exploitable code execution vulnerability exists in the UDP network functionality of Yi Home...7.5 High
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable code execution vulnerability exists in the firmware update functionality of Yi...9.0 Critical
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable code execution vulnerability exists in the firmware update functionality of the Yi...7.6 High
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable code execution vulnerability exists in the QR code scanning functionality of Yi...8.3 High
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable code execution vulnerability exists in the QR code scanning functionality of Yi...8.3 High
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable firmware downgrade vulnerability exists in the time syncing functionality of Yi...9.6 Critical
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi...5.7 Medium
- unknown yi technology, yi technology, yitechnology yi home camera firmware +2 moreAn exploitable code execution vulnerability exists in the firmware update functionality of Yi...7.6 High
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 11 could disclose sensitive information...5.3 Medium
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 11 could store highly sensitive...6.2 Medium
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the...6.2 Medium
- ibm rational engineering lifecycle managerIBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable...7.1 High
- ibm daeja viewoneIBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity...7.1 High
- unknown circontrol circarlife all versions prior to 4.3.1, circontrol circarlife firmware +1 moreCircontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored...9.8 Critical
- unknown circontrol circarlife all versions prior to 4.3.1, circontrol circarlife firmware +1 moreCircontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed...9.8 Critical
- ibm spectrum protect, spectrum protect server +1 moreIBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace...4.1 Medium
- ibm robotic process automation with automation anywhereIBM Robotic Process Automation with Automation Anywhere 10.0 and 11.0 allows a remote attacker to...5.5 Medium
- ibm rational quality managerIBM Quality Manager (RQM) 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site...5.4 Medium
- sauter-controls case suiteAn XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter...7.5 High
- aveva edge, indusoft web studio, intouch machine edition 2014 +1 more +3 moreInduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine...9.8 Critical
- aveva edge, indusoft web studio, intouch machine edition 2014 +1 more +3 moreInduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine...9.8 Critical
- mozilla firefoxA service worker can send the activate event on itself periodically which allows it to run...7.5 High
- google chromeInsufficiently strict origin checks during JIT payment app installation in Payments in Google...6.1 Medium
- freedesktop poppler, canonical ubuntu linux, debian linux +7 more +9 moreAn issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace:...6.5 Medium
- qemu, canonical ubuntu linux, fedoraproject fedora +1 more +3 moreIn Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an...5.5 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreIncorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote...4.3 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreIncorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote...4.3 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreIncorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed...4.3 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreUse after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a...8.8 High
- google chrome, debian linux, redhat linux desktop +2 more +4 moreIncorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67...4.3 Medium
- google chrome, debian linux, redhat enterprise linux desktop +2 more +4 moreIncorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0...9.6 Critical
- Show moreLoading…