CVEs published in November 2018
989 vulnerabilities, 150 critical, 5 exploited.
- otrs open ticket request system, debian linux +1 moreOpen Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0...6.5 Medium
- otrs open ticket request systemOpen Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack...4.8 Medium
- otrs open ticket request system, debian linux +1 moreOpen Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to...4.8 Medium
- clippercmsClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default)....8.8 High
- fruitywifi project fruitywifiShell Metacharacter Injection in www/modules/save.php in FruityWifi (aka PatatasFritas/PatataWifi...9.8 Critical
- zyxel zywall usg 100 firmwareZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi...8.8 High
- pdfforge pdf architectMemory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows...7.8 High
- caddyserver caddyCaddy allows enumeration of Certificates and Hostnames3.7 Low
- iobit malware fighterRegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when...7.8 High
- iobit malware fighterRegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when...7.8 High
- iobit malware fighterRegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when...7.8 High
- iobit malware fighterRegFilter.sys in IOBit Malware Fighter 6.2 is susceptible to a stack-based buffer overflow when...7.8 High
- freedesktop poppler, canonical ubuntu linux +1 morePoppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from...6.5 Medium
- s-cmsAn issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the...6.1 Medium
- pivotal software bits service, cloud foundry bits-service-release +1 moreSigning Key Extraction in Bits Service Release8.1 High
- jasper project jasper, debian linux, redhat fedora +2 moreAn issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from...5.5 Medium
- wstmartWSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI.8.8 High
- sennheiser headsetup, microsoft windows 10, windows 7 +6 more +8 moreSennheiser HeadSetup 7.3.4903 places Certification Authority (CA) certificates into the Trusted...7.5 High
- domainmodDomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.6.1 Medium
- domainmodDomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.6.1 Medium
- powerdns recursor, [unknown] pdns +1 moreAn issue has been found in PowerDNS Recursor from 4.0.0 up to and including 4.1.4. A remote...5.3 Medium
- ibm maximo asset managementIBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows...5.4 Medium
- phpcmsA code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary...9.8 Critical
- flarumFlarum Core Leaks PII5.3 Medium
- squid-cache squidSquid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for...6.1 Medium
- libav** DISPUTED ** In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec...6.5 Medium
- libavIn Libav 12.3, a NULL pointer dereference (RIP points to zero) issue in ff_mpa_synth_filter_float...6.5 Medium
- libavIn Libav 12.3, there is a heap-based buffer over-read in decode_frame in libavcodec/lcldec.c that...6.5 Medium
- prestashopPrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute...9.8 Critical
- prestashopPrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to delete an...7.5 High
- prestashopPrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 on Windows allows remote attackers to...7.5 High
- mz-automation libiec61850An issue has been found in libIEC61850 v1.3. It is a NULL pointer dereference in...4.3 Medium
- mz-automation libiec61850An issue has been found in libIEC61850 v1.3. It is a SEGV in Ethernet_receivePacket in...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreDuring HTTP Live Stream playback on Firefox for Android, audio data can be accessed across...8.8 High
- squid-cache squid, debian linux +1 moreSquid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.5.9 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow a user to...4.8 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC...3.6 Low
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1...7.4 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1...8.4 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could...6.2 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could...8.4 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could...7.8 High
- ibm api connectIBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the...8.9 High
- ibm mq, websphere mq +1 moreIBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that...5.3 Medium
- ibm marketing operationsIBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive...4.3 Medium
- adobe campaignIBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the...4.0 Medium
- telexy qpathAn issue was discovered in Telexy QPath 5.4.462. A low privileged authenticated user supplying a...6.5 Medium
- keepalivedkeepalived 2.0.8 didn't check for existing plain files when writing data to a temporary file upon...4.7 Medium
- keepalivedkeepalived 2.0.8 used mode 0666 when creating new temporary files upon a call to PrintData or...7.5 High
- keepalivedkeepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file...4.7 Medium
- Show moreLoading…