CVEs published in November 2019
1,672 vulnerabilities, 196 critical, 11 exploited.
- pithos, debian linux +1 morepithos before 0.3.5 allows overwrite of arbitrary files via symlinks.5.5 Medium
- consolekit, debian linux, redhat enterprise linux +2 moreIn ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw...8.8 High
- go-camo project go-camoInsufficient content type validation of proxied resources in go-camo before 2.1.1 allows a remote attacker to serve arbitrary content from go-camo's origin.6.1 Medium
- trendnet tew-812dru firmwareUndocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an...8.8 High
- debian linux, storaged-project udisks, fedoraproject fedora +2 more +4 moreudisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.7.8 High
- ckeditor, cksource ckeditor drupal module +1 morehook_file_download in the CKEditor module 7.x-1.4 for Drupal does not properly restrict access to...7.5 High
- zen theme, zen project zen +1 moreCross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the...5.4 Medium
- trendnet tew-691gr firmware, tew-692gr firmware +1 moreUndocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor...9.8 Critical
- projoom smart flash headerviews/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for...8.8 High
- bitweaverMultiple cross-site scripting (XSS) vulnerabilities in Bitweaver 2.8.1 and earlier allow remote...6.1 Medium
- adenion blog2socialThe Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The...6.1 Medium
- cleantalk spam protection\, antispam\, firewallThe CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross...6.1 Medium
- php, php5, debian linux +1 more +3 morePHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which...7.5 High
- containers crun, fedoraproject fedora +1 moreAn issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check...8.6 High
- lavaliteXSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.6.1 Medium
- fairsketch rise - ultimate project managerindex.php/team_members/add_team_member in RISE Ultimate Project Manager 2.3 has CSRF for adding...8.8 High
- google androidIn the Bootloader, there is a possible kernel command injection due to missing command...6.7 Medium
- google androidIn load_logging_config of qmi_vs_service.cc, there is a possible out of bounds write due to a...7.8 High
- freedesktop poppler, debian linux +1 morepoppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.7.8 High
- netgear wnr3500l firmware, wnr3500u firmware +1 moreNETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and...6.5 Medium
- parallels plesk panelParallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName"...6.1 Medium
- freedesktop poppler, debian linux +1 moreAn integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.6.5 Medium
- linux acrnThe Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci...7.5 High
- enghouse web chatA remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace...5.3 Medium
- offlineimap, debian linux +1 moreofflineimap before 6.3.4 added support for SSL server certificate validation but it is still...9.8 Critical
- enghouse web chatAn XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName...6.1 Medium
drupal/commerce_ingenicoPackagistThe security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please re…No scoredrupal/sendinbluePackagistUpdate: This module had an access bypass vulnerability which has now been addressed by the module’s current maintainers. Original description The security team is marking this project unsupported. The…No scoredrupal/bugsnagPackagistThe security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please re…No score- netgear wnr3500l firmware, wnr3500u firmware +1 moreCross-site scripting (XSS) vulnerability in NETGEAR WNR3500U and WNR3500L.5.4 Medium
drupal/nexusPackagistThe security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please re…No score- google android, canonical ubuntu linux +1 moreIn binder_transaction of binder.c, there is a possible out of bounds write due to a missing...7.8 High
- google androidIn binder_free_transaction of binder.c, there is a possible use-after-free due to a race...7.4 High
- google androidIn okToConnect of HidHostService.java, there is a possible permission bypass due to an incorrect...9.8 Critical
- google androidIn Download Provider, there is a possible SQL injection vulnerability. This could lead to local...5.5 Medium
- google androidIn Download Provider, there is possible SQL injection. This could lead to local information...5.5 Medium
- google androidIn BTA_DmPinReply of bta_dm_api.cc, there is a possible out of bounds read due to an incorrect...5.5 Medium
- google androidThere is a possible out of bounds read in v8 JIT code due to a bug in code generation. This could...7.5 High
- google androidIn poisson_distribution of random, there is an out of bounds read. This could lead to local...5.5 Medium
- google androidIn nfa_hci_handle_admin_gate_rsp of nfa_hci_act.cc, there is a possible out of bound write due to...7.8 High
- google androidIn getUserCount and getCount of UserSwitcherController.java, there is possible new user creation...6.8 Medium
- google androidIn rw_i93_sm_set_read_only of rw_i93.cc, there is a possible out of bounds write due to a missing...8.8 High
- google androidIn ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption...9.8 Critical
- enghouse web chatAn issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send...6.5 Medium
- google androidIn FindSharedFunctionInfo of objects.cc, there is a possible out of bounds read due to a mistake...9.8 Critical
- google androidIn CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a...7.8 High
- google androidIn CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a...7.8 High
- google androidIn processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass...5.5 Medium
- google androidIn createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could...7.5 High
- phoenix securecore technologyIn Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a...8.8 High
- Show moreLoading…