CVEs published in November 2019
1,672 vulnerabilities, 196 critical, 11 exploited.
- adobe bridge ccAdobe Bridge CC versions 9.1 and earlier have a memory corruption vulnerability. Successful...7.5 High
- adobe illustrator ccAdobe Illustrator CC versions 23.1 and earlier have an insecure library loading (dll hijacking)...7.8 High
- adobe animate ccAdobe Animate CC versions 19.2.1 and earlier have an insecure library loading (dll hijacking)...7.8 High
- untangle ng firewallThe Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within...7.2 High
- untangle ng firewallThe Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged...7.2 High
- untangle ng firewallWhen logged in as an admin user, the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS...4.8 Medium
- untangle ng firewallWhen logged in as an admin user, the Title input field (under Reports) within Untangle NG...4.8 Medium
- scanguard antivirusScanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory,...7.8 High
- microstrategy libraryMicrostrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.6.1 Medium
- linux kernelfs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer...5.5 Medium
- snowhazeSnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting,...7.5 High
- st st33tphf20i2c firmware, st33tphf20spi firmware, st33tphf2ei2c firmware +1 more +3 moreSTMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the...5.9 Medium
- klibc, debian linux +1 moreIn klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not...9.8 Critical
- thunar, debian linux, opensuse +2 moreThunar 1.2 through 1.2.1 could crash when copy and pasting a file name with % format characters...7.8 High
- rsyslog, debian linux, opensuse +2 moreA memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are...5.5 Medium
- rsyslog, debian linux, opensuse +2 moreA memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were...5.5 Medium
- rsyslog, debian linux, opensuse +2 moreA memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are...5.5 Medium
- unixodbc, debian linux, opensuse +1 more +3 moreThe SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow...7.8 High
- debian linux, tesseract-ocr tesseract ocr +1 moreIn tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID...4.7 Medium
- v86d, debian linux +1 morev86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could...7.8 High
- broadcom data loss preventionData Loss Prevention - Unprotected Transport of Credentials4.8 Medium
- No product listedRegular Expression Denial of Service in http.cookiejarNo score
- postgresql postgresql-common, canonical ubuntu linux, debian linux +2 moreThe pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges...7.8 High
- artifex ghostscript, fedoraproject fedora, opensuse leap +2 moreA flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure,...7.3 High
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Unprotected storage of shared credentials vulnerability9.8 Critical
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Path Traversal: '/absolute/pathname/here' vulnerability6.5 Medium
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')8.1 High
- netease pomeloPomelo allows external control of critical state data5.3 Medium
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Improper Neutralization of HTTP requests8.4 High
- phpbb, debian linux, phpbb3 +2 morephpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.6.1 Medium
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Information Disclosure vulnerability5.3 Medium
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Information Disclosure vulnerability8.8 High
- sibsoft xfilesharingSibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be...9.8 Critical
- sibsoft xfilesharingSibSoft Xfilesharing through 2.5.1 allows op=page&tmpl=../ directory traversal to read arbitrary...7.5 High
- exhibitor project exhibitorAn exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web...9.8 Critical
- edgewall trac, debian linux +1 moreTrac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be...7.5 High
- mcafee advanced threat defense (atd), advanced threat defense +1 moreAdvanced Threat Defense (ATD) - Information Disclosure vulnerability5.3 Medium
- zte zxhn h108n firmwareThe version V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are impacted by an information leak...6.5 Medium
- mitsubishielectric l02\/06\/26cpu-cm firmware, l02\/06\/26cpu-p firmware, l02\/06\/26cpu firmware +7 more +9 moreIn Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04...5.9 Medium
- fujielectric v-serverIn Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been...9.8 Critical
- sap erp sales, s4hana sales, sap se s4hana sales (s4core) +1 more +3 moreOrder processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16,...6.3 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreSAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface), corrected...7.1 High
- sap ui, sap se ui 700 +1 moreSAP UI5 HTTP Handler (corrected in SAP_UI versions 7.5, 7.51, 7.52, 7.53, 7.54 and SAP UI_700...5.3 Medium
- sap se netweaver as java, sap netweaver application server java +1 moreUnder certain conditions SAP NetWeaver AS Java (corrected in 7.10, 7.20, 7.30, 7.31, 7.40, 7.50)...4.3 Medium
- sap diagnostics agent, sap se data hub (dh foundation) +1 moreUnder certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker...4.3 Medium
- sap quality management, sap se quality management (s4core) +1 moreAn SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01,...4.3 Medium
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence) +1 moreA Cross-Site Scripting vulnerability exists in SAP BusinessObjects Business Intelligence Platform...5.4 Medium
- sap netweaver application server java, sap se netweaver application server java (j2ee-framework) +1 moreAn administrator of SAP NetWeaver Application Server Java (J2EE-Framework), (corrected in...8.8 High
- sap enable nowSAP Enable Now, before version 1908, does not sufficiently encode user-controlled inputs,...6.5 Medium
- actiontec mi424wr-gen3i firmwareUnspecified Cross-site scripting (XSS) vulnerability in the Verizon FIOS Actiontec MI424WR-GEN3I...6.1 Medium
- Show moreLoading…