CVEs published in November 2019
1,672 vulnerabilities, 196 critical, 11 exploited.
- lenovo customer engagement service (ccsdk), customer engagement service +1 moreA potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software...7.8 High
- lenovo thinkpad usb-c dock firmwareA potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a...7.5 High
- fedoraproject fedora, isc bind, bind9 +2 moreTCP-pipelined queries can bypass tcp-clients limit7.5 High
- ruby-lang ruby, debian linux, opensuse leap +1 more +3 moreRuby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the...8.1 High
- ruby-lang ruby, debian linux +1 moreRuby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting....5.3 Medium
- ruby-lang ruby, debian linux +1 moreWEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4...7.5 High
- ruby-lang ruby, canonical ubuntu linux +1 moreRuby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 mishandles path checking within...6.5 Medium
- ziku zikulaZikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the ...4.8 Medium
- marmaro masqmailmasqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that...9.8 Critical
- lightdmlightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files...7.8 High
- apache nifiApache NiFi process group information disclosure5.3 Medium
- apache nifiApache NiFi user log out issue8.8 High
- apache nifiApache NiFi information disclosure by XXE6.5 Medium
- debian linux, fedoraproject fedora, foomatic-filters +2 morefoomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of...5.5 Medium
- debian linux, foomatic-filters +1 morefoomatic-rip filter, all versions, used insecurely creates temporary files for storage of...5.5 Medium
- pixie project pixieSQL Injection in usmanhalalit/pixie9.8 Critical
- cloud foundry routing, cloudfoundry cf-deployment, routing-release +2 moreA forged route service request using an invalid nonce can cause the gorouter to panic and crash8.6 High
- ktsussktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local...7.8 High
- nlnetlabs unbound, fedoraproject fedora, opensuse leap +2 moreUnbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code...7.3 High
- cookie-signature project cookie-signature, debian linux +1 morecookie-signature Timing Attack4.4 Medium
- ktsussktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to...9.8 Critical
- phusion passenger, redhat openshift, ruby-passenger +2 moreRubyGems passenger gem allows remote attackers to delete files7.5 High
- nusoap, debian linux +1 morenuSOAP before 0.7.3-5 does not properly check the hostname of a cert.7.5 High
- falconplFalconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to...7.5 High
- uzbl, debian linux +1 moreuzbl: Information disclosure via world-readable cookies storage file5.5 Medium
- gnu gnusoundgnusound 0.7.5 has format string issue9.8 Critical
- cobblercobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE7.8 High
- mpackmpack 1.6 has information disclosure via eavesdropping on mails sent by other users7.5 High
- cobblerCobbler Web Interface Lacks CSRF Protection8.8 High
- f5 nginx, debian linux +1 morenginx http proxy module does not verify peer identity of https origin server which could...4.8 Medium
- openpegasus tog-pegasus, redhat enterprise linux +1 moretog-Pegasus has a package hash collision DoS vulnerability7.5 High
- suckless surf, debian linux +1 moresurf: cookie jar has read access from other local user5.5 Medium
- facebook hhvmhhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle:...9.8 Critical
- code42Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a...7.3 High
- code42Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations,...7.3 High
- gnu glibc, canonical ubuntu linux, debian linux +4 more +6 moreOn the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the...3.3 Low
- redmine, debian linux +1 moreA SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine...6.5 Medium
- apache shiroImproper input validation in Apache Shiro7.5 High
- simplito elliptic-phpTiming attacks might allow practical recovery of the long-term private key7.4 High
- getfiregpg iceweasel-firegpgA symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.7.8 High
- jenkinsJenkins CI Game Plugin allows Cross-Site Scripting (XSS)6.1 Medium
- phicomm k2\(psg1218\) firmware/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices...8.8 High
- jenkinsJenkins Violation Plugin allows Cross-Site Scripting (XSS)6.1 Medium
- symantec norton app lock, norton applock +1 moreNorton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of...5.6 Medium
- jenkinsJenkins allows Cross-Site Scripting (XSS) via Crafted URL6.1 Medium
- apache solrUnrestricted upload of file with dangerous type in Apache Solr9.8 Critical
- jenkinsJenkins allows Data Insertion and Execution of Code by those with Read and HTTP Access8.8 High
- getmailbird mailbirdMultiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote...6.1 Medium
- micro focus international operations agentXXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12...6.5 Medium
- apache atlasStored XSS in Apache Atlas6.1 Medium
- Show moreLoading…