CVEs published in November 2019
1,672 vulnerabilities, 196 critical, 11 exploited.
- jenkins support core, jenkins project support core plugin +1 moreMissing permission check in Jenkins Support Core Plugin6.5 Medium
- jenkins script security, jenkins project script security plugin +1 moreIncorrect Authorization in Jenkins Script Security Plugin8.8 High
- gonitro nitro proNitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if...7.8 High
- redhat openshift origin, rubygem-openshift-origin-node +1 moreopenshift-origin-node Improper Input Validation vulnerability5.5 Medium
- cumin, redhat enterprise mrg +1 morecumin: At installation postgresql database user created without password9.8 Critical
- net-ldap project net-ldap, debian linux, ruby-net-ldap +2 morenet-ldap has weak salt when generating passwords5.5 Medium
- pam shield project shield, debian linux, pam-shield +2 morepam_shield before 0.9.4: Default configuration does not perform protective action7.5 High
- slackware linuxSlackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and...7.8 High
- tryton trytondtrytond Incorrect Authorization vulnerability7.5 High
- slackware linuxSlackware 14.0 and 14.1, and Slackware LLVM 3.0-i486-2 and 3.3-i486-2, contain world-writable...9.8 Critical
crustcrates.iocrust repo has been archived; use libp2p insteadNo score- google chromeOut of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a...8.8 High
- google chrome, fedoraproject fedora, opensuse backports +3 more +5 moreUse after free in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker...8.8 High
- linux kernelext4_empty_dir in fs/ext4/namei.c in the Linux kernel through 5.3.12 allows a NULL pointer...5.5 Medium
- linux kernelbtrfs_root_node in fs/btrfs/ctree.c in the Linux kernel through 5.3.12 allows a NULL pointer...5.5 Medium
- debian linux, linux kernel, canonical ubuntu linux +2 more__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls...5.5 Medium
- libarchive, canonical ubuntu linux, debian linux +1 more +3 moreIn Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds...5.5 Medium
- schneider electric modicon controllers (m340 cpus, m340 communication modules, premium cpus, premium communication modules, quantum cpus, quantum communication modules - see security notification for specific versions), schneider-electric 140 cpu6x firmware, 140 noc 77101 firmware +8 more +10 moreA CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340...7.5 High
- schneider electric andover continuum models 9680, 5740 and 5720, bcx4040, bcx9640, 9900, 9940, 9924 and 9702, schneider-electric andover continuum 5720 firmware, andover continuum 5740 firmware +9 more +11 moreA CWE-79: Failure to Preserve Web Page Structure vulnerability exists in Andover Continuum ...6.1 Medium
- dolibarr, dolibarr erp\/crm +1 moreDolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php...9.8 Critical
- dolibarr, dolibarr erp\/crm +1 moreCross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary...6.1 Medium
- dolibarr, dolibarr erp\/crm +1 moreSQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute...9.8 Critical
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which...7.5 High
- pidginPidgin 2.10.0 uses DBUS for certain cleartext communication, which allows local users to obtain...5.5 Medium
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of...7.5 High
- tikiMultiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to...6.1 Medium
- tikiMultiple cross-site scripting vulnerabilities in Tiki 8.0 RC1 and earlier allow remote attackers...6.1 Medium
- codesys control for beaglebone, control for empc-a\/imx6, control for iot2000 +11 more +13 moreCODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a...9.8 Critical
- status statusnetCross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.6.1 Medium
- ibm security identity managerIBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on...8.0 High
- ibm maximo asset managementIBM Maximo Asset Management 7.6, 7.6.1, and 7.6.1.1 could allow an authenticated user to delete a...4.3 Medium
- status statusnetUnspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL...9.8 Critical
- iobroker iobroker.adminArbitrary File Write in iobroker.admin9.8 Critical
- weborf, debian linux +1 moreWeborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.7.5 High
- vmware fusion, workstation, workstation and fusion +2 moreVMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain a denial-of...7.7 High
- vmware fusion, workstation, workstation and fusion +2 moreVMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an out-of-bounds...9.1 Critical
- vmware fusion, workstation, workstation and fusion +2 moreVMware Workstation (15.x before 15.5.1) and Fusion (11.x before 11.5.1) contain an information...7.7 High
- smarty, smarty3, debian linux +2 moreSmarty3 Arbitrary PHP Code Execution9.8 Critical
- piwik, matomo +1 moreCross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web...6.1 Medium
- piwik, matomo +1 moreCross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web...6.1 Medium
- piwik, matomo +1 moreCross-site Scripting (XSS) in Piwik before 1.10.1 allows remote attackers to inject arbitrary web...6.1 Medium
- redhat tuned, debian linux, fedoraproject fedora +4 more +6 moretuned 2.10.0 creates its PID file with insecure permissions which allows local users to kill...5.5 Medium
- gnu serveezGNU Serveez through 0.2.2 has an Information Leak. An attacker may send an HTTP POST request to...7.5 High
- openfind mail2000Openfind MAIL2000 Webmail Post-Auth Cross-Site Scripting6.1 Medium
- openfind mail2000Openfind MAIL2000 Webmail Pre-Auth Open Redirect6.1 Medium
- openfind mail2000Openfind MAIL2000 Webmail Pre-Auth Cross-Site Scripting6.1 Medium
- lenovo lenovopaper, paper +1 moreA potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow...7.8 High
- lenovo system interface foundationA potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1...7.8 High
- lenovo xclarity controller (xcc), xclarity controller +1 moreA stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could...6.5 Medium
- lenovo system interface foundationA potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1...8.8 High
- Show moreLoading…