CVEs published in November 2019
1,672 vulnerabilities, 196 critical, 11 exploited.
- ibm tivoli netcool impact, tivoli netcool\/impact +1 moreIBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.16 is vulnerable to cross-site scripting. This...5.4 Medium
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 allows unauthorized disclosure of information like...5.1 Medium
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 is vulnerable to possible host header injection...4.6 Medium
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 could allow a remote attacker to hijack the clicking...6.1 Medium
- ibm smartcloud analytics, smartcloud analytics log analysis +1 moreIBM SmartCloud Analytics 1.3.1 through 1.3.5 does not set the secure attribute on authorization...3.7 Low
- red hat redhat-upgrade-tool, redhat enterprise linux +1 moreredhat-upgrade-tool: Does not check GPG signatures when upgrading versions9.8 Critical
- plowplow has local buffer overflow vulnerability7.8 High
- libbluray, debian linux, fedoraproject fedora +1 more +3 morelibbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files4.7 Medium
- ovirt, redhat ovirt-engine, virtualization +2 moreoVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data...6.5 Medium
- openstack designate, debian linux, redhat enterprise linux openstack platform +2 moreDesignate does not enforce the DNS protocol limit concerning record set sizes6.5 Medium
vantnpmCross-Site Scripting in vant9.1 Critical- linux kernelIn the AppleTalk subsystem in the Linux kernel before 5.1, there is a potential NULL pointer...5.5 Medium
- [unknown] cloudforms, redhat cloudforms management engine +1 morecloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A...6.5 Medium
- naver vaccinensGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via...7.5 High
- activityA cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.8.8 High
- activityCross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.4.8 Medium
- quick tabs project tabs, quick tabs quicktabs +1 moreCross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x...4.8 Medium
- zulip serverIn Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant...9.8 Critical
- xcfa, debian linux +1 morexcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a...7.0 High
- xcfaxcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a...4.7 Medium
- sensiolabs symfony, fedoraproject fedora +1 moreSymfony Unsafe Cache Serialization Could Enable RCE9.8 Critical
- sensiolabs symfonyImproper Input Validation in Symfony9.8 Critical
- wolfsslwolfssl before 3.2.0 has a server certificate that is not properly authorized for server...7.5 High
- wolfsslwolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.7.5 High
- wolfsslwolfssl before 3.2.0 does not properly issue certificates for a server's hostname.7.5 High
- chyrpMultiple cross-site scripting (XSS) vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2...6.1 Medium
- dasanzhone znid 2426a firmwareThe web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated...8.8 High
- synametrics synaman, syncrify, syntail +2 moreMultiple cross-site request forgery (CSRF) vulnerabilities in Synametrics Technologies SynaMan...8.8 High
- rconfigrConfig 3.9.2 allows devices.php?searchColumn= SQL injection.8.8 High
- oniguruma project oniguruma, fedoraproject fedora +1 moreAn issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function gb18030_mbc_enc_len in...7.5 High
- oniguruma project oniguruma, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Oniguruma 6.x before 6.9.4_rc2. In the function...7.5 High
- vtiger crmIn Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without...8.8 High
- ikiwiki, fedoraproject fedora +1 moreCross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3...6.1 Medium
- loftek nexus 543 firmwareDirectory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to...7.5 High
- loftek nexus 543 firmwareMultiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera...8.8 High
- loftek nexus 543 firmwareThe Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to...7.5 High
- loftek nexus 543 firmwareThe Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request...7.5 High
- beckhoff twincat, twincat 2, twincat 3.1 +2 moreBeckhoff TwinCAT Profinet Driver Divide-by-Zero Denial of Service7.5 High
- beckhoff twincat, twincat 2, twincat 3.1 +2 moreBeckhoff TwinCAT Discovery Service Denial of Service5.3 Medium
- kyrolsecuritylabs kyrol internet securityIOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to...7.8 High
- lexmark services monitor firmwareIn Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a...7.5 High
- hotkeyp project hotkeypHotkeyP through 4.9 r96 allows privilege escalation in the privilege function in Commands.cpp.9.8 Critical
- jalios jcmsJalios JCMS 10 allows attackers to access any part of the website and the WebDAV server with...9.8 Critical
- sangoma freepbxSangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect...9.8 Critical
- gog galaxyAn exploitable local privilege escalation vulnerability exists in the GalaxyClientService...7.8 High
- centreon webCentreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF ...7.8 High
- centreon webImproper Input Validation in Centreon Web7.2 High
- shibboleth service providerShibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files...7.8 High
- tendacn ac9v1.0 firmwareAn exploitable command injection vulnerability exists in the /goform/WanParameterSetting...7.8 High
- tendacn ac9v1.0 firmwareAn exploitable command injection vulnerability exists in the /goform/WanParameterSetting...7.8 High
- Show moreLoading…