CVEs published in November 2020
1,536 vulnerabilities, 172 critical, 12 exploited.
- json-ptr project json-ptrPrototype Pollution7.3 High
- vivo frame touch module, the frame touch module +1 moreThe frame touch module does not make validity judgments on parameter lengths when processing...5.5 Medium
- ibm content navigatorIBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows...5.4 Medium
- ibm content navigatorIBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability...6.4 Medium
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear...6.3 Medium
- dell cpg bios, inspiron 15 7579 firmware +1 moreDell Inspiron 15 7579 2-in-1 BIOS versions prior to 1.31.0 contain an Improper SMM communication...6.9 Medium
- a10networks agalaxy, advanced core operating system +1 moreA10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated...9.8 Critical
chronocrates.ioPotential segfault in `localtime_r` invocationsNo score- model project modelData races in model8.1 High
- lexer project lexerData races in lexer8.1 High
- lever project leverData races in lever8.1 High
- abox project aboxData race in abox8.1 High
- libsbc project libsbcData races in libsbc8.1 High
- may queue project queueData race in may_queue5.9 Medium
- hashconsing project hashconsingData races in hashconsing7.5 High
- late-static project late-staticData races in late-static7.0 High
wolfsslOSS-FuzzHeap-buffer-overflow in wolfSSH_acceptNo scorerdkitOSS-FuzzUNKNOWN READ in __dynamic_castNo score- mozilla firefox, firefox esr, thunderbird +2 moreIn certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions...8.8 High
- apache airflow, airflow's experimental api +1 moreAuthentication bypass in Apache Airflow9.8 Critical
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific...8.8 High
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative...4.4 Medium
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an...5.5 Medium
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server...5.5 Medium
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML...4.9 Medium
- trend micro interscan messaging security virtual appliance (imsva), trendmicro interscan messaging security virtual appliance +1 moreTrend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross...8.8 High
- atlassian gajira-comment, jira comment +1 moreThe execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code in the context of a GitHub runner by creating a specially c…9.8 Critical
- atlassian gajira-create, jira create +1 moregajira-create GitHub action vulnerable to arbitrary code execution9.8 Critical
- netgear r6250 firmware, r6400 firmware, r6400v2 firmware +10 more +12 moreupnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a...8.8 High
- hazelcast, hazelcast jet +1 moreThe LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3,...9.8 Critical
- readytalk avian** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10...9.8 Critical
- ibm filenet content managerIBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. A remote...7.0 High
- ibm maximo spatial asset managementIBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross...4.8 Medium
- ibm maximo spatial asset managementIBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be...4.0 Medium
- capasystems capainstallerCapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges...7.8 High
- locustLocust Stored Cross-site Scripting Vulnerability6.1 Medium
- percona serverAn issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server...9.8 Critical
- microweberMicroweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both...8.1 High
- microweberMicroweber 1.1.18 is affected by broken authentication and session management. Local session...5.5 Medium
- microweberAn unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account...9.8 Critical
- microweberMicroweber Insufficient Session Expiry5.5 Medium
- keycloakPath Traversal6.8 Medium
- netflix dispatchThere were XSS vulnerabilities discovered and reported in the Dispatch application, affecting...5.4 Medium
- netflix dispatchThe Access Control issues include allowing a regular user to view a restricted incident, user...6.5 Medium
- red hat open-cluster-management, redhat advanced cluster management for kubernetes +1 moreAn issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to...5.7 Medium
- hackerone nextcloud server, nextcloud server +1 moreA wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed...5.3 Medium
- hackerone nextcloud server, nextcloud server +1 moreA cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption...4.1 Medium
- json8-merge-patch project json8-merge-patchPrototype pollution in json8-merge-patch7.5 High
- braveThe implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1...5.5 Medium
- pega platformPega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.6.1 Medium
- Show moreLoading…