CVEs published in November 2020
1,536 vulnerabilities, 172 critical, 12 exploited.
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2...4.3 Medium
- anuko time trackerIn Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire...9.8 Critical
- anuko time trackerAnuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows...7.5 High
- phpgurukul user registration \& login and user management systemSQL injection vulnerability in PHPGurukul User Registration & Login and User Management System...9.8 Critical
- ivanti endpoint managerIvanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS...5.4 Medium
- ivanti endpoint managerLDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a ...8.8 High
- ivanti endpoint managerIn /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to...5.3 Medium
- lionwikiLionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via...7.5 High
- jetbrains ideavimJetBrains IdeaVim before version 0.58 might have caused an information leak in limited...7.5 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about...5.3 Medium
- jetbrains ktorIn JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.6.5 Medium
- jetbrains teamcityJetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.6.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in...5.3 Medium
- jetbrains toolboxJetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser...9.8 Critical
- jetbrains toolboxJetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser...7.5 High
- jetbrains youtrackJetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.5.3 Medium
- jetbrains youtrackJetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to...7.5 High
- jetbrains youtrackSensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0...3.3 Low
- chronoengine chronoforumsChronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a...6.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without...5.3 Medium
postgresqlSUSE,postgresql10SUSE,postgresql12SUSE +2 more +4 moreSecurity update for postgresql, postgresql96, postgresql10 and postgresql12No score- markdown-it-highlightjs project markdown-it-highlightjsCross-site Scripting (XSS)6.5 Medium
- google firebase\/utilPrototype Pollution5.6 Medium
- generator project generatorData races in generator5.9 Medium
- ruspiro-singleton project ruspiro-singletonData race in ruspiro-singleton8.1 High
- amazon aws encryption sdk, aws sdk +1 moreRobustness weakness in AWS KMS and Encryption SDKs4.8 Medium
- neuroinformatics unit, integrative computational brain science collaboration division, riken center for brain science xoonipsDeserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote...9.8 Critical
- neuroinformatics unit, integrative computational brain science collaboration division, riken center for brain science xoonipsStored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated...5.4 Medium
- neuroinformatics unit, integrative computational brain science collaboration division, riken center for brain science xoonipsReflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote...5.4 Medium
- neuroinformatics unit, integrative computational brain science collaboration division, riken center for brain science xoonipsSQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers...8.8 High
- vw polo firmwareThe update functionality of the Discover Media infotainment system in Volkswagen Polo 2019...6.8 Medium
- orbisius child theme creatorThe orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via...8.8 High
- wpbakery page builderThe WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to...6.4 Medium
- nagios xiImproper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an...8.8 High
- infinitewpIn InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset...9.8 Critical
- qnap qtsIf exploited, the command injection vulnerability could allow remote attackers to execute...7.2 High
- qnap qtsIf exploited, the command injection vulnerability could allow remote attackers to execute...7.2 High
- mitsubishi electric corporation melsec iq-r series cpu modules, mitsubishielectric melsec iq-r00 firmware, melsec iq-r01 firmware +6 more +8 moreUncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU...7.5 High
- hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...8.1 High
- hackerone nextcloud server, nextcloud server +1 moreInsufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an...4.4 Medium
- citrix virtual apps and desktopsAn unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as...8.8 High
- citrix virtual apps and desktops, xenapp, xendesktop +2 moreAn unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD...8.8 High
- citrix sd-wanPrivilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11...8.8 High
- citrix sd-wanAuthentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center...7.5 High
- citrix sd-wanUnauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions...9.8 Critical
libdatetime-timezone-perlDebianlibdatetime-timezone-perl - new upstream versionNo score- harman hermesA misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with...2.4 Low
- Show moreLoading…