CVEs published in November 2020
1,536 vulnerabilities, 172 critical, 12 exploited.
- endress orsg35 firmware, orsg45 firmware, rsg35 firmware +3 more +5 moreENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management9.1 Critical
- primekey ejbcaAn issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an...4.3 Medium
- zte zxhn f670l firmware, zxhn z500 firmware +1 moreSome ZTE devices have input verification vulnerabilities. The devices support configuring a...3.5 Low
- moodle, fedoraproject fedora +1 moreSQL Injection in moodle6.5 Medium
- moodle, fedoraproject fedora +1 moreCross-site Scripting (XSS) in moodle6.1 Medium
- moodle, fedoraproject fedora +1 moreExposure of Sensitive Information to an Unauthorized Actor in Moodle5.3 Medium
- moodle, fedoraproject fedora +1 morePrivilage Escalation in moodle5.3 Medium
- moodle, fedoraproject fedora +1 moreImproper Access Control in moodle7.5 High
- oppo ovoicemanagerOvoiceManager has system permission to write vulnerability reports for arbitrary files, affected...9.8 Critical
- oppo qualityprotectQualityProtect has a vulnerability to execute arbitrary system commands, affected product is com...9.8 Critical
- oppo colorosDynamic loading of services in the backup and restore SDK leads to elevated privileges, affected...9.8 Critical
- johnsoncontrols victor web, johnson controls c•cure web client version 2.90 and prior (note - this does not affect the new web-based c•cure 9000 client that was introduced in c•cure 9000 v2.90), victor web client version 5.6 and prior +1 more +3 morevictor Web Client and C•CURE Web Client JSON Web Token (JWT) Vulnerability7.1 High
- debian linux, linux kernel, fedoraproject fedora +2 moreAn issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through...5.5 Medium
- tsmmanagerJamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass...7.5 High
- ibm jazz reporting serviceIBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site...6.4 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is...8.4 High
- mozilla firefox, firefox esr, thunderbird +2 moreSearching for a single word from the address bar caused an mDNS request to be sent on the local...6.5 Medium
- influxdata influxdb, debian linux +1 moreImproper Authentication in InfluxDB9.8 Critical
- nextcloud socialImproper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.5.3 Medium
- nextcloud socialMissing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0...7.4 High
- nodejs node, node.js, c-ares project c-ares +6 more +8 moreUncontrolled Resource Consumption in node7.5 High
- f5 big-ip access policy manager, big-ip advanced firewall manager, big-ip advanced web application firewall +11 more +13 moreIn versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be...4.3 Medium
- schneider-electric easergy t300 firmwareA CWE-284: Improper Access Control vulnerability exists in Easergy T300 (with firmware 2.7 and...9.8 Critical
- moodle, fedoraproject fedora +1 morePrivilage Escalation in moodle7.5 High
- gitlab, gitlab ce/ee +1 moreThe Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete...7.6 High
- gitlab, gitlab ce/ee +1 moreAn issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A...8.2 High
- gitlab, gitlab ce/ee +1 moreAn issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path...7.5 High
- symantec endpoint detection and responseSymantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information...7.5 High
- ljcmsshop project ljcmsshopA cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd...6.1 Medium
- semantic-releaseSecret disclosure in semantic-release8.1 High
- trustedfirmware op-tee, westerndigital inand cl em132 firmware, inand ix em132 firmware +1 more +3 moreWestern Digital iNAND devices through 2020-06-03 allow Authentication Bypass via a capture-replay...6.8 Medium
- salesagility suitecrmSuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview...5.4 Medium
- jupyter notebook, debian linux +1 moreOpen redirect in Jupyter Notebook4.4 Medium
- salesagility suitecrmSuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.6.1 Medium
- salesagility suitecrmSuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts,...7.8 High
- grocy project grocyCross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets...5.4 Medium
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual...7.2 High
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual...7.2 High
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an...8.8 High
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an...9.8 Critical
- trend micro worry-free business security, trend micro, inc. micro worry-free business security +1 moreA unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro...7.5 High
- trend micro apex oneA vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product...7.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus\+ security 2020 +3 more +5 moreTrend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could...7.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus\+ security 2020 +3 more +5 moreTrend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could...7.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus\+ security 2020 +3 more +5 moreTrend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could...7.8 High
- planet nvr-1615 firmware, nvr-915 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** The firmware of the PLANET Technology Corp NVR-915 and NVR-1615...9.8 Critical
- cisco dna spaces connector, dna spaces\ +1 moreCisco DNA Spaces Connector Command Injection Vulnerability9.4 Critical
- cisco iot field network director, iot field network director (iot-fnd) +1 moreCisco IoT Field Network Director Unauthenticated REST API Vulnerability9.8 Critical
- cisco expressway, telepresence video communication server (vcs) expressway, telepresence video communication server +2 moreCisco Expressway Software Unauthorized Access Information Disclosure Vulnerability6.5 Medium
- cisco webex meetings serverCisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure Vulnerability6.5 Medium
- Show moreLoading…