CVEs published in November 2020
1,536 vulnerabilities, 172 critical, 12 exploited.
- vmware sd-wan orchestratorThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set...8.8 High
- vmware sd-wan orchestratorThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct...6.5 Medium
- vmware sd-wan orchestratorVMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0...6.5 Medium
- vmware sd-wan orchestratorThe SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1...7.2 High
- vmware sd-wan orchestratorThe SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the...9.8 Critical
- newsscriptphp news script php proSimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in...9.8 Critical
- newsscriptphp news script php proSimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS)...6.1 Medium
- newsscriptphp news script php proSimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session...6.5 Medium
- newsscriptphp news script php proSimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF)...6.5 Medium
- misp-project mispMISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php...9.8 Critical
- cache project cacheData races in cache8.1 High
- project convecData races in convec8.1 High
- conqueue project conqueueData race in conqueue8.1 High
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreDenial of service via malformed network packet7.5 High
- seiko epson corporation the installers of multiple seiko epson products, epson album print, color calibration utility +31 more +33 moreUntrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an...7.8 High
- netgear gs108ev3 firmware, netgear japan g.k. gs108ev3 +1 moreCross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier...6.5 Medium
- mediawikiincludes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS...4.8 Medium
- mediawikiThe PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll...5.4 Medium
- hashicorp nomadPath Traversal in HashiCorp Nomad6.5 Medium
- matrix synapse, fedoraproject fedora +1 moreDenial of service attack due to invalid JSON7.5 High
- ortussolutions testboxIn Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index...5.3 Medium
- ortussolutions testboxIn Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system...9.8 Critical
- giteaImproper Access Control in Gitea9.8 Critical
- freedesktop xdg-utilsA flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling...6.5 Medium
- spip, debian linux +1 moreImproper Input Validation in SPIP9.8 Critical
- vmware identity manager, identity manager connector, one access +3 more +5 moreVMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector...9.1 Critical
- typo3, typo3 typo3.cms +1 moreXML External Entity in Dashboard Widget3.7 Low
- typo3, typo3 typo3.cms +1 moreCleartext storage of session identifier8.1 High
- redhat.com rhacm, redhat advanced cluster management for kubernetes +1 moreA flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were...3.5 Low
- typo3, typo3 typo3.cms +1 moreCross-Site Scripting in Fluid view helpers6.1 Medium
- playgroundsessions playground sessionsPlayground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text...7.5 High
- octobercms octoberBypass of fix for CVE-2020-15247, Twig sandbox escape5.2 Medium
- v-secure jingyun antivirusIn Jingyun Antivirus v2.4.2.39, the driver file (hookbody.sys) allows local users to cause a...7.8 High
- v-secure jingyun antivirusIn Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a...7.8 High
- v-secure jingyun antivirusIn Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a...7.8 High
- v-secure jingyun antivirusIn Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a...7.8 High
- private-ip project private-ipServer-Side Request Forgery in private-ip9.8 Critical
- v-secure jingyun antivirusIn Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a...7.8 High
- linux kernelThe Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty...4.4 Medium
- linux kernel, broadcom brocade fabric operating system firmware, netapp a250 firmware +16 more +18 moreUse-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users...6.7 Medium
- octobercms octoberStored XSS by authenticated backend user with access to upload files2.8 Low
- octobercms octoberPrivilege escalation by backend users assigned to the default "Publisher" system role4.0 Medium
- magicpinThere is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin...6.1 Medium
- octobercms octoberTwig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.5.2 Medium
- octobercms octoberLocal File Inclusion by unauthenticated users7.5 High
- scratchaddons scratch addons, scratchaddons +1 moreCross-Site Scripting in Scratch browser addons7.6 High
- mongodb ops managerPotential privilege escalation in Ops Manager API8.1 High
- mutt, neomutt, debian linux +2 moreMutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed...5.3 Medium
- winscpBuffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or...9.8 Critical
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreInfinite loop in aggregation expression6.5 Medium
- Show moreLoading…