CVEs published in November 2020
1,536 vulnerabilities, 172 critical, 12 exploited.
openvswitchOSS-FuzzHeap-use-after-free in decode_NXAST_RAW_ENCAPNo score- intelbras tip200 firmware, tip200lite firmware, tip300 firmware +2 moreIntelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi...5.4 Medium
- libslirp project libslirp, debian linux, fedoraproject fedora +2 moreModerate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update4.3 Medium
popplerUbuntupoppler regressionNo score- cloudera data engineeringCloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.8.8 High
- bigbluebuttonAn issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because...3.7 Low
- bigbluebuttonAn issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an...7.5 High
dashopenSUSESecurity update for dashNo score- intelbras tip200 firmware, tip200lite firmware, tip300 firmware +2 moreIntelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow...5.3 Medium
- glpi-project glpiIn GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).4.3 Medium
- glpi-project glpiIn GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.)…4.3 Medium
- zetetic sqlcipherZetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and...7.5 High
- sebhildebrandt systeminformationPrototype Pollution7.3 High
- djvalidator project djvalidatorRegular Expression Denial of Service (ReDoS)5.3 Medium
- petl project petlDuplicate Advisory: XML Injection in petl9.8 Critical
- rockwell automation factorytalk linxA heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This...9.8 Critical
- rockwell automation factorytalk linxA heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This...7.5 High
- rockwell automation factorytalk linxA flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior....7.5 High
libjpeg-turboOSS-FuzzHeap-buffer-overflow in decompress_smooth_dataNo scorelibavcOSS-FuzzHeap-buffer-overflow in ih264d_parse_psliceNo score- libslirp project libslirp, debian linux, fedoraproject fedora +2 moreslirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain...4.3 Medium
- lxml, debian linux, fedoraproject fedora +5 more +7 morelxml vulnerable to Cross-site Scripting6.1 Medium
- atlassian crucible, fisheye +1 moreAffected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of...7.5 High
- x11vnc project x11vnc, debian linux, fedoraproject fedora +2 morescan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other...8.8 High
- atlassian crucible, fisheye +1 moreAffected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application...7.5 High
- oscommerceosCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into...4.8 Medium
- glpi-project glpiAny GLPI CalDAV calendars is read-only for every authenticated user7.7 High
- nanopbMemory leak in nanopb7.5 High
- liquidfilesAn XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from...9.0 Critical
- liquidfilesA Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client...6.1 Medium
- ethereum go ethereum, go-ethereum +1 moreErroneous Proof of Work calculation in geth5.3 Medium
- ethereum go ethereum, go-ethereum +1 moreShallow copy bug in geth6.5 Medium
- ethereum go ethereum, go-ethereum +1 moreDenial of service in geth6.5 Medium
c-blosc2OSS-FuzzHeap-buffer-overflow in frame_get_usermetaNo scorec-blosc2OSS-FuzzHeap-buffer-overflow in Lizard_decompress_safeNo score- spipSpip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection...8.8 High
- spipA PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP...8.8 High
- spipMultiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web...6.1 Medium
- freedesktop poppler, debian linux, redhat enterprise linux +2 moreA flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote...7.5 High
- cron-utils project cron-utilsCritical vulnerability found in cron-utils7.9 High
- modern honey network project honey network_get_flag_ip_localdb in server/mhn/ui/utils.py in Modern Honey Network (MHN) through 2020-11-23...5.5 Medium
- google chromeInappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote...6.5 Medium
- google chromeInsufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66...8.8 High
- google chromeInappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local...4.3 Medium
- google chromeInappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote...4.3 Medium
- google chromeInsufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote...4.3 Medium
- google chromeInsufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote...4.3 Medium
- google chromeInsufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote...6.1 Medium
- google chromeInappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote...8.8 High
- google chromeHeap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker...8.8 High
- Show moreLoading…