CVEs published in November 2021
2,284 vulnerabilities, 191 critical, 13 exploited.
- amd athlon™ series, epyc 7232p firmware, epyc 7251 firmware +56 more +58 moreInsufficient validation of BIOS image length by PSP Firmware could lead to arbitrary code execution.7.8 High
- amd 3rd gen amd epyc™, epyc 7232p firmware, epyc 72f3 firmware +18 more +20 moreFailure to validate SEV Commands while SNP is active may result in a potential impact to memory...7.8 High
- amd 2nd gen amd epyc™, 3rd gen amd epyc™, epyc 7002 firmware +44 more +46 moreA potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an...7.8 High
- amd 3rd gen amd epyc™, epyc 7003 firmware, epyc 72f3 firmware +18 more +20 moreWhen the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently...7.8 High
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +58 more +60 moreA side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI...5.5 Medium
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +58 more +60 moreAMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to...7.8 High
- amd athlon™ series, epyc 7001 firmware, epyc 7002 firmware +57 more +59 moreImproper input and range checking in the Platform Security Processor (PSP) boot loader image...7.8 High
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +57 more +59 moreInsufficient ID command validation in the SEV Firmware may allow a local authenticated attacker...5.5 Medium
- ruijie rg-uac firmwareRuijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component ...7.5 High
- ruijie rg-uac 6000-e50 firmwareRuijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS)...6.1 Medium
- amd athlon™ series, epyc 7001 firmware, epyc 7002 firmware +57 more +59 moreRace condition in PSP FW could allow less privileged x86 code to perform PSP SMM operations.7.0 High
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +57 more +59 moreInsufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV...5.5 Medium
- amd athlon™ series, epyc 7002 firmware, epyc 7003 firmware +94 more +96 moreInsufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses...5.5 Medium
- amd athlon™ series, epyc 7232p firmware, epyc 7252 firmware +43 more +45 moreInsufficient input validation in PSP firmware for discrete TPM commands could allow a potential...7.1 High
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +57 more +59 morePersistent platform private key may not be protected with a random IV leading to a potential “two...7.5 High
- amd 1st gen amd epyc™, 2nd gen amd epyc™, 3rd gen amd epyc™ +57 more +59 moreAMD System Management Unit (SMU) may experience an integer overflow when an invalid length is...5.5 Medium
- canonical accountsservice, ubuntu linux +1 moreFree of static data in accountsservice7.8 High
- amd athlon™ series, epyc 7232p firmware, epyc 7251 firmware +57 more +59 morePSP protection against improperly configured side channels may lead to potential information...5.5 Medium
- amd 2nd gen amd epyc™, 3rd gen amd epyc™, epyc 7232p firmware +43 more +45 moreImproper access controls in System Management Unit (SMU) may allow for an attacker to override...7.5 High
- amd 3rd gen amd epyc™, epyc 7232p firmware, epyc 72f3 firmware +18 more +20 moreFailure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.7.8 High
- tibco partnerexpressTIBCO PartnerExpress Click-Jacking vulnerability9.8 Critical
- tibco partnerexpressTIBCO PartnerExpress Cross Site Scripting vulnerabilities9.0 Critical
- tibco partnerexpressTIBCO PartnerExpress Session Token in URL7.5 High
- doctrine-project database abstraction layerDBAL 3 SQL Injection Security Vulnerability9.8 Critical
- getkirby kirbyCross-site scripting (XSS) from image block content in the site frontend7.3 High
- getkirby kirbyCross-site scripting (XSS) from writer field content in the site frontend7.3 High
- ibm mq, websphere mq +1 moreIBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which...6.2 Medium
- ibm spectrum scaleIBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem...4.4 Medium
- meddata hbysMedData HBYS 1.0 Remote SQL Injection Vulnerability9.9 Critical
- meddata hbysMedData HBYS 1.0 Remote SQL Injection Vulnerability9.9 Critical
- ipack automation systems scada software, ipack scada automation +1 moreSQL Injection Vulnerability in Ipack SCADA Software9.8 Critical
- tokioRace Condition in tokio8.1 High
- micron lpddr4, ddr4 sdram firmware, lddr4 firmware +1 more +3 moreScalable Rowhammering In the Frequency Domain to Bypass TRR Mitigations On Modern DDR4/LPDDR4X Devices9.0 Critical
- darwin factorFactorJS - Insufficient Session Expiration Leads to a Local Account Takeover7.8 High
- darwin factorFactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality6.1 Medium
- darwin factorFactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories Functionality6.1 Medium
- darwin factorFactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality6.1 Medium
- apache shenyu, apache software foundation shenyu admin +1 moreApache ShenYu Admin bypass JWT authentication9.8 Critical
- arangodbArangoDB - Insufficient Session Expiration after Password Change8.8 High
- janeczku calibre-web, calibreweb +1 moreCalibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)8.8 High
drbd-utilsopenSUSESecurity update for drbd-utilsNo scoredrbd-utilsSUSESecurity update for drbd-utilsNo score- dotnetfoundation piranha cms, piranhacms piranha +1 morePiranha CMS - Site-wide Cross-Site Request Forgery (CSRF)8.1 High
- aifu information technology co. cash, aifu cashier accounting management system +1 moreTVN-2021100094.3 Medium
- ruby-lang date, ruby, debian linux +6 more +8 moreRegular expression denial of service vulnerability (ReDoS) in date7.5 High
@openzeppelin/contractsnpm,@openzeppelin/contracts-upgradeablenpm +1 moreERC1155Supply vulnerability in OpenZeppelin ContractsNo score- discourseCache poisoning via maliciously-formed request in discourse4.8 Medium
- cron-utils project cron-utilsUnauthenticated remote code injection in cron-utils10.0 Critical
- iidk-the-actual console, min minio console +1 moreAuthentication bypass issue in the Operator Console8.6 High
- grafanaCross organization admin control in Grafana9.1 Critical
- Show moreLoading…