CVEs published in November 2021
2,284 vulnerabilities, 191 critical, 13 exploited.
- concretecms concrete cmsServer-Side Request Forgery in Concrete CMS7.5 High
- concretecms concrete cmsServer-Side Request Forgery in Concrete CMS5.3 Medium
- beyondtrust privilege management for windowsBeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory...7.8 High
- sas sas\/intrnetSAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. The samples library (included...7.5 High
- teampasswordmanager team password managerTeam Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.7.5 High
- teampasswordmanager team password managerTeam Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during...8.8 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the...7.8 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain buffer over-read in the fxDebugThrow...7.1 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the...7.8 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fxIDToString...7.8 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the...7.8 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component ...7.8 High
- moddableOpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow via the component ...5.5 Medium
- wireshark, debian linux +1 moreNULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of...7.5 High
- greenplumIn versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to information disclosure from the file system. A malicious user c…9.1 Critical
- imagemagickA flaw was found in ImageMagick 7.1.0-14 where it did not properly sanitize certain input before...7.8 High
- greenplumIn versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs of the database. A malicious user with a…6.5 Medium
- adobe auditionAdobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability5.5 Medium
- spring by vmware cloud netflix, vmware spring cloud netflix +1 moreCode injection in spring-cloud-netflix-hystrix-dashboard8.8 High
- microsoft clarity, sammartin microsoft clarity +1 moreThere is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3. The XSS payload...5.4 Medium
- copy delete posts duplicate post wordpress plugin, duplicate post project post +1 moreDuplicate Post WordPress Plugin SQL Injection Vulnerability6.5 Medium
- wpo365 wordpress + microsoft office 365 / azure ad | login, wordpress \+ azure ad \/ microsoft office 365 +1 moreWPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting9.3 Critical
- preview e-mails for woocommerce e-mails for woocommercePreview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site Scripting6.1 Medium
- easy registration forms registration forms, easyregistrationforms easy registration forms +1 moreEasy Registration Forms <= 2.1.1 Cross-Site Request Forgery to Stored Cross-Site Scripting8.8 High
- oisf suricataSuricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP...9.8 Critical
- elastic kibanaAn open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user...6.1 Medium
- getgrav getgrav/grav-plugin-admin, grav-plugin-admin +1 moreCross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin4.6 Medium
- django-helpdesk django-helpdesk/django-helpdesk, django-helpdesk project django-helpdesk +1 moreCross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk8.8 High
- kevinpapst kevinpapst/kimai2, kimai 2 +1 moreCross-Site Request Forgery (CSRF) in kevinpapst/kimai24.6 Medium
- snipe snipe/snipe-it, snipeitapp snipe-it +1 moreCross-site Scripting (XSS) - Stored in snipe/snipe-it8.0 High
- kevinpapst kevinpapst/kimai2, kimai 2 +1 moreCross-Site Request Forgery (CSRF) in kevinpapst/kimai24.3 Medium
- vim, vim vim/vim, fedoraproject fedora +2 moreHeap-based Buffer Overflow in vim/vim8.0 High
- vim, vim vim/vim, debian linux +1 more +3 moreHeap-based Buffer Overflow in vim/vim7.3 High
- asus gt-ax11000 firmware, rt-ax3000 firmware, rt-ax55 firmware +15 more +17 moreA brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000,...9.8 Critical
- asus gt-ax11000 firmware, rt-ax3000 firmware, rt-ax55 firmware +15 more +17 moreAn HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55,...7.5 High
- kevinpapst kevinpapst/kimai2, kimai 2 +1 moreCross-Site Request Forgery (CSRF) in kevinpapst/kimai24.3 Medium
- apache ozoneUnauthenticated access to Ozone Recon HTTP endpoints5.3 Medium
- apache ozoneOwners of the S3 tokens are not validated8.8 High
- apache ozoneAccess mode of block tokens are not enforced6.5 Medium
- apache ozoneRaw block data can be read bypassing ACL/authorization6.8 Medium
- apache ozoneContainer-related datanode operations can be called without authorization9.1 Critical
- apache ozoneMissing admin check for SCM related admin commands8.8 High
- apache ozoneMissing authentication/authorization on internal RPC endpoints9.1 Critical
- apache ozoneOriginal block tokens are persisted and can be retrieved9.8 Critical
- 4mosan gcb doctor4MOSAn GCB Doctor - Improper Authorization9.8 Critical
- ionic identity vaultIn Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be...6.8 Medium
- debian linux, fedoraproject fedora, roundcube webmail +2 moreRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's...6.1 Medium
- debian linux, fedoraproject fedora, roundcube webmail +2 moreRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search...9.8 Critical
c-blosc2OSS-FuzzHeap-buffer-overflow in inflateNo score- wireshark, debian linux, fedoraproject fedora +2 moreUncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3...7.5 High
- Show moreLoading…