CVEs published in November 2021
2,284 vulnerabilities, 191 critical, 13 exploited.
- backstage, linuxfoundation auth backend +1 moreXSS vulnerability in @backstage/plugin-auth-backend7.4 High
- basercmsZip Slip Vulnerability in BaserCMS7.7 High
- basercmsOS Command Injection Vulnerability and Potential Zip Slip Vulnerability9.1 Critical
- getawesomesupport awesome support, awesome support (wordpress plugin), awesome support team support (wordpress plugin) +2 moreWordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities6.1 Medium
- f-secure atlant, elements endpoint protection, endpoint protection products on windows and mac. f-secure linux security (32-bit) f-secure linux security 64 f-secure internet gatekeeper & f-secure atlant +3 more +5 moreDenial-of-Service (DoS) Vulnerability5.5 Medium
- hitachi energy rtu500 series, hitachienergy rtu500 firmware +1 moreSpecially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series7.5 High
- acurax floating social media icon, acurax technologies floating social media icon (wordpress plugin) +1 moreWordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- bandisoft ark, ark library +1 morebandisoft ARK library integer overflow vulnerability7.8 High
- goqual gkw-ic052, hej hejhome gkw-ic052 firmware +1 moreHejHome IP Camera use of hard-coded credentials vulnerability8.1 High
- afreecatv, afreecatv afreecatvstreamer.exe +1 moreAfreecaTV streamer service stack-based buffer overflow7.5 High
- sophos sg utm, unified threat management up2date +1 moreAn authenticated user could potentially execute code via an SQLi vulnerability in the user portal...8.8 High
- sophos exploit prevention, intercept x advanced, intercept x advanced for server +2 more +4 moreA local administrator could prevent the HMPA service from starting despite tamper protection...4.4 Medium
- qnap qvrImproper Authentication Vulnerability in VioStor8.8 High
- qnap qvrCommand Injection Vulnerability in VioStor9.8 Critical
curlOSS-FuzzHeap-buffer-overflow in junkscanNo score- keepalived, fedoraproject fedora +1 moreIn Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message...5.4 Medium
- debian linux, linux kernel, fedoraproject fedora +3 more +5 moreA memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user...4.4 Medium
- wordpressWordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for...8.1 High
- linux kernelA race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and...4.1 Medium
- gin-vue-admin project gin-vue-adminGin-Vue-Admin before 2.4.6 mishandles a SQL database.9.8 Critical
shopware/corePackagist,shopware/platformPackagist +1 moreWebcache Poisoning in shopware/platform and shopware/coreNo score- sensiolabs symfony, fedoraproject fedora +1 moreCSV Injection in Symfony6.5 Medium
- sensiolabs symfonyWebcache Poisoning in Symfony6.5 Medium
- sensiolabs symfonyCookie persistence in Symfony6.5 Medium
- glpi-project barcodePath traversal in GLPI barcode plugin9.1 Critical
- ubiquiti inc unifi protect application, ui unifi protect +1 moreA Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1...8.8 High
- zoom controllers for zoom rooms, hybrid mmr, hybrid zproxy +38 more +40 moreProcess memory exposure in Zoom Client and other products5.3 Medium
- zoom controllers for zoom rooms, hybrid mmr, hybrid zproxy +37 more +39 moreBuffer overflow in Zoom client and other products7.3 High
- vmware vcenter serverThe vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability...9.8 Critical
- vmware vcenter server, cloud foundation +1 moreThe vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A...7.5 High
- wpwave hide my wp, hide my wp (wordpress plugin) +1 moreWordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability8.6 High
- wpwave hide my wp, hide my wp (wordpress plugin) +1 moreWordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability6.5 Medium
- windriver vxworksAn issue was discovered in VxWorks 6.9 through 7. In the IKE component, a specifically crafted...6.5 Medium
- ibm planning analyticsIBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could...6.8 Medium
- bitdefender endpoint security tools, gravityzone, unified endpoint for linux +2 moreServer-Side Request Forgery in EPPUpdateService remote config file (VA-9825)5.3 Medium
- bitdefender endpoint security tools for linux, endpoint security tools, gravityzone +1 more +3 moreImproper Access Control vulnerability in the patchesUpdate API9.0 Critical
- bitdefender endpoint security tools, gravityzone +1 moreInsufficient validation on regular expression in EPPUpdateService config file (VA-9825)5.3 Medium
- apache jspwikiArbitrary file deletion on logout9.1 Critical
- apache jspwikiXSS vulnerability on Denounce plugin6.1 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreUser may trigger invariant when allowed to send commands directly to shards6.5 Medium
- alfasado powercms, alfasado inc. powercms xmlrpc api +1 morePowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and...9.8 Critical
- rwtxt project rwtxtCross-site Scripting in github.com/schollz/rwtxt6.1 Medium
- delite studio push notifications for wordpress (lite), delitestudio push notifications for wordpress +1 moreCross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite)...8.8 High
- xml-sitemaps unlimited sitemap generatorCross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to...8.8 High
- ntt-west biz box nvr510 firmware, biz box nvr700w firmware, biz box rtx1210 firmware +6 more +8 moreImproper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI...5.7 Medium
- ntt-west biz box nvr510 firmware, biz box nvr700w firmware, biz box rtx1210 firmware +6 more +8 moreCross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier,...5.4 Medium
- ec-cube, ec-cube co.,ltd. 2 series +1 moreEC-CUBE Cross-site request forgery (CSRF) vulnerability6.5 Medium
- ec-cube, ec-cube co.,ltd. 2 series +1 moreEC-CUBE Improper access control in Management screen6.5 Medium
- saasproject booking package - appointment booking calendar system, booking package +1 moreCross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System...6.1 Medium
- mercari, mercari, inc. android app 'mercari (merpay) - marketplace and mobile payments app' (japan version) +1 moreImproper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari ...7.5 High
- Show moreLoading…