CVEs published in November 2021
2,284 vulnerabilities, 191 critical, 13 exploited.
- bytecodealliance lucetUse After Free in lucet8.5 High
- ipuptime pinkiePinkie 2.15 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read ...7.5 High
- vercot servaServa 4.4.0 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read ...7.5 High
- rosariosisSQL Injection in rosariosis9.8 Critical
- nodebbPath traversal in translator module of NobeBB5.0 Medium
- nodebbAPI token verification can be bypassed9.8 Critical
- nodebbXSS via prototype pollution9.0 Critical
- backstagePath Traversal in @backstage/plugin-scaffolder-backend8.5 High
- acronis agentSensitive information could be logged7.5 High
- acronis cyber protect 15, cyber protect +1 moreSelf cross-site scripting (XSS) was possible on devices page5.4 Medium
- acronis agent, cyber protect 15, cyber protect home office +1 more +3 moreDLL hijacking could lead to denial of service5.5 Medium
- acronis cyber protect 15, cyber protect +1 moreStored cross-site scripting (XSS) was possible in activity details5.4 Medium
- acronis cyber protect 15, cyber protect +1 moreStored cross-site scripting (XSS) was possible in protection plan details5.4 Medium
- acronis cyber protect 15, cyber protect +1 moreDLL hijacking could lead to local privilege escalation7.8 High
- acronis cyber protect 15, cyber protect +1 moreCross-site scripting (XSS) was possible in notification pop-ups6.1 Medium
- steticStetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting8.8 High
- asgaros forum, asgaros forums forums +1 moreAsgaros Forums <= 1.15.13 Authenticated Stored XSS4.8 Medium
- contact form with captcha form with captchaContact Form With Captcha <= 1.6.2 Cross-Site Request Forgery to Reflected Cross-Site Scripting8.8 High
- python-ldapDenial of Service in python-ldap6.5 Medium
- huawei ecns280 td firmware, ese620x vess firmware +1 moreSome Huawei products use the OpenHpi software for hardware management. A function that parses...6.5 Medium
- tripexpress project tripexpressAn unspecified version of tripexpress is affected by a path manipulation vulnerability in file...9.8 Critical
- youtube-php-mirroring project youtube-php-mirroringAn unspecified version of youtube-php-mirroring is affected by a Cross Site Scripting (XSS)...6.1 Medium
- vestacp vesta control panelvesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.9.8 Critical
- issabel pbxAn unspecified version of issabelPBX is affected by a Cross Site Scripting (XSS) vulnerability....6.1 Medium
- twmap project twmapAn unspecified version of twmap is affected by a Cross Site Scripting (XSS) vulnerability. In...6.1 Medium
- workerman-thinkphp-redis project workerman-thinkphp-redisAn unspecified version of Workerman-ThinkPHP-Redis is affected by a Cross Site Scripting (XSS)...6.1 Medium
- rust-embed project rust-embedRustEmbed generated `get` method allows for directory traversal when reading files from disk7.5 High
- phpwhois project phpwhoisAn unspecified version of phpWhois is affected by a Cross Site Scripting (XSS) vulnerability. In...6.1 Medium
aspnetcore-runtime-5.0AlmaLinux,aspnetcore-targeting-pack-5.0AlmaLinux,dotnet5.0-build-reference-packagesAlmaLinux +7 more +9 more.NET 5.0 bugfix updateNo score- joe dolson my calendar, my calendar project calendar +1 moreMy Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site Scripting5.4 Medium
- smashballoon smash balloon social post feedSmash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS5.4 Medium
- contest gallery gallery, unknown contest gallery – photo contest plugin for wordpress +1 moreContest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure9.8 Critical
- unknown check & log email, wpchill check \& log email +1 moreCheck & Log Email < 1.0.4 - Reflected Cross-Site Scripting6.1 Medium
- media-tags project media-tags, unknown media tags +1 moreMedia-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site Scripting4.8 Medium
- ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 moreNinja Forms < 3.6.4 - Admin+ SQL Injection7.2 High
- essentialplugin popup anything, unknown popup anything – a marketing popup +1 morePopup Anything < 2.0.4 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- roundupwp registrations for the events calendar, unknown registrations for the events calendar – event registration plugin +1 moreRegistrations for The Events Calendar < 2.7.5 - Reflected Cross-Site Scripting6.1 Medium
- bannersky bsk pdf managerBSK PDF Manager < 3.1.2 - Admin+ SQL Injection7.2 High
- bulk datetime change project datetime change, unknown bulk datetime change +1 moreBulk Datetime Change < 1.12 - Missing Authorisation5.4 Medium
- design stylish cost calculatorStylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS5.4 Medium
- shoppagewp shop page wpShop Page WP < 1.2.8 - Admin+ Stored Cross-Site Scripting4.8 Medium
- wprssaggregator wp rss aggregator, unknown wp rss aggregator – news feeds, autoblogging, youtube video feeds and more +1 moreWP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site Scripting4.8 Medium
- wpexperts mycred, mycred – points, rewards, gamification, ranks, badges & loyalty plugin, unknown mycred – points, rewards, gamification, ranks, badges & loyalty plugin +2 moremyCred < 2.3 - Subscriber+ SQL Injection8.8 High
- edge22 generateblocksGenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- kaizencoders url shortify, url shortify – simple, powerful and easy url shortener plugin for wordpress +1 moreURL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRF4.3 Medium
- m&s consulting email before downloadEmail Before Download < 6.8 - Admin+ SQL Injection8.8 High
- unknown about author boxAbout Author Box < 1.0.2 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- mycred, mycred – points, rewards, gamification, ranks, badges & loyalty plugin, unknown mycred – points, rewards, gamification, ranks, badges & loyalty plugin +2 moremyCRED < 1.7.8 - Reflected Cross-Site Scripting6.1 Medium
- wipro holmesWipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application...7.5 High
- wipro holmesWipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download...7.5 High
- Show moreLoading…