CVEs published in November 2022
3,183 vulnerabilities, 267 critical, 13 exploited.
- salonerp project salonerpSalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This...6.1 Medium
- auieo candidatsCandidATS version 3.0.0 allows an external attacker to elevate privileges in the application....8.8 High
- auieo candidatsCandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This...8.8 High
- auieo candidatsCandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to...6.1 Medium
- auieo candidatsCandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external...6.1 Medium
- auieo candidatsCandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to...6.1 Medium
- auieo candidatsCandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to...6.1 Medium
- auieosoftware candidatsCandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This...7.5 High
- auieo candidatsCandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application...9.8 Critical
- deep-parse-json project deep-parse-jsondeep-parse-json 1.0.2 - Prototype Pollution5.3 Medium
- ibm robotic process automation for cloud pakIBM Robotic Process Automation for Cloud Pak information disclosure3.3 Low
- fastest-json-copy project fastest-json-copyfastest-json-copy 1.0.1 - Prototype Pollution5.3 Medium
- deep-object-diff project deep-object-diffdeep-object-diff 1.1.0 - Prototype Pollution5.3 Medium
- amitmerchant1990 markdownifyMarkdownify has Files or Directories Accessible to External Parties5.5 Medium
- openwrt luciOpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site...5.4 Medium
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE)...9.1 Critical
- hendrik erz zettlrZettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any...5.5 Medium
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by...6.5 Medium
- ibm mq appliance"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout...6.5 Medium
- keystonejs keystoneNODE_ENV in Keystone defaults to development with esbuild9.8 Critical
- glpi-project glpiImproper input validation on emails links in GLPI2.6 Low
- glpi-project glpiCross-Site Scripting (XSS) through public RSS feed in GLPI4.5 Medium
- glpi-project glpiStored Cross-Site Scripting (XSS) in entity name in GLPI4.9 Medium
- glpi-project glpiStored Cross-Site Scripting (XSS) in user information in GLPI3.5 Low
- glpi-project glpiStored Cross-Site Scripting (XSS) through asset inventory in GLPI7.5 High
- glpi-project glpiImproper access to debug panel in GLPI4.3 Medium
- glpi-project glpiSQL Injection on REST API in GLPI7.4 High
- glpi-project glpiCross-Site Scripting (XSS) in external links in GLPI4.5 Medium
- glpi-project glpiBlind Server-Side Request Forgery (SSRF) in RSS feeds and planning3.5 Low
- glpi-project glpiStored Cross-Site Scripting (XSS) on login page in GLPI5.2 Medium
- glpi-project glpiuser session persists even after permanently deleting account in GLPI4.7 Medium
- ibm websphere application server"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the...5.9 Medium
- ibm robotic process automation, robotic process automation as a service, robotic process automation for cloud pak +2 moreIBM Robotic Process Automation information disclosure5.3 Medium
- avaya scopia pathfinder 10 pts firmware, scopia pathfinder 20 pts firmware +1 more** UNSUPPPORTED WHEN ASSIGNED **Broken Access Control in User Authentication in Avaya Scopia...9.1 Critical
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute...7.8 High
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm business automation workflow"IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20...4.3 Medium
- ibm cognos analytics"IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which...6.5 Medium
- apache software foundation uima, apache uimaj +1 moreApache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archives7.5 High
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could...8.8 High
- ibm infosphere information server, infosphere information server on cloud +1 more"IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information...6.5 Medium
- ibm infosphere information server"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote...9.8 Critical
- alpine project alpineAlpine before 2.25 allows remote attackers to cause a denial of service (daemon crash) when LIST...5.9 Medium
- ibm security guardiumIBM Security Guardium information disclosure4.4 Medium
- opencartOpenCart SQL injection vulnerability4.9 Medium
- mkcms project mkcmsMKCMS V6.2 has SQL injection via the /ucenter/repass.php name parameter.9.8 Critical
- mkcms project mkcmsMKCMS V6.2 has SQL injection via the /ucenter/active.php verify parameter.9.8 Critical
- mkcms project mkcmsMKCMS V6.2 has SQL injection via /ucenter/reg.php name parameter.9.8 Critical
- am-hili project am-hili, ayoub media am-hili (wordpress plugin) +1 moreWordPress AM-HiLi plugin <= 1.0 - Auth. Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- Show moreLoading…