CVEs published in November 2022
3,183 vulnerabilities, 267 critical, 13 exploited.
- wowonderWoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability...7.5 High
- apache airflowApache Airflow <2.4.0 has an RCE in a bash example8.8 High
- kareadita kareadita/kavita, kavitareader kavita +1 moreImproper Restriction of Excessive Authentication Attempts in kareadita/kavita9.4 Critical
- sanitization management system project management system, sourcecodester sanitization management system +1 moreSourceCodester Sanitization Management System Banner Image cross site scripting2.4 Low
- elated-themes frappeFrappe Search navbar_search.html cross site scripting3.5 Low
- linux kernelA use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol...7.8 High
- discourseUsers erroneously and transparently added to private messages in Discourse6.5 Medium
- linux kernelAn incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux...4.6 Medium
- nintex workflowThe Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.6.1 Medium
- microsoft device-mapper-multipath, redhat enterprise linux +1 moreA vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows...7.8 High
- gnome nautilus, fedoraproject fedora +1 moreGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a...5.5 Medium
- camp project camppatrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is...9.8 Critical
- digitialpixies oauth client, unknown oauth client by digitialpixies +1 moreOAuth Client by DigitialPixies <= 1.1.0 - CSRF6.5 Medium
- digitialpixies oauth client, unknown oauth client by digitialpixies +1 moreOAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- metagauss profilegrid, profilegrid – user profiles, memberships, groups and communities – user profiles, memberships, groups and communities, unknown profilegrid – user profiles, memberships, groups and communities +2 moreProfileGrid < 5.1.1 - Reflected Cross-Site Scripting6.1 Medium
- unknown wpforms pro, wpforms pro +1 moreWPForms Pro < 1.7.7 - CSV Injection9.8 Critical
- konker platformKonker v2.3.9 was to discovered to contain a Cross-Site Request Forgery (CSRF).8.8 High
- unknown testimonials, themepoints super testimonials, unknown testimonial pro +2 moreTestimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site Scripting4.8 Medium
- unknown webmaster tools verification, webmaster tools verification project tools verification +1 moreWebmaster Tools Verification <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation6.5 Medium
- wpb show core project show core, unknown wpb-show-core +1 moreWPB Show Core - Reflected Cross-Site Scripting6.1 Medium
- macho themes newsmag, newspaper project newspaper, tagdiv composer +2 moretagDiv Composer < 3.5 - Unauthenticated Account Takeover9.8 Critical
- marco milesi wp attachmentsWP Attachments < 5.0.5 - Admin+ Stored Cross-Site Scripting4.8 Medium
- insyde insydeh2oDMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe...7.8 High
- bluecoral chat bubble, blue coral chat bubble – floating chat with contact chat icons, messages, telegram, email, sms, call me back +1 moreChat Bubble < 2.3 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- insyde kernelDMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could...6.4 Medium
- insyde kernelDMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI...7.0 High
- insyde kernelDMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI...7.0 High
- insyde kernelDMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI...7.0 High
- insyde kernelDMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead...6.4 Medium
- insyde kernelDMA transactions which are targeted at input buffers used for the HddPassword software SMI...7.0 High
- insyde kernelDMA transactions which are targeted at input buffers used for the SdHostDriver software SMI...7.0 High
- insyde kernelDMA transactions which are targeted at input buffers used for the software SMI handler used by...6.4 Medium
- insyde kernelDMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI...6.4 Medium
- insyde kernelDMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler...7.0 High
- ikus-soft rdiffweb, ikus060 ikus060/rdiffweb +1 moreInsufficient Session Expiration in ikus060/rdiffweb6.1 Medium
- linux kernelA double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount...7.8 High
- insyde kernelDMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software...6.4 Medium
- insyde kernelDMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe...6.4 Medium
- insyde kernelUpdate description and links DMA transactions which are targeted at input buffers used for the...6.4 Medium
- insyde kernelDMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after...6.4 Medium
- insyde kernelDMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after...6.4 Medium
- apache airflowApache Airflow prior to 2.3.1 may include sensitive values in rendered template7.5 High
- resmush.it image optimizer, unknown resmush.it : the only free image optimizer & compress plugin +1 morereSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX Calls4.3 Medium
- resmush.it image optimizer, unknown resmush.it : the only free image optimizer & compress plugin +1 morereSmush.it Image Optimizer < 0.4.7 - Multiple CSRF6.5 Medium
- op5 monitorOP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).6.1 Medium
- xiongmaitech xm-jpr2-lx firmwareXiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text...5.3 Medium
- xiongmaitech xm-jpr2-lx firmwareXiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.7.5 High
- nodejs node, node.js, debian linux +2 moreA OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19...8.1 High
- nagvisNagVis CoreLogonMultisite.php checkAuthCookie type conversion5.6 Medium
- nodebbNodeBB abort cross-site request forgery4.3 Medium
- Show moreLoading…