CVEs published in November 2022
3,183 vulnerabilities, 267 critical, 13 exploited.
openscOSS-FuzzStack-buffer-overflow in authentic_get_tagged_dataNo scoretumbleropenSUSESecurity update for tumblerNo scoretumbleropenSUSESecurity update for tumblerNo score- librenms, librenms librenms/librenms +1 moreInsufficient Session Expiration in librenms/librenms2.7 Low
- librenms, librenms librenms/librenms +1 moreCross-site Scripting (XSS) - Generic in librenms/librenms3.4 Low
- librenms, librenms librenms/librenms +1 moreImproperly Controlled Modification of Dynamically-Determined Object Attributes in librenms/librenms7.6 High
- librenms, librenms librenms/librenms +1 moreCross-site Scripting (XSS) - Stored in librenms/librenms3.4 Low
- librenms, librenms librenms/librenms +1 moreCross-site Scripting (XSS) - Stored in librenms/librenms4.3 Medium
- librenms, librenms librenms/librenms +1 moreCross-site Scripting (XSS) - Generic in librenms/librenms4.3 Medium
- librenms, librenms librenms/librenms +1 moreDeserialization of Untrusted Data in librenms/librenms9.0 Critical
- librenms, librenms librenms/librenms +1 moreCross-site Scripting (XSS) - Stored in librenms/librenms5.7 Medium
- aliyun-oss-client project aliyun-oss-client, tu6ge oss-rs +1 moreExposure of sensitive information in aliyun-oss-client5.6 Medium
- heimdal project heimdal, mit kerberos 5, samba +3 more +5 moreImportant: krb5 security update8.8 High
- knative func, linuxfoundation knative func +1 moreCredential exposure when running third-party builders in knative/func6.1 Medium
- flarum, flarum framework +1 moreCross site scripting vulnerability with discussion titles in flarum9.0 Critical
- davidmoreno onion, mozilla firefox +1 moredavidmoreno onion Log response.c onion_response_flush allocation of resources3.5 Low
- cbeust testngcbeust testng XML File Parser JarFileUtils.java testngXmlExistsInJar path traversal5.5 Medium
- dalli project dalliDalli Meta Protocol request_formatter.rb self.meta_set injection6.3 Medium
- wordplus better messages, better messages (wordpress plugin) +1 moreWordPress Better Messages plugin <= 1.9.10.68 - Server-Side Request Forgery (SSRF) vulnerability6.4 Medium
- webence iq block country, pascal iq block country (wordpress) +1 moreWordPress iQ Block Country plugin <= 1.2.18 - Block BYPASS vulnerability5.3 Medium
- wordplus better messages, better messages (wordpress plugin) +1 moreWordPress Better Messages plugin <= 1.9.10.69 - Auth. Messaging Block Bypass vulnerability4.3 Medium
- wp-polls project wp-polls, lester 'gamerz' chan wp-polls (wordpress plugin) +1 moreWordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerability4.3 Medium
- davidlingren media library assistant, david lingren media library assistant (wordpress plugin) +1 moreWordPress Media Library Assistant plugin <= 3.00 - Unauthenticated Error Log Disclosure vulnerability3.7 Low
- agilelogix store locator, store locator wordpress (wordpress plugin) +1 moreWordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability6.1 Medium
- maxfoundry media library folders, max foundry media library folders (wordpress plugin) +1 moreWordPress Media Library Folders plugin <= 7.1.1 - Cross-Site Request Forgery (CSRF) vulnerability5.4 Medium
- wpchill customizable wordpress gallery plugin - modula image gallery, modula image gallery (wordpress plugin) +1 moreWordPress Modula plugin <= 2.6.9 - Unauth. Plugin Settings Change vulnerability6.5 Medium
- algolplus phone orders for woocommerce, phone orders for woocommerce (wordpress plugin) +1 moreWordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability4.3 Medium
- accessibility project accessibility, octa code accessibility (wordpress plugin) +1 moreWordPress Accessibility plugin <= 1.0.3 - Auth. Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- themeum wp page builder, wp page builder (wordpress plugin) +1 moreWordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities4.8 Medium
- viszt péter csomagpontok és szállítási címkék woocommerce-hez (wordpress plugin), integration for szamlazz.hu & woocommerce (wordpress plugin), visztpeter integration for szamlazz.hu \& woocommerce +1 more +3 moreMultiple Cross-Site Request Forgery (CSRF) vulnerabilities in Integration for Szamlazz.hu & WooCommerce and Csomagpontok és szállítási címkék WooCommerce hez plugins5.4 Medium
- oxilab image hover effects ultimate, biplob adhikari image hover effects ultimate (wordpress plugin) +1 moreWordPress Image Hover Effects Ultimate plugin <= 9.7.1 - Auth. WordPress Options Change vulnerability7.2 High
- clogica seo redirection, wp-buy seo redirection plugin – 301 redirect manager (wordpress plugin) +1 moreWordPress SEO Redirection Plugin plugin <= 8.9 - Multiple Cross-Site Scripting (CSRF) vulnerabilities5.4 Medium
- api2cart bridge connector, bridge connector (wordpress plugin) +1 moreWordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability9.8 Critical
- api2cart bridge connector, bridge connector (wordpress plugin) +1 moreWordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary Code Execution vulnerability10.0 Critical
- pencidesign soledad, soledad (wordpress theme) +1 moreWordPress Soledad premium theme <= 8.2.5 - Auth. Cross-Site Scripting (XSS) vulnerability5.4 Medium
- gvectors wpdiscuz, gvectors team comments – wpdiscuz (wordpress plugin) +1 moreWordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- constantcontact creative mail, constant contact creative mail (wordpress plugin) +1 moreWordPress Creative Mail plugin <= 1.5.4 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities5.4 Medium
- watchtowerhq watchtower, whatarmy watchtowerhq (wordpress plugin) +1 moreWordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Download vulnerability7.5 High
- watchtowerhq watchtower, whatarmy watchtowerhq (wordpress plugin) +1 moreWordPress WatchTowerHQ plugin <= 3.6.15 - Unauth. Arbitrary File Deletion vulnerability9.1 Critical
- oxilab accordions, biplob adhikari accordions – multiple accordions or faqs builder (wordpress plugin) +1 moreWordPress Accordions plugin <= 2.0.3 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities3.4 Low
- villatheme s2w – import shopify to woocommerce (wordpress plugin), s2w - import shopify to woocommerce +1 moreWordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability4.9 Medium
- richplugins plugin for google reviews, plugin for google reviews (wordpress plugin) +1 moreWordPress Plugin for Google Reviews plugin <= 2.2.2 - Auth. Broken Access Control vulnerability4.3 Medium
- wpbrigade loginpress, loginpress | custom login page customizer (wordpress plugin) +1 moreWordPress LoginPress plugin <= 1.6.2 - Broken Access Control vulnerability5.3 Medium
- expresstech quiz and survey master, quiz and survey master (wordpress plugin) +1 moreWordPress Quiz And Survey Master plugin <= 7.3.10 - Sensitive Information Disclosure vulnerability5.3 Medium
- expresstech quiz and survey master, quiz and survey master (wordpress plugin) +1 moreWordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability5.4 Medium
- miniorange wordpress rest api authentication, wordpress rest api authentication (wordpress plugin) +1 moreWordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability5.4 Medium
- hp fusion, support assistant +1 moreHP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses...7.8 High
- hp inc. certain hp pagewide pro printers, hp pagewide 352dw j6u57a firmware, pagewide 377dw j9v80a firmware +11 more +13 moreCertain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.7.5 High
- frroutingIn FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root...6.7 Medium
- miniorange google authenticator, miniorange's google authenticator (wordpress plugin) +1 moreWordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…