CVEs published in November 2022
3,183 vulnerabilities, 267 critical, 13 exploited.
- dinstar dag2000-16o firmwareDinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).5.4 Medium
- avs4you avs audio converterAVS Audio Converter 10.3 is vulnerable to Buffer Overflow.9.8 Critical
- apereo opencastOpencast Authenticated OpenRedirect Vulnerability5.7 Medium
- hummus project hummus, muhammara project muhammara, julianhille muhammarajs +2 moremuhammara vulnerable to Unchecked Return Value to NULL Pointer Dereference7.5 High
- discourseDiscourse users can see notifications for topics they no longer have access to3.5 Low
- discourseDiscourse chat messages should have a maximum character limit3.5 Low
- crewjam samlcrewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements9.1 Critical
- linux layer 2 tunneling protocol, fedoraproject fedora, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreA flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when...5.5 Medium
- linux kernelA NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when...5.5 Medium
- linux kernelA NULL pointer dereference issue was discovered in the Linux kernel in...5.5 Medium
- lepton project leptonA loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the...5.5 Medium
- decode-uri-component project decode-uri-componentdecode-uri-component vulnerable to Denial of Service (DoS)7.5 High
- microfocus netiq advanced authenticationThis update resolves a multi-factor authentication bypass attack6.3 Medium
- lahirudanushka school management systemSQL injection in School Management System 1.0 allows remote attackers to modify or delete data,...9.8 Critical
- msi centerAn issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to...8.8 High
- sz-fujia ourphotoThe /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication...7.5 High
- sz-fujia ourphotoThe user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not...6.5 Medium
- sz-fujia ourphotoThe /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password...7.5 High
- sz-fujia ourphotoThe user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from...7.5 High
- debian linux, linux kernel, fedoraproject fedora +5 more +7 moreAn issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth...7.8 High
- kubeview project kubeviewKubeView vulnerable to full cluster takeover due to improper authentication9.8 Critical
- linuxfoundation opendaylightA SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm...7.5 High
- linuxfoundation opendaylightA SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm...7.5 High
- linuxfoundation opendaylightA SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm...7.5 High
- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 moreAn issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core...7.0 High
- electronic shelf label protocol project shelf label protocolThe ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF...6.5 Medium
ghostscriptOSS-FuzzUNKNOWN READ in chunk_free_objectNo scoreharfbuzzOSS-FuzzHeap-buffer-overflow in OT::hb_ot_apply_context_t::skipping_iterator_t::nextNo scorelibredwgOSS-FuzzHeap-buffer-overflow in bit_calc_CRCNo score- drachtio drachtio-serverdrachtio-server 0.8.18 has a heap-based buffer over-read via a long Request-URI in an INVITE...9.1 Critical
- paddlepaddlePaddlePaddle vulnerable to code injection via winstr9.8 Critical
- linuxfoundation pytorchPyTorch vulnerable to arbitrary code execution9.8 Critical
- openjsf express, qs project qs, debian linux +2 moreqs vulnerable to Prototype Pollution7.5 High
- fortinet fortianalyzer, fortimanager +1 moreAn improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6...4.1 Medium
harfbuzzOSS-FuzzHeap-buffer-overflow in OT::hb_ot_apply_context_t::skipping_iterator_t::nextNo scoreghostscriptOSS-FuzzStack-buffer-overflow in cmap_put_rangesNo scoreapache-commons-imagingOSS-FuzzSecurity exception in java.desktop/java.awt.image.DataBufferInt.<init>No score- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 moreAn issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a...6.4 Medium
- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 moreAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec...4.7 Medium
- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 moreAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a...7.0 High
- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 moreAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c...7.0 High
- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 moreAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a...7.0 High
- prasathmani tiny file managerTiny File Manager version 2.4.8 allows an unauthenticated remote attacker to execute arbitrary...9.8 Critical
- prasathmani tiny file managerTiny File Manager version 2.4.8 allows an unauthenticated remote attacker to execute arbitrary...6.5 Medium
- book store management system project store management systemBook Store Management System v1.0 was discovered to contain a cross-site scripting (XSS)...6.1 Medium
- oretnom23 human resource management systemHuman Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS)...6.1 Medium
- jeecg bootJeecg-boot vulnerable to SQL Injection4.3 Medium
- jeecg bootJeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin4.3 Medium
- jeecg bootJeecg-boot vulnerable to SQL injection via updateNullByEmptyString9.8 Critical
- jeecg bootJeecg-boot vulnerable to SQL Injection9.8 Critical
- Show moreLoading…