CVEs published in November 2022
3,183 vulnerabilities, 267 critical, 13 exploited.
- perfsonarperfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is...4.3 Medium
- perfsonarAn issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access...8.6 High
- zkteco biotimeZkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave,...6.8 Medium
- zkteco biotimeZkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign,...6.2 Medium
- zkteco biotimeIn Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and...5.4 Medium
- canonical snapd, ubuntu linux +1 moresnapd Race Condition vulnerability7.8 High
- snyk cli, language server, security +2 moreCode Injection5.8 Medium
- checkpoint ssl network extenderThe IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network...7.5 High
- snyk cli, cocoapods cli, docker cli +5 more +7 moreCommand Injection5.0 Medium
- sapido br270n, brc76n, gr297 +5 more +7 moreSapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection6.3 Medium
- seppmailSEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads...6.1 Medium
- solarwinds platform, orion platform +1 moreSolarWinds Platform Deserialization of Untrusted Data8.8 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Command Injection7.2 High
- solarwinds platform, orion platform +1 moreSolarWinds Platform Improper Input Validation8.8 High
- deanoakley photospace gallery, photospace gallery project gallery +1 morePhotospace Gallery <= 2.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- standalonetech terawallet, subratamal wallet for woocommerce +1 moreTeraWallet – For WooCommerce <= 1.4.3 - Insecure Direct Object Reference4.3 Medium
- tipsandtricks-hq wp affiliate platformWP Affiliate Platform <= 6.3.9 - Cross-Site Request Forgery8.8 High
- tipsandtricks-hq wp affiliate platformWP Affiliate Platform <= 6.3.9 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5 Medium
- tipsandtricks-hq wp affiliate platformWP Affiliate Platform <= 6.3.9 - Reflected Cross-Site Scripting6.1 Medium
- muffingroup becustomBecustom <= 1.0.5.2 - Cross-Site Request Forgery8.8 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Remote Code Execution via Multi-Select7.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options7.2 High
- ultimatemember ultimate member, ultimate member – user profile, registration, login, member directory, content restriction & membership plugin +1 moreUltimate Member – User Profile, User Registration, Login & Membership Plugin <= 2.5.0 - Authenticated (Contributor+) Directory Traversal via Shortcodes4.3 Medium
- dwbooster appointment hour booking, codepeople appointment hour booking – booking calendar +1 moreAppointment Hour Booking <= 1.3.72 - CAPTCHA Bypass5.3 Medium
- dwbooster appointment hour booking, codepeople appointment hour booking – booking calendar +1 moreAppointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form7.2 High
- dwbooster appointment hour booking, codepeople appointment hour booking – booking calendar +1 moreAppointment Hour Booking <= 1.3.72 - CSV Injection5.8 Medium
- expresstech quiz and survey master, quiz and survey master (qsm) – easy quiz and survey maker +1 moreQuiz and Survey Master <= 8.0.4 - Improper Input Validation5.3 Medium
- expresstech quiz and survey master, quiz and survey master (qsm) – easy quiz and survey maker +1 moreQuiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short Answer7.2 High
- simple-press simple\, simplepress simple:press forum +1 moreSimple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification3.8 Low
- simple-press simple\, simplepress simple:press forum +1 moreSimple:Press <= 6.8 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion8.1 High
- simple-press simple\, simplepress simple:press forum +1 moreSimple:Press <= 6.8 - Reflected Cross-Site Scripting via Cookie Value4.7 Medium
- simple-press simple\, simplepress simple:press forum +1 moreSimple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures6.4 Medium
- simple-press simple\, simplepress simple:press forum +1 moreSimple:Press <= 6.8 - Unauthenticated Stored Cross-Site Scripting via Forum Replies7.2 High
shadowUbuntushadow regressionNo score- samtools htsjdkCreation of Temporary File in Directory with Insecure Permissions7.3 High
- static-dev-server project static-dev-serverDirectory Traversal7.5 High
supportutilsSUSESecurity update for supportutilsNo scoresupportutilsopenSUSESecurity update for supportutilsNo score- team johnlong software co., ltd. maild mail server, raidenmaild +1 moreTEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Cross-Site Scripting5.4 Medium
- team johnlong software co., ltd. maild mail server, raidenmaild +1 moreTEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Formula Injection8.0 High
- realtek rtl8111ep-cg, rtl8111fp-cg, rtl8111ep-cg firmware +1 more +3 moreRealtek RTL8111EP-CG/RTL8111FP-CG - Use of Hard-coded Credentials2.1 Low
- realtek rtl8111fp-cg, rtl8111fp-cg firmware +1 moreRealtek RTL8111FP-CG - Missing Authorization6.5 Medium
- airtable, airtable airtable.js +1 moreAirtable.js credentials exposed in browser builds7.6 High
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function8.2 High
- discourseDiscourse may allow exposure of hidden tags in the subject of notification emails4.3 Medium
- discourseDiscourse allows self-XSS through malicious composer message7.1 High
- prometheus exporter toolkit, exporter-toolkit +1 morePrometheus Exporter Toolkit vulnerable to basic authentication bypass6.2 Medium
- gpacGPAC v2.1-DEV-rev478-g696e6f868-master was discovered to contain a heap use-after-free via the...7.8 High
- aerocms project aerocmsAeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter....7.5 High
- chocolatey phpInsecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the...4.3 Medium
- Show moreLoading…