CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- floriangaerber magnesium-phpMagnesium-PHP Base.php formatEmailString injection3.5 Low
lcmsOSS-FuzzHeap-buffer-overflow in cmsMLUsetWideNo scorelibeccOSS-FuzzUse-of-uninitialized-value in fp_uninitNo score- debian linux, fedoraproject fedora, roundcube webmail +2 moreRoundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content...6.1 Medium
- sfu pkp web application libraryPKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal...5.3 Medium
- redmineRedmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails.6.1 Medium
- redmineRedmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter.6.1 Medium
- redmineRedmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter.6.1 Medium
libredwgOSS-FuzzStack-buffer-overflow in dynapi_set_helperNo score- rosenpassRemotely exploitable denial of service in Rosenpass5.3 Medium
- color demoiccmaxIn International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function ...6.5 Medium
- xxyopen novel-plusSQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary...9.8 Critical
- hillstone next generation firewall sg-6000-e3960, hillstonenet sc-6000-e3960 firmware +1 moreCross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5...6.1 Medium
- kaoshifeng yunfan learning examination systemAn issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5...5.3 Medium
- loytec linx-212 firmware, liob-586 firmware, lvis-3me12-a1 firmware +2 moreLOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3...7.5 High
- loytec linx-212 firmware, liob-586 firmware, lvis-3me12-a1 firmware +2 moreLOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3...8.2 High
- loytec linx-212 firmware, liob-586 firmware, lvis-3me12-a1 +1 more +3 moreLOYTEC LINX-212 firmware 6.2.4 and LVIS-3ME12-A1 firmware 6.2.2 and LIOB-586 firmware 6.2.3...7.5 High
- kerawenkerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart...9.8 Critical
- demonisblack demon image annotationWordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL Injection7.6 High
- nucleus genius quasar form free – contact form builder for wordpress, quasar-form quasar form +1 moreWordPress Quasar form Plugin <= 6.0 is vulnerable to SQL Injection8.5 High
- themesgrove onepage builderWordPress Onepage Builder – Easiest Landing Page Builder For WordPress Plugin <= 2.4.1 is vulnerable to SQL Injection6.7 Medium
- it path solutions pvt ltd contact form to any apiWordPress Contact Form to Any API Plugin <= 1.1.2 is vulnerable to SQL Injection7.6 High
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreWordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL Injection8.3 High
- ibm robotic process automation, robotic process automation for cloud pak +1 moreIBM Robotic Process Automation information disclosure6.5 Medium
ezsystems/ezplatform-kernelPackagistIbexa ezplatform-kernel download route allows filename changeNo scoreibexa/corePackagistIbexa DXP Download route allows filename changeNo scoreezsystems/ezplatform-solr-search-enginePackagistJson response for search reveals Solr credentialsNo scoreibexa/solrPackagistJson response for search reveals Solr credentialsNo score- clickbar dot-diverPrototype Pollution vulnerability in @clickbar/dot-diver7.3 High
- strapiUnauthorized Access to Private Fields in User Registration API in strapi7.6 High
ezsystems/ezpublish-kernelPackagistDownload route allows filename change in eZpublish kernelNo score- ivanti avalancheIvanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability7.8 High
- ivanti avalancheIvanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation...7.8 High
- ivanti automationA locally authenticated attacker with low privileges can bypass authentication due to insecure...8.8 High
- ivanti avalancheIvanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation...7.8 High
- ivanti avalancheIvanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation...7.8 High
- kubernetes csi-proxy, csi proxy +1 moreKubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation8.8 High
- favethemes houzez, houzez - real estate wordpress theme +1 moreWordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL Injection9.9 Critical
- adrian tobey groundhoggWordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL Injection7.6 High
- themeum tutor lmsWordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection8.2 High
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud4.3 Medium
- qnap music stationMusic Station7.5 High
- qnap media streaming add-on, multimedia console, qts +2 moreQTS, Multimedia Console, and Media Streaming add-on9.0 Critical
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud9.8 Critical
- themeum tutor lmsWordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection8.1 High
- themeum tutor lmsWordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection7.1 High
- cagewebdev order your posts manually, rolfvangelder order your posts monthly +1 moreWordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to SQL Injection7.6 High
- highfivery zero spam for wordpressWordPress Zero Spam Plugin <= 5.4.4 is vulnerable to SQL Injection7.6 High
- gopi ramasamy email posts to subscribersWordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL Injection8.2 High
- qemu, red hat enterprise linux 6, enterprise linux 7 +4 more +6 moreQemu: improper ide controller reset can lead to mbr overwrite6.4 Medium
- Show moreLoading…