CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- spwebguy responsive pricing tableResponsive Pricing Table < 5.1.8 - Admin+ Stored Cross-Site Scriping4.8 Medium
- shamimsplugins front end pmFront End PM < 11.4.3 - Sensitive Data Exposure via Directory Listing6.5 Medium
- awesomesupport awesome supportAwesome Support < 6.1.5 - Insufficient permission check in wpas_edit_reply4.3 Medium
- unknown user registrationUser Registration < 3.0.4.2 - Admin+ Stored XSS4.8 Medium
- click5 history log by click5, click5interactive sitemap by click5 +1 moreHistory Log by click5 < 1.0.13 - Admin+ Time-Based Blind SQL Injection7.2 High
- awesomesupport awesome supportAwesome Support < 6.1.5 - Reflected Cross-Site Scripting6.1 Medium
- templatelyTemplately < 2.2.6 - Arbitrary post trashing via Missing Authorization7.5 High
- proofpoint enterprise protectionHTML injection in AdminUI through email subject6.1 Medium
- red lion crimsonRed Lion Crimson Improper Neutralization of Null Byte or NUL Character8.8 High
- weintek easybuilder proWeintek EasyBuilder Pro Use of Hard-coded Credentials9.8 Critical
- xwiki, xwiki xwiki-platform +1 moreRemote code execution through the section parameter in Administration as guest in XWiki Platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreReflected Cross-site scripting through revision parameter in content menu in XWiki Platform9.7 Critical
- clastix capsule, capsule-proxy +1 moreService accounts can see namespaces of other tenants in capsule-proxy4.3 Medium
- mybbVisual editor persistent Cross-site Scripting (XSS) in MyBB7.5 High
- exiv2Out-of-bounds write in exiv28.8 High
- gitlabMissing Authorization in GitLab3.5 Low
- squid-cache squidSQUID-2021:8 Denial of Service in Gopher gateway7.5 High
- opensc project opensc, fedoraproject fedora, red hat enterprise linux 7 +3 more +5 moreOpensc: out-of-bounds read in myeid driver handling encryption using symmetric keys4.5 Medium
- mattermostDenial of Service via Link Preview in /api/v4/redirect_location5.3 Medium
- openssl, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +7 more +9 moreExcessive time spent in DH check / generation with large Q parameter value5.3 Medium
- mattermostPassword hash in response body after username update4.9 Medium
- mattermostDenial of Service via crashing the Calls Plugin4.3 Medium
- calico typha, tigera calico, calico enterprise +2 more +4 moreCalico Typha hangs during unclean TLS handshake7.5 High
- rapid7 velociraptorRapid7 Velociraptor Reflected XSS8.6 High
wasmedgeOSS-FuzzSegv on unknown address in FunctionCompiler::compileReturnNo score- red hat 3scale api management platform 2, redhat 3scale api management +1 more3scale-admin-portal: logged out users tokens can be accessed5.5 Medium
- 1e platform1E-Exchange-DisplayMessage instruction allows for arbitrary code execution9.9 Critical
- 1e platform1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution9.9 Critical
- gitlabAllocation of Resources Without Limits or Throttling in GitLab3.1 Low
- 1e platform1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution9.9 Critical
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab8.5 High
- gitlabInefficient Regular Expression Complexity in GitLab4.3 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab4.3 Medium
tiny-servercrates.io`tiny-server` was removed from crates.io for malicious codeNo scorelittestcrates.io`littest` was removed from crates.io for malicious codeNo score- kadence wp woocommerce email designer, kadencewp kadence woocommerce email designer +1 moreWordPress Kadence WooCommerce Email Designer Plugin <= 1.5.11 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- themekraft tk google fonts gdpr compliantWordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- roland murg current menu item for custom post typesWordPress Current Menu Item for Custom Post Types Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- alterWordPress Alter Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- easyrecipeWordPress EasyRecipe Plugin <= 3.5.3251 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- thefreewindows auto limit posts reloadedWordPress Auto Limit Posts Reloaded Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- custom login page | temporary users | rebrand login | login captcha, featherplugins custom login page \| temporary users \| rebrand login \| login captcha +1 moreWordPress Feather Login Page Plugin <= 1.1.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- josie auto excerpt everywhereWordPress Auto Excerpt everywhere Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- djo original texts yandex webmasterWordPress Original texts Yandex WebMaster Plugin <= 1.18 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- gvectors wpdiscuz, gvectors team comments — wpdiscuz +1 moreWordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)7.1 High
- gitlabLoop with Unreachable Exit Condition ('Infinite Loop') in GitLab6.5 Medium
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab3.7 Low
- netskope, netskope client +1 moreLocal privilege escalation6.6 Medium
- proper fraction llc. admin bar & dashboard access control, properfraction admin bar \& dashboard access control +1 moreWordPress Admin Bar & Dashboard Access Control Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- nazmul hossain nihal login screen managerWordPress Login Screen Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- Show moreLoading…