CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- gara amazonifyAmazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update4.3 Medium
- redhat quay, red hat quay 3 +1 moreQuay: clickjacking on config-editor page severity6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreCode execution via the edit action in XWiki platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in XWiki Platform9.7 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation in Xwiki platform9.1 Critical
- perforce puppet enterprise, puppet enterprise +1 moreBroken Session Management in Puppet Enterprise6.8 Medium
- squidexCross-Site Scripting (XSS) via postMessage Handler in Squidex6.8 Medium
- squidexRemote code execution in Squidex9.1 Critical
- gpac, gpac gpac/gpac +1 moreOut-of-bounds Read in gpac/gpac4.0 Medium
- intermesh group-office, groupoffice, group-office group office +2 moreServer-Side Request Forgery in groupoffice7.4 High
- simonpedge slide anything – responsive content / html slider and carousel, slide anything-responsive content\/html slider and carousel +1 moreWordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)5.4 Medium
- sigstore cosignPossible endless data attack from attacker-controlled registry in cosign3.1 Low
- crudlab jazz popupsWordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSS5.4 Medium
- wpexperts email templates customizer and designer, wpexpertsio email templates customizer and designer for wordpress and woocommerce +1 moreWordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- squidexStored Cross-site Scripting in Squidex5.4 Medium
- wpwax directorist, directorist – wordpress business directory plugin with classified ads listings +1 moreWordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection5.1 Medium
- kaushik kalathiya export users data csv, kaushikkalathiya export users data +1 moreWordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection7.6 High
- kigurumi csv exporter, nakashima masahiro wp csv exporter +1 moreWordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection5.8 Medium
- shambix simple csv/xls exporter, simple csv\/xls exporter +1 moreWordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection5.8 Medium
- patrick robrecht posts and users statsWordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection5.8 Medium
- solwin infotech user blockerWordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection5.9 Medium
- coffee2code commenter emailsWordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection4.7 Medium
- webtoffee wordpress comments import & export, wordpress comments import and export +1 moreWordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection6.1 Medium
- anmari amr usersWordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection5.8 Medium
- icegram express – email marketing, newsletters and automation for wordpress & woocommerce, express +1 moreWordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection6.1 Medium
- jackmail, jackmail & sarbacane emails & newsletters with jackmail +1 moreWordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection5.8 Medium
- narola infotech solutions llp export users data distinctWordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection5.8 Medium
- noptin, noptin newsletter simple newsletter plugin – noptin +1 moreWordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection6.1 Medium
- reviewx – multi-criteria rating & reviews for woocommerce, wpdeveloper reviewx, reviewx – multi-criteria rating & reviews for woocommerce +2 moreWordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection6.1 Medium
- ge micom s1 agileUncontrolled Search Path Element in GE MiCOM S1 Agile5.3 Medium
- geminilabs site reviewsWordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection6.1 Medium
- webtoffee product reviews import export for woocommerceWordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection6.1 Medium
- bestwebsoft post to csv by bestwebsoft, post to csv +1 moreWordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection4.7 Medium
- muneeb form builder | create responsive contact forms, web-settler form builder +1 moreWordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV Injection4.7 Medium
- wpeka wp cookie consent, wpeka-club wp cookie consent ( for gdpr, ccpa & eprivacy ) +1 moreWordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection4.0 Medium
- 8blocks 1003 mortgage applicationWordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection6.1 Medium
- arm mali gpu kernel driver, valhall gpu kernel driver, arm ltd 5th gen gpu architecture kernel driver +2 moreMali GPU Kernel Driver allows improper GPU memory processing operations7.8 High
- givewpWordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection4.7 Medium
- arm valhall gpu kernel driverMali GPU Kernel Driver exposes sensitive data from freed memory7.8 High
- arm mali gpu kernel driver, bifrost gpu kernel driver, midgard gpu kernel driver +2 more +4 moreMali GPU Kernel Driver exposes sensitive data from freed memory5.5 Medium
- opendesign drawings sdk, open design alliance oda drawings sdk - all versions < 2024.10 +1 moreAn issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value...7.8 High
- progress ws ftp serverWS_FTP Server Arbitrary File Upload9.1 Critical
- kb support support, kbsupport kb support +1 moreWordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV Injection8.8 High
- ayecode userswpWordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection5.8 Medium
- pär thernström simple history – user activity log, audit tool, simple-history simple history +1 moreWordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV Injection3.0 Low
libredwgOSS-FuzzStack-buffer-overflow in dxf_header_readNo score- mongodb atlas kubernetes operatorSecret logging may occur in debug mode of Atlas Operator4.5 Medium
- brewlabs sendpress newsletters, pressified sendpress +1 moreSendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- illia simple like page, topdevs simple like page plugin – fast & privacy-friendly page embeds +1 moreSimple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- dspreen qr code tagQR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- Show moreLoading…