CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- lenovo lecloud, lecloud application +1 moreLenovo LeCloud App improper input validation allows attackers to access arbitrary components and...7.5 High
- lenovo thinkpad, thinkpad bios, thinkpad l13 gen 2 firmware +19 more +21 moreA vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker...6.7 Medium
- lenovo ideapad duet 3-10igl5, ideapad duet 3 10igl5, ideapad duet 3 10igl5 firmware +2 moreA buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5...6.7 Medium
- lenovo view driverA potential use-after-free vulnerability was reported in the Lenovo View driver that could...5.5 Medium
- lenovo 1lenovo preload directory, preload directory +1 moreA privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using...7.3 High
- lenovo system updateAn uncontrolled search path vulnerability was reported in Lenovo System Update that could allow...7.8 High
- bleachbitDLL Search Order Hijacking vulnerability in BleachBit for Windows7.3 High
- okta ldap agentThe LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could...6.7 Medium
- spotfire analyst, for aws marketplace, server +4 more +6 moreTIBCO Spotfire Insufficiently Protected Credential vulnerability5.0 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to...8.8 High
github.com/slsa-framework/slsa-verifierGo,github.com/slsa-framework/slsa-verifier/v2Go +1 moreslsa-verifier vulnerable to mproper validation of npm's publish attestationsNo score- bainternet shortcodes uiWordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- vyas dipen top 25 social iconsWordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- muneeb layer sliderWordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- umarbajwa social feed | all social media in one place, web-settler social feed \| all social media in one place +1 moreWordPress Social Feed | All social media in one place Plugin <= 1.5.4.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- i thirteen web solution post sliders & post grids, i13websolution post sliders \& post grids +1 moreWordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- wp map plugins basic interactive world mapWordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- apollo13themes apollo13 framework extensionsWordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- martin gibson ideapushWordPress IdeaPush Plugin <= 8.52 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- prestashop blockreassurance, customer reassurance block +1 morePrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block5.5 Medium
- zitadelZITADEL race condition in lockout policy execution7.3 High
- ethyca fidesEthyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages4.3 Medium
- palo alto networks cortex xsoarCortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine6.4 Medium
- microfocus fortify scancentral dastA potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API.8.2 High
- avast avg antivirus, avast/avg antivirus +1 moreTime-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation.8.2 High
- cloudnet360WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)7.1 High
- sahu tiktok pixel for e-commerce, sahumedia sahu tiktok pixel for e-commerce +1 moreWordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- d. relton medialistWordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- ashish ajani wordpress simple html sitemapWordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)7.1 High
- helgatheviking simple user listingWordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- helix core, perforce helix core +1 moreUnauthenticated Remote Denial-of-Service via Buffer in Helix Core7.5 High
- helix core, perforce helix core +1 moreUnauthenticated Remote Denial-of-Service (Commit) in Helix Core7.5 High
- helix core, perforce helix core +1 moreArbitrary Code Execution in Helix Core9.0 Critical
- thm pilosPILOS account takeover through password reset poisoning8.8 High
drupal/graphqlPackagistThe GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates (create, update, delete) through mutations. The module does not sufficiently valid…No score- flowfact, flowfact wp connector +1 moreWordPress FLOWFACT WP Connector Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)7.1 High
- helix core, perforce helix core, helix swarm +2 moreUnauthenticated Remote Denial-of-Service via Shutdown Function in Helix Core7.5 High
drupal/graphqlPackagistThis module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's lab…No score- ovh the-bastionGroup-based JIT MFA bypass on scp and sftp in The Bastion4.8 Medium
- ni topografix dataplugin for gpx, diadem, flexlogger +2 more +4 moreIncorrect Permission Assignment in the TopoGrafix DataPlugin for GPX5.5 Medium
- enej bajgoric / gagan sandhu / ctlt dev user avatarWordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)7.1 High
- add-to-calendar-button add to calendar buttonWordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
s2n-quiccrates.ios2n-quic potential denial of service via crafted stream framesNo scoreopenscOSS-FuzzHeap-buffer-overflow in iasecc_parse_aclsNo scorelcmsOSS-FuzzUNKNOWN READ in cmsIT8GetDataRowColDblNo score- lanaccess onsafe monitorhmIncorrect input data validation in Lanaccess ONSAFE MonitorHM Web Console8.3 High
- huawei emui, harmonyos +1 morePermission control vulnerability in the call module. Successful exploitation of this...7.5 High
- huawei emui, harmonyos +1 moreThe multi-screen interaction module has a vulnerability in permission management. Successful...7.5 High
- huawei harmonyosKeep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this...7.5 High
- huawei emui, harmonyos +1 morePermission control vulnerability in the window management module. Successful exploitation of this...5.3 Medium
- Show moreLoading…