CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: rce due to lfi risk in some misconfigured shared hosting environments6.5 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: insufficient capability checks when updating the parent of a course category3.3 Low
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: cache poisoning risk with endpoint revision numbers3.3 Low
- moodle, fedoraproject fedora, redhat enterprise linux +2 moreMoodle: xss risk when previewing data in course upload tool3.3 Low
- moodle, fedoraproject fedora, redhat enterprise linux +2 moreMoodle: stored xss in quiz grading report via user id number4.3 Medium
- moodle h5p, moodle, fedoraproject extra packages for enterprise linux +1 more +3 moreMoodle: auto-populated h5p author name causes a potential information leak3.3 Low
- moodle, fedoraproject fedora, redhat enterprise linux +2 moreMoodle: stored xss and potential idor risk in wiki comments6.5 Medium
- malinky ajax pagination and infinite scroll, malinky-ajax-pagination +1 moreWordPress Ajax Pagination and Infinite Scroll Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- sakura internet inc. ts webfonts for さくらのレンタルサーバ, sakura ts webfonts for sakura +1 moreWordPress TS Webfonts for さくらのレンタルサーバ Plugin <= 3.1.2 is vulnerable to Broken Access Control6.5 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: students can view other users in "only see own membership" groups3.3 Low
- alex raven wp report postWordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- moodleMoodle: xss risk when using csv grade import method3.3 Low
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: authenticated remote code execution risk in imscp4.7 Medium
- kenth hagström wp-cache.com, kenthhagstrom wp-cachecom +1 moreWordPress WP-Cache.com Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- moodle, fedoraproject extra packages for enterprise linux, fedora +2 moreMoodle: authenticated remote code execution risk in lesson4.7 Medium
- adrian tobey groundhoggWordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- christian kramer & hendrik thole wp-cirrusWordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- peter shaw lh password changer, shawfactor lh-password-changer +1 moreWordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 lock.php sql injection5.5 Medium
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection6.3 Medium
- didier sampaolo spamreferrerblockWordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- asyncssh project asyncsshAsyncSSH Rogue Session Attack6.8 Medium
- asyncssh project asyncsshAsyncSSH Rogue Extension Negotiation5.9 Medium
- webberzone top 10 – wordpress popular posts by webberzone, top 10 +1 moreWordPress Top 10 Plugin <= 3.3.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- auto publish for google my business project publish for google my business, martin gibson auto publish for google my business +1 moreWordPress WP Google My Business Auto Publish Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- mat bao corp wp helper premiumWordPress WP Helper Premium Plugin <= 4.5.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- wpclever wpc smart wishlist for woocommerceWordPress WPC Smart Wishlist for WooCommerce Plugin <= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- joomsky js job managerWordPress JS Job Manager Plugin <=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- wp inventory manager, wp inventory manager inventory manager, wpinventory wp inventory manager +2 moreWordPress WP Inventory Manager Plugin <= 2.1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- etsy shop project shop, frédéric sheedy etsy shop +1 moreWordPress Etsy Shop Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- telit cinterion ehs5, telit bgs5 firmware, ehs5 firmware +10 more +12 moreA CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion...8.1 High
software.amazon.cryptography:aws-database-encryption-sdk-dynamodbMavenSigning DynamoDB Sets when using the AWS Database Encryption SDK.No score- idoweb simple site verifyWordPress Simple Site Verify Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)4.3 Medium
- alex benfica publish to schedule, publish to schedule project to schedule +1 moreWordPress Publish to Schedule Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- xwiki application-collaboraThe same file cannot be opened with different rights7.4 High
- prestashop blockreassurance, customer reassurance block +1 moreAny value can be changed in the configuration table by an employee having access to block reassurance module9.1 Critical
- linux kernel, fedora, red hat enterprise linux 6 +3 more +5 moreKernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnect5.5 Medium
- appsanywhere clientSymmetric encryption used to protect messages between the AppsAnywhere server and client can be...8.0 High
- solarwinds network configuration managerSolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability8.0 High
- solarwinds network configuration managerSolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability8.0 High
- appsanywhere clientThe AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands...7.5 High
- humansignal label studio, label-studio +1 moreLabel Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens9.8 Critical
- apereo cas, central authentication service +1 moreMFA bypass in Apereo CAS9.8 Critical
libheifOSS-FuzzUNKNOWN READ in HeifPixelImage::overlayNo score- telit cinterion bgs5, ehs5, els61 +17 more +19 moreA CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists...3.3 Low
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection6.3 Medium
- telit cinterion bgs5, ehs5, els61 +17 more +19 moreA CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in...2.4 Low
- telit cinterion bgs5, ehs5, els61 +17 more +19 moreA CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit...6.8 Medium
- eclipse ide, org.eclipse.core.runtime, pde +1 more +3 moreXXE in eclipse.platform / Eclipse IDE5.0 Medium
- apache pyarrowPyArrow, PyArrow: Arbitrary code execution when loading a malicious data file9.8 Critical
- Show moreLoading…