CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- amit agarwal google xml sitemap for imagesWordPress Google XML Sitemap for Images Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- stranger studios force first and last name as display name, strangerstudios force display name +1 moreWordPress Force First and Last Name as Display Name Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- leo caseiro custom options plusWordPress Custom Options Plus Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- mythemeshop wp shortcode by mythemeshop, wp shortcode +1 moreWordPress WP Shortcode by MyThemeShop Plugin <= 1.4.16 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- contrid slideshow gallery lite, tribulant slideshow gallery +1 moreWordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- jetmonsters hotel booking liteWordPress Hotel Booking Lite Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- infolific enhanced plugin adminWordPress Enhanced Plugin Admin Plugin <= 1.16 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- wbcom designs – buddypress activity social share, wbcomdesigns buddypress activity social share +1 moreWordPress Wbcom Designs – BuddyPress Activity Social Share Plugin <= 3.5.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- harish chouhan, themeist i recommend thisWordPress I Recommend This Plugin <= 3.9.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- robin phillips mobile bannerWordPress Mobile Banner Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- roxnor wp ultimate reviewWordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- jjlemstra whydonate – free donate button – crowdfunding – fundraising, whydonate – free donate button – crowdfunding – fundraising, wp whydonate +2 moreWordPress Whydonate – FREE Donate button Plugin <= 3.12.15 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- plainware shiftcontroller, shiftcontroller employee shift scheduling +1 moreWordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
github.com/consensys/gnarkGognark's range checker gadget allows wider inputs up to word alignment3.2 Low- apache airflowApache Airflow: Permission verification bypass allows viewing dagruns of other dags6.5 Medium
- apache airflowApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)4.3 Medium
matioOSS-FuzzHeap-buffer-overflow in H5MM_strdupNo score- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection6.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM cross-site scripting4.6 Medium
apache-poiOSS-FuzzSecurity exception in org.apache.poi.hssf.record.crypto.Biff8DecryptingStream.isNeverEncryptedRecordNo scorefluent-bitOSS-FuzzSegv on unknown address in flb_sds_cat_safeNo score- byzoro smart s85f management platform, smart s85f firmware +1 moreByzoro Smart S85F Management Platform login.php password recovery4.3 Medium
- openvpn, debian linux, fedoraproject fedora +2 more +4 moreUse after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory...9.8 Critical
- openvpn, debian linux, fedoraproject fedora +2 more +4 moreUsing the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows...7.5 High
- juanfont headscaleHeadscale writes bearer tokens to info-level logs7.5 High
- johnson controls quantum hd unity acuair, quantum hd unity compressor, quantum hd unity condenser/vessel +9 more +11 moreQuantum HD Unity10.0 Critical
- sigstore gitsignGitsign's Rekor public keys fetched from upstream API instead of local TUF client.4.2 Medium
- microsoft edge (chromium-based), edge chromium, edge (chromium-based) extended stable +2 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability7.1 High
- statamic cms, statamic +1 moreStatamic CMS remote code execution via front-end form uploads8.4 High
- opentelemetry, open-telemetry opentelemetry-go-contrib +1 moreDoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics7.5 High
- piccolo-orm piccolopiccolo SQL Injection via named transaction savepoints9.1 Critical
- sensiolabs symfonySymfony potential Cross-site Scripting in WebhookController6.1 Medium
- sensiolabs symfony, debian linux, symfony twig-bridge +2 moreSymfony potential Cross-site Scripting vulnerabilities in CodeExtension filters6.1 Medium
- sensiolabs symfonySymfony possible session fixation vulnerability6.5 Medium
- free software foundation grub-legacy, gnu grub, xen +2 moreMemory Corruption Vulnerability in Grub-Legacy's XFS Implementation8.1 High
- telit cinterion bgs5, telit bgs5 firmware, ehs5 firmware +42 more +44 moreA CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit...7.8 High
- qnap qumagieQuMagie7.4 High
- qnap qumagieQuMagie7.4 High
- qnap qumagieQuMagie8.8 High
- telit cinterion bgs5, telit bgs5 firmware, ehs5 firmware +42 more +44 moreA CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in...3.3 Low
- phpgurukul restaurant table booking systemPHPGurukul Restaurant Table Booking System Reservation Status booking-details.php information disclosure5.3 Medium
- discourseDiscourse SSRF vulnerability in Embedding3.4 Low
- discourseDiscourse DoS through Onebox favicon URL7.5 High
- discourseHTML injection in oneboxed links5.3 Medium
- phpgurukul restaurant table booking systemPHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scripting3.5 Low
- discourseBypassing height value allowed in some theme components4.3 Medium
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud4.7 Medium
- discourseUnread bookmark reminder notifications that the user cannot access can be seen3.3 Low
- discourseDiscourse vulnerable to DoS via Regexp Injection in Full Name4.3 Medium
- phpgurukul restaurant table booking systemPHPGurukul Restaurant Table Booking System Booking Reservation check-status.php sql injection6.3 Medium
- Show moreLoading…