CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
lasso-rscrates.io`lasso-rs` was removed from crates.io for malicious codeNo scorelfest-maincrates.io`lfest-main` was removed from crates.io for malicious codeNo score- checkmkDoS via long hostnames2.7 Low
- broadcom reactor netty, reactor netty netty +1 moreIn Reactor Netty HTTP Server a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack7.5 High
ffmpegUbuntuffmpeg regressionNo score- elastic logstashLogstash Insertion of Sensitive Information into Log File8.4 High
- shareaholic, shareaholic professional social sharing buttons, icons & related posts – shareaholic +1 moreShareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload6.6 Medium
- fuji electric co., ltd. and hakko electronics co., ltd. v-server, v-server lite +1 moreMultiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V...7.8 High
- fuji electric co., ltd. and hakko electronics co., ltd. v-server, v-server lite +1 moreOut-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0...7.8 High
- fuji electric co., ltd. and hakko electronics co., ltd. v-server, v-server lite +1 moreOut-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0...7.8 High
- fuji electric co., ltd. and hakko electronics co., ltd. tellus simulator, fujielectric tellus +1 moreMultiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier. If a...7.8 High
- fuji electric tellus, fuji electric co., ltd. and hakko electronics co., ltd. tellus lite +1 moreAccess of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS...7.8 High
- fuji electric tellus, fuji electric co., ltd. and hakko electronics co., ltd. tellus lite +1 moreOut-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0...7.8 High
- fuji electric tellus, fuji electric co., ltd. and hakko electronics co., ltd. tellus lite +1 moreMultiple improper restriction of operations within the bounds of a memory buffer issues exist in...7.8 High
- schneider electric galaxy vl, galaxy vs, schneider-electric galaxy vl firmware +1 more +3 moreA CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')...5.3 Medium
- schneider electric ecostruxure power monitoring expert (pme), ecostruxure power operation (epo) – advanced reporting and dashboards module, ecostruxure power scada operation (pso) - advanced reporting and dashboards module +1 more +3 moreA CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)...6.1 Medium
- schneider electric ecostruxure power monitoring expert (pme), ecostruxure power operation (epo) – advanced reporting and dashboards module, ecostruxure power scada operation (pso) - advanced reporting and dashboards module +1 more +3 moreA CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an...8.2 High
- schneider electric ion8650, ion8800, schneider-electric ion8650 firmware +1 more +3 moreA CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that...4.8 Medium
- schneider electric ion8650, ion8800, schneider-electric ion8650 firmware +1 more +3 moreA CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow...7.2 High
- asustek computer inc. rt-ac87u, asus rt-ac87u firmware +1 moreAn improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or...9.1 Critical
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote...8.8 High
- qlik senseQlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code...9.6 Critical
- publiccmsAn issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via...6.5 Medium
- grocy project grocyCross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary...5.4 Medium
- grocy project grocyAn issue in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive...7.8 High
- grocy project grocyCross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary...5.4 Medium
- grocy project grocyCross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary...5.4 Medium
- xuxueli xxl-jobxxl-job-admin vulnerable to Remote Code Execution8.8 High
- xuxueli xxl-jobxxl-job-admin vulnerable to Cross Site Scripting5.4 Medium
- xuxueli xxl-jobxxl-job-admin vulnerable to Insecure Permissions5.4 Medium
- gpacGPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the...7.8 High
- gpacGPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the...7.8 High
- gpacGPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the...7.8 High
- phpgurukul pre-school enrollment systemPre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php...5.4 Medium
- phpgurukul pre-school enrollment systemPre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in...9.8 Critical
- opencartAn issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having...8.8 High
- free5gcBuffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via...7.5 High
- free5gcfree5gc Buffer Overflow vulnerability7.5 High
- nukium glsNukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via...5.4 Medium
- activedesign newsletterpop, prestashop newsletter popup pro +1 moreIn the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6...9.8 Critical
- gimpGIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability7.8 High
- gimpGIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability7.8 High
- gimpGIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- gimpGIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability7.8 High
- prestahero ybc blogETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the...9.8 Critical
- eyoucmsEyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via...6.1 Medium
- kloudq tor loco min, tor equip gateway, tor lenz +1 more +3 moreAn issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a...9.8 Critical
- myprestamodules orders \(csv\, excel\) export proMyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection...8.8 High
- Show moreLoading…