CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- first co., ltd. cfr-4eab, cfr-8eab, cfr-16eab, c-first cfr-1004ea firmware, cfr-1008ea firmware +36 more +38 moreMissing authentication for critical function vulnerability in First Corporation's DVRs allows a...9.8 Critical
- elecom co.,ltd. wrc-x3000gs2-b, wrc-x3000gs2-w, wrc-x3000gs2a-b +3 more +5 moreOS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and...8.0 High
- elecom lan-w300n\/p firmware, lan-w300n\/rs firmware, lan-w301nr firmware +65 more +67 moreInadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and...6.5 Medium
- linecorp linenagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an...7.5 High
- code-projects simple crud functionalitySQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run...9.8 Critical
- bandoche pypinksignPyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption7.5 High
- superagiSuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This...7.5 High
- localstackMissing SSL certificate validation in localstack7.4 High
- archerydms archeryArchery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES...7.5 High
- httpieHTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack7.4 High
- struktur libde265Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a...6.5 Medium
- ffmpegBuffer Overflow vulnerability in Ffmpeg before github commit...7.8 High
- autelrobotics evo nano drone firmwareInsecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows...6.5 Medium
- withsecure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products have a buffer over-read whereby processing certain fuzz file types...7.5 High
- withsecure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow a Denial of Service (DoS) in the antivirus engine when scanning...7.5 High
- free5gcFree5gc allows a local attacker to cause a denial of service via the free5gc-compose component5.5 Medium
- redislabs redisgraphAn issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial...9.8 Critical
- dedecmsCross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management...8.8 High
- lmxcmsSQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the...9.8 Critical
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery5.4 Medium
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- webtechstreet elementor addon elements, wpvibes addon elements for elementor (formerly elementor addon elements) +1 moreElementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery5.4 Medium
- manageengine access manager plus, asset explorer, service desk plus +39 more +41 moreManageEngine Information Disclosure in Multiple Products5.5 Medium
- ethyca fidesCryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides8.2 High
- sandisk security installer for windows, westerndigital sandisk security installer +1 moreMultiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows7.3 High
- payara, payara platform server, micro and embedded +1 morePayara Platform: URL Redirection to untrusted site using FORM authentication6.1 Medium
- palantir video-application-server, com.palantir.video:video-application-server +1 moreGotham Video Broken Authentication2.7 Low
pocketmine/raklibPackagistpocketmine/raklib reliable-ordered queue size is unlimited, allowing a session to hog server memory5.3 Medium- aveva application server, batch management, communication drivers pack +19 more +21 moreAVEVA Operations Control Logger External Control of File Name or Path5.5 Medium
- aveva application server, batch management, communication drivers pack +19 more +21 moreAVEVA Operations Control Logger Execution with Unnecessary Privileges7.8 High
- pimcoreSQL Injection in Admin Grid Filter API in Pimcore8.8 High
- pimcore admin-ui-classic-bundle, admin classic bundle +1 moreFull Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle5.3 Medium
drupal/molliePackagistThis module enables you to pay online via Mollie. The module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacke…No score- eclipse openj9Eclipse OpenJ9 possible infinite busy hang4.1 Medium
- quarkusQuarkus: build env information disclosure via gradle plugin7.7 High
lcmsOSS-FuzzHeap-buffer-overflow in WriteCLUTNo scoreopenscOSS-FuzzInvalid-free in sc_file_clear_acl_entriesNo score- combust mleapUsing MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.7.5 High
- prasunsen namaste! lms, kibokolabs namaste\! lms +1 moreNamaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scripting6.1 Medium
winx-rscrates.io`winx-rs` was removed from crates.io for malicious codeNo scorelibusb1-maincrates.io`libusb1-main` was removed from crates.io for malicious codeNo scorewindows-service-rscrates.io`windows-service-rs` was removed from crates.io for malicious codeNo scorewin_run_rscrates.io`win_run_rs` was removed from crates.io for malicious codeNo scoreregistry-wincrates.io`registry-win` was removed from crates.io for malicious codeNo scoreacceptxmr-rscrates.io`acceptxmr-rs` was removed from crates.io for malicious codeNo scorewin-base64-rscrates.io`win-base64-rs` was removed from crates.io for malicious codeNo scoremonero-rpc-rscrates.io`monero-rpc-rs` was removed from crates.io for malicious codeNo scoremonero-apicrates.io`monero-api` was removed from crates.io for malicious codeNo scorewin-cryptocrates.io`win-crypto` was removed from crates.io for malicious codeNo score- Show moreLoading…