CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- misp-project mispAn issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses.9.8 Critical
- misp-project mispAn issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php...9.8 Critical
- concretecms concrete cmsConcrete CMS Cross-site Scripting vulnerability3.5 Low
- concretecms concrete cmsConcrete CMS allows unauthorized access because directories can be created with insecure permissions9.8 Critical
- terra-mater terra-masterDirectory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker...7.5 High
- opensupportsOpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the...9.8 Critical
- corebosCorebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject...8.0 High
- kodcloud kodboxkodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the...9.8 Critical
- howerj liblispLiblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in...8.1 High
- howerj liblispLiblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void...6.5 Medium
- git-urls project git-urlsInefficient Regular Expression Complexity in git-urls7.5 High
- myprestamodules exportproductsIn the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5...9.8 Critical
- common-services sonice retour, sonice retour common services for prestashop +1 moreIn the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for...7.5 High
- limesurveyCross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a...5.4 Medium
- gstreamerGStreamer MXF File Parsing Use-After-Free Remote Code Execution Vulnerability8.8 High
- gstreamerGStreamer AV1 Codec Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability8.8 High
- crushftpCrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically...9.8 Critical
- openndsAn issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple...7.5 High
- openndsAn issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in...9.8 Critical
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. It allows users to skip...5.3 Medium
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL...7.5 High
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a...7.5 High
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape...9.8 Critical
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a...7.5 High
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer...6.5 Medium
- opennds captive portalAn issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer...7.5 High
- bell home hub 3000 firmwareAn issue was discovered on Bell HomeHub 3000 SG48222070 devices. There is XSS related to the...6.1 Medium
- bell home hub 3000 firmwareAn issue was discovered on Bell HomeHub 3000 SG48222070 devices. Remote authenticated users can...4.3 Medium
- vim, fedoraproject fedora +1 moreUse-After-Free in win_close() in vim3.9 Low
- vim, fedoraproject fedora +1 moreFloating point Exception in adjust_plines_for_skipcol() in vim3.9 Low
- vim, fedoraproject fedora +1 moreoverflow with count for :s command in vim2.8 Low
- vim, fedoraproject fedora +1 moreoverflow in nv_z_get_count in vim2.8 Low
- vim, fedoraproject fedora +1 moreoverflow in ex address parsing in vim2.8 Low
- vim, fedoraproject fedora +1 moreoverflow in get_number in vim2.8 Low
- vim, fedoraproject fedora +1 moreoverflow in shift_line in vim2.8 Low
- bob arigato autoresponder and newsletterWordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.2.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- vjinfotech woo custom and sequential order numberWordPress Woo Custom and Sequential Order Number Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- alexufo youtube speedloadWordPress Youtube SpeedLoad Plugin <= 0.6.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- zulip, zulip server +1 moreStream description leaks to ex-subscribers in Zulip4.3 Medium
- opennms horizon, meridian +1 moreCross-site scripting in bootstrap.jsp5.8 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreMLflow Authentication Bypass9.1 Critical
- ray project ray, ray-project ray-project/ray +1 moreRay Static File Local File Include7.5 High
- pagerduty rundeckAuthenticated users can view or delete jobs they do not have authorization for in Rundeck8.1 High
- splunk, splunk enterprise, cloud +1 more +3 moreCross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page4.8 Medium
- splunk, splunk enterprise, cloud +2 moreRemote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing8.0 High
- pagerduty rundeckAuthenticated users can view job names and groups they do not have authorization to view in Rundeck4.3 Medium
- mingocommerce woocommerce product enquiryWordPress WooCommerce Product Enquiry Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS)7.1 High
- dazzlersoft team members showcaseWordPress Team Members Showcase Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- microsoft edge (chromium-based), edge chromium, edge (chromium-based) extended stable +2 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability6.6 Medium
- microsoft edge (chromium-based), edge chromium, edge (chromium-based) extended stable +2 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.3 Medium
- Show moreLoading…