CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- opencrxCross-site Scripting in OpenCRX6.1 Medium
@vendure/corenpm@vendure/core's insecure currencyCode handling allows wrong payment amounts5.3 Mediumibis-frameworkPyPIIbis PyArrow dependency allows arbitrary code execution when loading a malicious data fileNo score- librenmsRate limiting Bypass on login page in libreNMS5.3 Medium
- joaquimserafim json-web-token, json web token +1 moreJWT Algorithm Confusion in json-web-token library7.5 High
- librenmsBroken Access control on Graphs Feature in LibreNMS4.3 Medium
- librenmsCross-site Scripting at Device groups Deletion feature in LibreNMS6.3 Medium
- get-simple getsimplecmsGetSimpleCMS theme-edit.php code injection4.7 Medium
- honeywell prowatchIncorrect Permission assignment to program executable folders7.8 High
- adobe coldfusionAdobe ColdFusion RCE Security Vulnerability9.8 Critical
- adobe coldfusionColdFusion | Improper Input Validation (CWE-20)4.3 Medium
- adobe coldfusionCVE-2023-38205 issues | ColdFusion Admin Panel Access7.5 High
- adobe coldfusionColdFusion WDDX Deserialization Gadgets9.8 Critical
- adobe coldfusionUnauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version6.1 Medium
- adobe coldfusionColdFusion | Deserialization of Untrusted Data (CWE-502)9.8 Critical
pcapplusplusOSS-FuzzStack-buffer-overflow in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<chNo scorerubyOSS-FuzzHeap-buffer-overflow in fill_linesNo score- adobe robohelp, robohelp server +1 moreZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure Vulnerability7.5 High
- adobe robohelp, robohelp server +1 moreZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure Vulnerability7.5 High
- adobe robohelp, robohelp server +1 moreZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability7.5 High
- adobe robohelp, robohelp server +1 moreZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure Vulnerability6.5 Medium
- adobe robohelp, robohelp server +1 moreZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution Vulnerability7.2 High
- adobe framemaker publishing serverZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability9.8 Critical
- adobe after effectsZDI-CAN-21702: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- adobe after effectsZDI-CAN-21790: Adobe After Effects MP4 File Uninitialized Variable Information Disclosure Vulnerability3.3 Low
- adobe after effectsZDI-CAN-21704: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability5.5 Medium
- adobe after effectsZDI-CAN-21705: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- adobe after effectsZDI-CAN-21708: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- adobe after effectsZDI-CAN-21709: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- adobe after effectsZDI-CAN-21703: Adobe After Effects M4A File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- adobe after effectsZDI-CAN-21706: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- mcafee epolicy orchestratorAn open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a...5.4 Medium
- mcafee epolicy orchestratorCSRF in ePO leading to privilege escalation8.0 High
- aweber, aweber – free sign up form and landing page builder plugin for lead generation and email newsletter growth +1 moreWordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access Control4.3 Medium
- adobe dimensionZDI-CAN-21866: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability5.5 Medium
- adobe animateZDI-CAN-21666: Adobe Animate FLA File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability5.5 Medium
- liferay portalLiferay Portal XSS with `p_l_back_url_title` on edit content page9.6 Critical
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x (expresscluster x) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- nec expresscluster x, expresscluster x singleserversafe, nec corporation clusterpro x singleserversafe (expresscluster x singleserversafe) +1 more +3 moreCLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X...8.8 High
- cubecartCubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege...7.2 High
- cubecartDirectory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated...4.9 Medium
- cubecartDirectory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated...6.5 Medium
- cubecartCross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote...8.1 High
- gnu gnutls, debian linux, fedoraproject fedora +12 more +14 moreGnutls: timing side-channel in the rsa-psk authentication5.9 Medium
- misp-project mispAn issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles...9.8 Critical
- misp-project mispAn issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam...9.8 Critical
- misp-project mispAn issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters.9.8 Critical
- Show moreLoading…