CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- xwiki admin tools, xwiki-contrib application-admintools +1 moreXWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery9.1 Critical
- nearform fast-jwtfast-jwt JWT Algorithm Confusion5.9 Medium
- wireapp wire-avs, wire audio\, video\, and signaling +1 morewire-avs remote format string vulnerability7.3 High
- strapi protected populate, strapi-community strapi-plugin-protected-populate +1 moreStrapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable5.3 Medium
- inea me rtu, me rtu firmware +1 moreINEA ME RTU Missing Authentication for Critical Function9.8 Critical
- inea me rtu, me rtu firmware +1 moreOS Command Injection in INEA ME RTU9.9 Critical
- microsoft powershell, powershell 7.2, powershell 7.3 +1 more +3 morePowerShell Information Disclosure Vulnerability6.5 Medium
u-bootMageiaFix u-boot reading file would overwrite reserved memory errorNo score- audio merchant merchant, myaudiomerchant audio merchant +1 moreAudio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting5.4 Medium
- audio merchant merchant, myaudiomerchant audio merchant +1 moreAudio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload8.8 High
- revolution slider slider revolutionWordPress Slider Revolution Plugin <= 6.6.14 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
libredwgOSS-FuzzHeap-use-after-free in dxf_tables_readNo scorewiresharkOSS-FuzzGlobal-buffer-overflow in dissect_zcl_read_attr_structNo score- zyxel secuextender ssl vpn client, secuextender ssl vpn +1 moreThe out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software...7.8 High
tauri-winrt-notificationscrates.io`tauri-winrt-notifications` was removed from crates.io for malicious codeNo scoretauri-win-rt-notificationcrates.io`tauri-win-rt-notification` was removed from crates.io for malicious codeNo score- openatom openharmonyArkruntime has a buffer overflow vulnerability4.0 Medium
- openatom openharmonyCert manager has a use of uninitialized resource vulnerability6.2 Medium
- openatom openharmonyLiteos-A has a incorrect default permissions vulnerability6.2 Medium
- openatom openharmonyArkruntime has a type confusion vulnerability5.9 Medium
- openatom openharmonyArkruntime has a type confusion vulnerability6.2 Medium
- openatom openharmonyHiview has an improper preservation of permissions vulnerability8.4 High
- openatom openharmonyLiteos-A has a incorrect default permissions vulnerability7.3 High
- apache derbyApache Derby: LDAP injection vulnerability in authenticator9.8 Critical
- apache submarineApache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization9.8 Critical
- wago compact controller 100 (751-9301), compact controller 100 firmware, edge controller (752-8303/8000-002) +12 more +14 moreWAGO: Improper Privilege Management in web-based management5.3 Medium
- luxsoft luxcal web calendarCross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and...6.1 Medium
- luxsoft luxcal web calendarSQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web...9.8 Critical
- totolink a3700r firmwareAn issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary...7.8 High
- mizhexiaoxiao websiteguideAn Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated...9.8 Critical
- tenda ax1803 firmwareTenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the...7.5 High
- tenda ax1803 firmwareTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the...7.5 High
- tenda ax1803 firmwareTenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the...7.5 High
- gpacGPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes...7.1 High
- carglglz upydevupydev has weak encryption padding7.5 High
- gpacGPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string...5.5 Medium
- paulrouget dzslidesCross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after...6.1 Medium
- spaceapplications yacmsAn issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via...6.1 Medium
- withsecure client security, elements endpoint protection, email and server security +1 more +3 moreCertain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client...7.8 High
- publiccmsDeserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute...9.8 Critical
- spaceapplications yacmsCross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote...5.4 Medium
- spaceapplications yacmsCross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote...5.4 Medium
- strongswanstrongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution...9.8 Critical
- os4ed opensisOpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection...8.8 High
- os4ed opensisAn Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of...7.5 High
- os4ed opensisA reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of...6.1 Medium
- os4ed opensisA reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of...6.1 Medium
- os4ed opensisA reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of...6.1 Medium
- Show moreLoading…