CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- radare radare2radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a...7.5 High
- remyandrade sticky notes appA Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP...6.5 Medium
- videolan vlc media playerA binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on...7.8 High
- myprestamodules cross selling in modal cartIn the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for...9.8 Critical
- chronopostIn the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL...9.8 Critical
- struktur libde265Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and...8.1 High
- statamic cms, statamic +1 moreStatamic CMS vulnerable to Cross-site Scripting via uploaded assets7.5 High
- nautobot nautobot-plugin-device-onboardingClear Text Credentials Exposed via Onboarding Task5.7 Medium
- nextcloud mail, kiteworks security-advisories +1 moreNextcloud Mail app vulnerable to Server-Side Request Forgery3.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF5.0 Medium
- pyloadDownload to arbitrary folder can lead to RCE8.8 High
- fastbotsfastbots Eval Injection vulnerability8.4 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server user_ldap app logs user passwords in the log file on level debug4.2 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server admins can change authentication details of user configured external storage2.4 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V3.5 Low
- digital communications technologies syrus4 iot telematics gateway, digitalcomtech syrus 4g iot telematics gateway firmware +1 moreData leakage and arbitrary remote code execution in Syrus cloud devices10.0 Critical
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name3.5 Low
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server users can make external storage mount points inaccessible for other users8.5 High
- capnprotoCap'n Proto WebSocket message can cause crash5.9 Medium
- goauthentik authentikOAuth2: PKCE can be fully circumvented7.5 High
- linux kernel, fedora, red hat enterprise linux 6 +3 more +5 moreKernel: nvme: memory corruption via unprivileged user passthrough6.7 Medium
- openreplayOpenReplay HTML Injection vulnerability6.5 Medium
- salesagility suitecrm, suitecrm-core +1 moreSuiteCRM has Unauthenticated Graphql Introspection Enabled3.1 Low
- cisco appdynamicsA vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an...6.3 Medium
- cisco identity services engine, identity services engine software +1 moreA vulnerability in the web-based management interface of Cisco Identity Services Engine could...6.7 Medium
- cisco identity services engine software, identity services engine +1 moreA vulnerability in the web-based management interface of Cisco ISE could allow an authenticated,...4.8 Medium
- cisco ip phones with multiplatform firmware, session initiation protocol (sip) software, ip dect 110 firmware +3 more +5 moreA vulnerability in the web-based management interface of a small subset of Cisco IP Phones could...5.5 Medium
- siemens jt2go, teamcenter visualization +1 moreSiemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory Buffer7.8 High
- zephyrproject zephyrL2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()8.3 High
- atlassian crowd, crowd data center, crowd server +2 moreThis High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of...8.0 High
- atlassian bamboo, bamboo data center, bamboo server +2 moreThis High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8...8.5 High
zlibTuxCare,minizip-compatTuxCare,minizip-compat-develTuxCare +2 more +4 moreUpdate of zlibNo score- amazon freertos, texas instruments cc32xx, simplelink msp432e4xx +8 more +10 moreTexas Instruments FREERTOS Integer Overflow or Wraparound7.4 High
- texas instruments cc32xx, simplelink msp432e4xx, simplelink-cc13xx +8 more +10 moreTexas Instruments TI-RTOS Integer Overflow or Wraparound7.4 High
container-suseconnectSUSESecurity update for container-suseconnectNo scoregithub.com/go-jose/go-jose/v3Go,github.com/square/go-joseGo +1 moreDecryption of malicious PBES2 JWE objects can consume unbounded system resourcesNo scorehibagentUbuntuhibagent updateNo score- mozilla firefoxMemory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory...8.8 High
- mozilla firefox for ios, firefox mobile +1 moreAn attacker could have performed HTML template injection via Reader Mode and exfiltrated user...6.1 Medium
- mozilla firefox for ios, firefox mobile +1 moreAn attacker could have accessed internal pages or data by ex-filtrating a security key from...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bugs present in Firefox 119, Firefox 115.4, and Thunderbird 115.4. Some of these...8.8 High
- mozilla firefoxIf an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS...6.5 Medium
- mozilla firefoxWhen an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreRelative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../"...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen using X11, text selected by the page using the Selection API was erroneously copied into the...8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreOwnership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects...8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIt was possible to cause the use of a MessagePort after it had already been freed, which could...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreOn some systems—depending on the graphics settings and drivers—it was possible to force an out-of...6.5 Medium
- Show moreLoading…