CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- mattermostLog Flooding due to specially crafted requests in different endpoints4.3 Medium
- mattermostHTML injection via channel autocomplete3.1 Low
- mattermostDenial of Service via specially crafted block fields in Mattermost Boards4.3 Medium
- mattermostDenial of Service via Board Import Zip Bomb4.3 Medium
- mattermostUsers full name disclosure through Mattermost Boards with Show Full Name Option disabled4.3 Medium
- mattermostUsername and Icon override can be used by members when Hardened Mode is enabled4.3 Medium
- naver whale browserThe Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser...5.5 Medium
- md yeasin ul haider url shortener, url shortener project shortener +1 moreSourceCodester URL Shortener Long URL cross site scripting3.5 Low
- razormist loan management systemSourceCodester Loan Management System Users Page deleteUser.php delete_user sql injection4.7 Medium
- razormist loan management systemSourceCodester Loan Management System Loan Type Page delete_ltype.php delete_ltype sql injection4.7 Medium
- razormist loan management systemSourceCodester Loan Management System deleteBorrower.php delete_borrower sql injection4.7 Medium
- moses-smt mosesdecodermoses-smt mosesdecoder trans_result.php os command injection5.5 Medium
- four-faith video surveillance management systemXiamen Four-Faith Video Surveillance Management System Apache Struts unrestricted upload6.3 Medium
- jeecg jimureportjeecgboot JimuReport image path traversal6.3 Medium
- mayurik free and open source inventory management systemSourceCodester Free and Open Source Inventory Management System member_data.php sql injection6.3 Medium
- mayurik free and open source inventory management systemSourceCodester Free and Open Source Inventory Management System suppliar_data.php sql injection6.3 Medium
- tecno 4g portable wifi tr118, tecno-mobile tr118 firmware +1 moreTecno 4G Portable WiFi TR118 Ping Tool goform_get_cmd_process os command injection7.2 High
- cskaza cszcmsCSZCMS Site Settings Page cross site scripting2.4 Low
- cskaza cszcmsCSZCMS File Manager Page templates permission4.7 Medium
- phpseclibPhpseclib needs guardrails on large binaryfield integers7.5 High
- tenda ax1803 firmwareTenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function...7.5 High
- tenda ax1803 firmwareStack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute...9.8 Critical
- tenda ax1803 firmwareStack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute...9.8 Critical
- tenda ax1803 firmwareBuffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute...9.8 Critical
- tenda ax1803 firmwareHeap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute...9.8 Critical
- tenda ax1803 firmwareAn issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the...9.8 Critical
- 32ns kliveSQL Injection vulnerability in32ns KLive v.2019-1-19 and before allows a remote attacker to...7.5 High
- smpn1smg absisCross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote...6.1 Medium
- absisCross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote...5.4 Medium
- store-opart op\'art devisSQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote...9.8 Critical
- acer sk-9662 firmwareAn issue discovered in Acer Wireless Keyboard SK-9662 allows attacker in physical proximity to...6.1 Medium
- pachnoA vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute...5.4 Medium
- owncast project owncastOwnCast remote code execution vulnerability9.8 Critical
- blmodules csv feeds proIn the module "CSV Feeds PRO" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can...5.3 Medium
- myprestamodules updateproductsIn the module "Product Catalog (CSV, Excel) Export/Update" (updateproducts) < 3.8.5 from...9.8 Critical
- busyboxA heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159.5.5 Medium
- busyboxA use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in...5.5 Medium
- busyboxA use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service...5.5 Medium
- busyboxA use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in...5.5 Medium
- sapplica sentrifugoIn Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated...8.8 High
- mayuri k best courier management systemSourceCodester Best Courier Management System GET Parameter parcel_list.php cross site scripting3.5 Low
- mayuri k best courier management systemSourceCodester Best Courier Management System cross site scripting3.5 Low
- apryse itextApryse iText Reference Table PdfDocument.java memory leak4.3 Medium
- apryse itextApryse iText PdfDocument.java main array index4.3 Medium
- phpgurukul nipah virus testing management systemPHPGurukul Nipah Virus Testing Management System Search Report Page patient-search-report.php cross site scripting4.3 Medium
- oscommerceosCommerce Instant Message compare cross site scripting4.3 Medium
apache-commons-langOSS-FuzzSecurity exception in jaz.Zer.reportFindingNo scorepython-requestbuilderDebianpython-requestbuilder - security updateNo scorereportbugDebianreportbug - security updateNo score- f-secure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow a Denial of Service because there is an unpack handler crash...7.5 High
- Show moreLoading…