CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- chamilo, chamilo lms +1 moreChamilo LMS File Upload Functionality Remote Code Execution8.8 High
- chamilo, chamilo lms +1 moreChamilo LMS Learning Path PPT2LP Command Injection Vulnerability7.2 High
- chamilo, chamilo lms +1 moreChamilo LMS Learning Path PPT2LP Command Injection Vulnerability7.2 High
- chamilo, chamilo lms +1 moreChamilo LMS Unauthenticated Big Upload File Remote Code Execution8.1 High
- chamiloChamilo LMS Htaccess File Upload Security Bypass9.8 Critical
- chamiloChamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write9.8 Critical
- chamiloChamilo LMS Unauthenticated Command Injection9.8 Critical
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreWP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure4.3 Medium
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreWP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- reputeinfosystems bookingpress, appointment booking calendar plugin and scheduling plugin – bookingpress +1 moreBookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
- zyxel usg flex series firmware, vpn series firmware, zld +2 moreAn improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX...5.5 Medium
- zyxel atp series firmware, nwa50ax firmware, usg flex 50(w) series firmware +23 more +25 moreAn improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series...5.5 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +3 more +5 moreAn improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware...5.5 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +8 more +10 moreAn integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the...7.5 High
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +2 more +4 moreA buffer overflow vulnerability in the Zyxel ATP series firmware version 5.37, USG FLEX series...4.4 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +3 more +5 moreA buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG...5.5 Medium
- zyxel atp series firmware, nwa50ax firmware, usg flex 50(w) series firmware +23 more +25 moreAn improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series...5.5 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +3 more +5 moreA cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware...5.2 Medium
- zyxel atp series firmware, usg flex 50(w) series firmware, usg flex series firmware +3 more +5 moreAn improper input validation vulnerability in the “Quagga” package of the Zyxel ATP series...5.5 Medium
postgresql-multicornDebianpostgresql-multicorn - security updateNo score- asana desktopAsana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is...7.8 High
- horsicq xmachoviewerA dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By...9.8 Critical
- ureport project ureportureport arbitrary file read vulnerability7.5 High
- fit2cloud jumpserverInsecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to...9.8 Critical
- ezviz cs-c3n-a0-3h2wfrl firmware, cs-c6cn-a0-3h2wfr firmware, cs-c6n-a0-1c2wfr firmware +1 more +3 moreAn authentication bypass vulnerability in the Direct Connection Module in Ezviz CS-C6N-xxx prior...5.3 Medium
- communitydeveloper amazzing filterAmazzing Filter for Prestashop through 3.2.2 is vulnerable to Cross-Site Scripting (XSS).6.1 Medium
- anyscale rayAnyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this...9.1 Critical
- anyscale rayRay has arbitrary code execution via jobs submission API9.8 Critical
- jflyfox jfinal cmsAn issue in jflyfox jfinalCMS v.5.1.0 allows a remote attacker to execute arbitrary code via a...9.8 Critical
- gitkraken gitlensAn issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a...7.8 High
- haproxyHAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers...8.2 High
- netwrix usercubeNetwrix Usercube before 6.0.215, in certain misconfigured on-premises installations, allows...9.8 Critical
- bluetooth core specification, microsoft windows 10 1809, windows 10 21h2 +7 more +9 moreBluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth...6.8 Medium
- oroinc orocommerceOroCommerce get-totals-for-checkout API endpoint returns unwanted data5.8 Medium
- oroinc orocommerceOroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility5.0 Medium
- churchcrm crm, oroinc client relationship management +1 moreOroCRMCallBundle has incorrect call view page visibility5.0 Medium
- knative servingKnative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler6.5 Medium
- pimcore admin classic bundle, admin-ui-classic-bundle +1 morePimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls8.5 High
- aio-libs aiohttpaiohttp's ClientSession is vulnerable to CRLF injection via version7.2 High
- aio-libs aiohttpaiohttp's ClientSession is vulnerable to CRLF injection via method5.3 Medium
- aio-libs aiohttpAIOHTTP: HTTP request smuggling via WebSocket upgrade6.3 Medium
- apache nifiApache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt7.9 High
- franklin electric fueling systems colibri, franklinfueling colibri firmware +1 moreFranklin Electric Fueling Systems Colibri Path Traversal6.5 Medium
- oroinc oroplatform, churchcrm crm +1 moreOroCalendarBundle has incorrect system calendar events visibility5.0 Medium
- oroinc oroplatform, platform +1 moreOroPlatform vulnerable to path traversal during temporary file manipulations8.6 High
- github.com/go-resty/resty/v2, resty project resty +1 moreHTTP request body disclosure in github.com/go-resty/resty/v25.9 Medium
org.owasp.esapi:esapiMavenValidator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 yearNo scoreuptime-kumanpmUptime Kuma Authenticated remote code execution via TailscalePingNo score- arcserve udpArcserve UDP Agent Unauthenticated Path Traversal File Upload9.8 Critical
- arcserve udpArcserve UDP Management Authentication Bypass9.8 Critical
- Show moreLoading…