CVEs published in November 2023
2,587 vulnerabilities, 293 critical, 11 exploited.
- pt trijaya digital grup tripay payment gateway, tripay payment gateway +1 moreWordPress TriPay Payment Gateway Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- codehooligans simply excludeWordPress Simply Exclude Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS)5.8 Medium
- sophos email applianceA reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to...4.7 Medium
- apache dolphinschedulerApache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for6.5 Medium
- apache cocoonApache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction9.8 Critical
- asr falcon, asrmicro asr1803 firmware, asr1806 firmware +2 moreOut-of-bounds access a buffer in SIM management7.2 High
- mailcow mailcow-dockerized, mailcow\ +1 moremailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation8.3 High
- asr falcon, asrmicro asr1803 firmware, asr1806 firmware +2 moreBuffer Copy Without Checking size of input in IMS6.7 Medium
- nexryai nexkeynexkey allows arbitrary users to impersonate any remote user due to missing signature validation8.6 High
- asr falcon, asrmicro asr1803 firmware, asr1806 firmware +2 moreOut-of-bounds access a buffer in IMS6.7 Medium
- pimcore customer-data-framework, pimcore +1 morePimcore missing token/header to prevent CSRF4.3 Medium
- getsentry symbolicatorSymbolicator Server Side Request Forgery vulnerability4.3 Medium
- mitsubishi electric melsoft iq appportal, motion control setting, mitsubishi electric corporation gx works3 +1 more +3 moreMalicious Code Execution Vulnerability due to External Control of File Name or Path in multiple...7.8 High
- bowo debug log manager, qriouslad debug log manager – conveniently monitor and inspect errors +1 moreDebug Log Manager <= 2.2.0 - Cross-Site Request Forgery4.3 Medium
- zyxel nas326 firmware, nas542 firmware +1 moreThe improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware...9.8 Critical
- zyxel nas326 firmware, nas542 firmware +1 moreA command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21...9.8 Critical
- zyxel nas326 firmware, nas542 firmware +1 moreA post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326...8.8 High
- zyxel nas326 firmware, nas542 firmware +1 moreThe improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware...8.8 High
- zyxel nas326 firmware, nas542 firmware +1 moreA command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel...9.8 Critical
- zyxel nas326 firmware, nas542 firmware +1 moreAn improper authentication vulnerability in the authentication module of the Zyxel NAS326...7.5 High
- nec itk-12d-1\(bk\)tel firmware, itk-12d-1p\(bk\)tel firmware, itk-12dg-1p\(bk\)tel firmware +41 more +43 moreAn OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions...9.8 Critical
- microweberMicroweber file upload vulnerability8.8 High
- tenda i6 firmwareTenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/WifiMacFilterSet.7.5 High
- tenda i6 firmwareTenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget.7.5 High
- iteachyou dreamer cmsDreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the...8.8 High
- iteachyou dreamer cmsDreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the...8.8 High
- iteachyou dreamer cmsDreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the...8.8 High
- huaxiaerp jsherpIncorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive...6.5 Medium
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- totolink x6000r firmwareIn TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields...9.8 Critical
- gl-inet gl-ax1800 firmwareInsecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote...8.8 High
- gl-inet gl-ax1800 firmwareInsecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote...9.8 Critical
- netease cloudmusicAn Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local...7.8 High
- sohu video playerAn Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain...7.8 High
- notepad-plus-plus notepad\+\+An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated...7.8 High
- zoneland o2oaRemote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to...9.8 Critical
- szlbt lbt-t300-t310 firmwareBuffer Overflow vulnerability in /apply.cgi in Shenzhen Libituo Technology Co., Ltd LBT-T300-T310...7.5 High
- oretnom23 packers and movers management systemSQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote...7.2 High
- loytec linx-151 firmware, linx-212 firmware +1 moreLOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 Firmware 7.2.4 are vulnerable to...7.5 High
- loytec linx-151 firmware, linx-212 firmware +1 moreLOYTEC electronics GmbH LINX-212 6.2.4 and LINX-151 7.2.4 are vulnerable to Insecure Permissions...7.5 High
- loytec linx-151 firmware, linx-212 firmware +1 moreLOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to...7.5 High
- loytec linx-151 firmware, linx-212 firmware +1 moreLOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to...7.5 High
- Show moreLoading…