Archive
20 August 2019
Vulnerabilities first published on this day (UTC), newest first.
197 results · Feed
-
Medium 4.3
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Anal…
-
High 7.6
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQ…
-
Medium 4.3
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Anal…
-
High 8.4
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.…
-
High 7.1
IBM InfoSphere Global Name Management 5.0 and 6.0 and IBM InfoSphere Identity Insight 8.1 and 9.0 is vulnerable to an X…
-
High 7.5
IBM Security Guardium Big Data Intelligence 4.0 (SonarG) uses an inadequate account lockout setting that could allow a …
-
Medium 4.3
IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute …
-
Medium 6.2
IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive inf…
-
High 8.6
IBM API Connect 2018.1 through 2018.4.1.6 developer portal could allow an unauthorized user to cause a denial of servic…
-
Medium 4.3
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Anal…
-
Medium 5.7
IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow a user to obtain highly sensitive informa…
-
Medium 6.2
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill…
-
High 7.1
IBM Intelligent Operations Center V5.1.0 through V5.2.0 is vulnerable to an XML External Entity Injection (XXE) attack …
-
High 7.6
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQ…
-
Medium 4.3
IBM API Connect 5.0.0.0 through 5.0.8.6 developer portal could allow a remote attacker to traverse directories on the s…
-
Medium 6.8
Metasys use of hardcoded RC2 key
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).
-
Medium 6.8
Metasys use of shared RSA key pairs
Metasys® ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
-
High 7.5
assign-deep Vulnerable to Prototype Pollution
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
-
Unscored —
In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scann…
-
Unscored —CVE-2019-3967 EPSS 29%
In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authe…
-
Unscored —
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This c…
-
Unscored —
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This …
-
Unscored —CVE-2019-3964 EPSS 53%
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could…
-
Unscored —CVE-2019-3963 EPSS 53%
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This c…
-
High 8.8
TIBCO FTL Escalation Of Privileges for Realm Configuration
The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO F…
-
Unscored —
An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Onl…
-
Unscored —
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
-
Unscored —CVE-2017-18532 Scanner template
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
-
Unscored —
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
-
Unscored —CVE-2017-18530 Scanner template
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
-
Unscored —CVE-2017-18529 Scanner template
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
-
Unscored —CVE-2017-18528 Scanner template
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
-
Unscored —
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
-
Unscored —CVE-2017-18527 Scanner template
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
-
Unscored —
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
-
Unscored —
The moreads-se plugin before 1.4.7 for WordPress has XSS.
-
Unscored —
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
-
Unscored —
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
-
Unscored —
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
-
Unscored —
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.