Archive
21 August 2019
Vulnerabilities first published on this day (UTC), newest first.
115 results · Feed
-
High 8.8
Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnera…
-
High 8.8
Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnera…
-
High 7.2
Cisco Integrated Management Controller Buffer Overflow Vulnerability
A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on a…
-
Unscored —
The smokesignal plugin before 1.2.7 for WordPress has XSS.
-
Unscored —
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data i…
-
Unscored —
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
-
Unscored —
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
-
Unscored —
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
-
High 7.2
Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operati…
-
Medium 6.7
Cisco Remote PHY Device Software Command Injection Vulnerability
A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sa…
-
High 7.2
Cisco Integrated Management Controller Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. An attacker…
-
Unscored —
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.
-
Unscored —
The duplicate-post plugin before 2.6 for WordPress has XSS.
-
Unscored —
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
-
Unscored —
The embed-comment-images plugin before 0.6 for WordPress has XSS.
-
Unscored —CVE-2017-18562 Scanner template
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
-
High 8.8
Cisco IOS XE NGWC Legacy Wireless Device Manager GUI Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected …
-
Medium 4.8
Cisco Unified Contact Center Express Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interfac…
-
Medium 5.8
Cisco Firepower Threat Defense Software Information Disclosure Vulnerability
A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to insufficient applicati…
-
High 8.6
Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS…
-
Medium 6.8
Cisco HyperFlex Static SSL Key Vulnerability
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific en…
-
Medium 4.1
Cisco RoomOS Software Privilege Escalation Vulnerability
A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could e…
-
Medium 4.3
Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration Vulnerability
A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to t…
-
Unscored —
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
-
Unscored —
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
-
Unscored —
In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore req…
-
Unscored —
The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
-
Unscored —
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
-
Unscored —
The profile-builder plugin before 2.2.5 for WordPress has XSS.
-
Unscored —
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
-
Unscored —
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
-
Unscored —CVE-2017-18564 Scanner template
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
-
Unscored —
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
-
Unscored —
An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bit…
-
High 8.6
Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software
A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this co…
-
Critical 9.8
An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 libr…
-
Critical 9.8
An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words lib…
-
Critical 9.8
An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 librar…
-
Medium 4.4
Buffer overflow in DLP Endpoint for Windows
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated me…
-
Medium 4.4
Buffer overflow in DLP Endpoint for Windows
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results …