Skip to content
OpenAdvisories

Archive

22 August 2019

Vulnerabilities first published on this day (UTC), newest first.

← July 2019 2019 / August /22 September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

111 results · Feed

  • Unscored —
    CVE-2014-10393

    The cforms2 plugin before 10.5 for WordPress has XSS.

  • Unscored —
    CVE-2019-13139 Public exploit

    In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build"…

    docker.io Debian
  • Unscored —
    CVE-2015-9334

    The email-newsletter plugin through 20.15 for WordPress has SQL injection.

  • Unscored —
    CVE-2017-18578

    The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.

  • Unscored —
    CVE-2017-18579

    The corner-ad plugin before 1.0.8 for WordPress has XSS.

  • Unscored —
    CVE-2014-10382

    The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.

  • Unscored —
    CVE-2016-10928

    The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisio…

  • Unscored —
    CVE-2016-10929

    The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files…

  • Unscored —
    CVE-2018-20986

    The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by auth…

  • Unscored —
    CVE-2017-18585

    The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

  • Unscored —
    CVE-2013-7483

    The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.

  • Unscored —
    CVE-2019-15325

    In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/…

  • Unscored —
    CVE-2019-15326

    The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

  • Unscored —
    CVE-2019-15327

    The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.

  • Unscored —
    CVE-2019-15328

    The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.

  • Unscored —
    CVE-2019-15329

    The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

  • Unscored —
    CVE-2014-10386

    The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.

  • Unscored —
    CVE-2018-20987

    The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.

  • Unscored —
    CVE-2015-9338

    The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.

  • Unscored —
    CVE-2015-9339

    The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.

  • Unscored —
    CVE-2015-9340

    The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php…

  • Unscored —
    CVE-2015-9341

    The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.

  • Unscored —
    CVE-2019-15330

    The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.

  • Unscored —
    CVE-2019-15331

    The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.

  • Unscored —
    CVE-2016-10930

    The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via…

  • Unscored —
    CVE-2019-15060

    The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote cod…

  • Unscored —
    CVE-2014-10387

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.

  • Unscored —
    CVE-2014-10388

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.

  • Unscored —
    CVE-2014-10389

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.

  • Unscored —
    CVE-2014-10390

    The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.

  • Unscored —
    CVE-2014-10391

    The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.

  • Unscored —
    CVE-2018-20988

    The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.

  • Unscored —
    CVE-2014-10392

    The cforms2 plugin before 10.2 for WordPress has XSS.

  • Unscored —
    CVE-2017-18586

    The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

  • Unscored —
    CVE-2014-10394

    The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.

  • Unscored —
    CVE-2019-12386

    An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay "add instance" fun…

    ampache Ubuntu
  • Unscored —
    CVE-2019-12385

    An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to…

    ampache Ubuntu
  • Unscored —
    CVE-2019-14469

    In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.

  • High 7.2
    CVE-2019-7617

    Elastic APM agent for Python client CGI proxy redirection flaw

    When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choo…

    Elastic Elastic APM agent for Python elastic-apm PyPI
  • High 7.5
    CVE-2019-14751 Public exploit

    NLTK Vulnerable To Path Traversal

    NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

    nltk nltk nltk Debian Ubuntu PyPI