Archive
22 August 2019
Vulnerabilities first published on this day (UTC), newest first.
111 results · Feed
-
Medium 5.9
Invalid Curve Attack in openpgp
A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback about whether decryption of these messages succeeded to conduct an invalid curve attack in order to gain the victim's ECDH private key.
-
High 7.5
Improper Key Verification in openpgp
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as signed.
-
High 7.5CVE-2019-9153 Public exploit
Message Signature Bypass in openpgp
Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature.
-
Unscored —
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.e…
-
Unscored —
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common…
-
Unscored —
Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, …
-
Unscored —
Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allo…
-
Unscored —
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated ad…
-
Unscored —
osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter,…
-
Medium 6.5
Hickory Smart Lock Cleartext Password
A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith Products, LLC. Captured data reveals that the Hickory Smart Ethernet Bridge device communicates over the network to an MQTT broker without…
-
Medium 6.5
Hickory Smart Lock Insecure Logging on Android
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) f…
-
Medium 6.5
Hickory Smart Lock Insecure Storage on Android
An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. …
-
Medium 6.5
Hickory Smart Lock Insecure Storage on iOS
An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwith Products, LLC. The application's database was found to contain information that could be used to control the lock devices remotely. This…
-
Unscored —
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
-
Unscored —
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
-
Unscored —
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via A…
-
Unscored —
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.
-
Unscored —
The ad-inserter plugin before 2.4.20 for WordPress has path traversal.
-
Unscored —
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
-
Unscored —
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
-
Unscored —CVE-2018-20985 Scanner template
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pa…
-
Unscored —
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or us…
-
Unscored —
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
-
Unscored —
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
-
Unscored —
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.
-
Unscored —
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.
-
Unscored —
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.
-
Unscored —
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
-
Unscored —
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
-
Unscored —
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
-
Unscored —
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
-
Unscored —
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
-
Unscored —
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
-
Unscored —
The tubepress plugin before 1.6.5 for WordPress has XSS.
-
Unscored —
The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
-
Unscored —
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
-
Unscored —
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
-
Unscored —
The ebook-download plugin before 1.2 for WordPress has directory traversal.
-
Unscored —
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
-
Unscored —
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.