Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Unscored —
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
-
Unscored —
The js-jobs plugin before 1.0.7 for WordPress has CSRF.
-
Unscored —
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
-
Unscored —
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
-
Unscored —
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
-
Unscored —
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
-
Unscored —
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
-
Unscored —
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
-
Unscored —
Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulner…
-
Unscored —
Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Suc…
-
Unscored —
Creative Cloud Desktop Application versions 4.6.1 and earlier have a security bypass vulnerability. Successful exploita…
-
Unscored —
Creative Cloud Desktop Application 4.6.1 and earlier versions have an insecure transmission of sensitive data vulnerabi…
-
Unscored —CVE-2019-7964 EPSS 10%
Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability. Successful exploitation cou…
-
Unscored —CVE-2019-15120 Public exploit
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
-
Medium 5.5
cnlh nps vulnerable to file overwrite by local user
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
-
Unscored —
parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles a short descriptor, leading to…
-
Unscored —
check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack e…
-
Unscored —
The note-press plugin before 0.1.2 for WordPress has SQL injection.
-
Unscored —
The olimometer plugin before 2.57 for WordPress has SQL injection.
-
Unscored —
The visitors-online plugin before 0.4 for WordPress has SQL injection.
-
Unscored —
The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
-
Unscored —
EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
-
Unscored —
filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary fi…
-
Unscored —
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the…
-
Low 3.5
An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filen…
-
Unscored —
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (…
-
Unscored —CVE-2019-15104 Public exploit
An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/New…
-
Unscored —CVE-2019-15105 Public exploit
An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability i…
-
Unscored —
An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password require…
-
Critical 9.8
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulner…
KEV Mar 25, 2022 -
Unscored —
drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplet…
-
Unscored —
drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.2.8 has a NULL pointer dereference via an incomplet…
-
Unscored —
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.
-
Critical 9.8
Nokogiri Command Injection Vulnerability
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called wit…
-
Unscored —
An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of …
-
Unscored —CVE-2019-15084 Public exploit
Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, installs with incorrect file permissions. As a result,…
-
Unscored —
Insufficient URL encoding flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python …
-
Unscored —
LibreLogo global-event script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreL…
-
Unscored —
Insufficient url validation allowing LibreLogo script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-ins…
-
Unscored —CVE-2019-10081 EPSS 14%
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…