Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Medium 4.3
MWG Proxy: Cross-Frame Scripting vulnerability
Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.
-
High 8.1
Improper Verification of Cryptographic Signature in keycloak
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attac…
-
Medium 4.6
Improper Input Validation and Cross-Site Request Forgery in Keycloak
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
-
Unscored —CVE-2019-15053 Public exploit
The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=fa…
-
Unscored —
A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4…
-
Unscored —
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
-
Unscored —
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export acti…
-
Unscored —
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
-
Unscored —
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
-
Unscored —
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
-
Unscored —
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
-
Unscored —
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
-
Unscored —
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
-
Unscored —
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
-
Unscored —
The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.
-
Unscored —
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
-
Unscored —
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
-
Unscored —
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
-
Unscored —
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
-
Unscored —
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
-
Unscored —
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
-
Unscored —
The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.
-
Unscored —
The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
-
Unscored —
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
-
Unscored —
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBi…
-
Unscored —
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4Rt…
-
Unscored —
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4…
-
Unscored —
An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4…
-
Unscored —
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
-
Unscored —
SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRN…
-
Unscored —CVE-2015-9312 Scanner template
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
-
Unscored —
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
-
Unscored —
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
-
Unscored —
Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Succe…
-
Unscored —
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
-
Unscored —
Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Ove…
-
Unscored —
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
-
Unscored —
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.