Archive
August 2019
Vulnerabilities first published in this month (UTC), newest first.
2,007 results · Feed
-
Unscored —
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
-
Unscored —
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
-
Unscored —CVE-2018-20966 Public exploit
The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
-
Unscored —
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechani…
-
Unscored —
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable o…
-
Unscored —
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
-
Unscored —
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
-
Unscored —
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
-
Unscored —
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
-
Unscored —
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
-
Unscored —
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
-
Unscored —
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
-
Unscored —
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
-
Unscored —
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg(…
-
Unscored —CVE-2019-14950 Scanner template
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
-
Unscored —
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
-
Unscored —
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
-
Unscored —
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
-
Unscored —
The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates'…
-
Unscored —
In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent i…
-
Medium 5.5
MySQL for Node.js Unsafe Options
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
-
Unscored —
3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation dire…
-
Unscored —
An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value…
-
High 8.8
Bagisto CSRF Vulnerability
Bagisto 0.1.5 allows CSRF under /admin URIs.
-
Unscored —
An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileEx…
-
Unscored —
On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-…
-
Unscored —
On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each r…
-
Unscored —
On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of …
-
Unscored —
In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/s…
-
Unscored —
Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET s…
-
Unscored —CVE-2019-12260 EPSS 23%
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vul…
-
Unscored —
Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: D…
-
Unscored —
The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter…
-
Unscored —
The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript…
-
Critical 9.8
There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators a…
KEV Mar 7, 2022 -
Medium 4.8
heap-buffer-overflow on exif_scan_thumbnail in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…
-
Medium 4.8
heap-buffer-overflow on exif_process_user_comment in EXIF extension
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the alloc…
-
Medium 4.3
UAA SCIM Filter XSS
Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.
-
Unscored —
Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: T…
-
High 7.8
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-priv…