Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • High 8.8
    CVE-2019-10384

    Cross-Site Request Forgery in Jenkins

    Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Medium 6.5
    CVE-2019-10391

    Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields

    Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.

    Jenkins Project Jenkins IBM Application Security on Cloud Plugin com.hcl.security:ibm-application-security Web / CMS Maven
  • High 8.8
    CVE-2019-10390

    Jenkins Splunk Plugin Sandbox Bypass

    A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.

    Jenkins Project Jenkins Splunk Plugin com.splunk.splunkins:splunk-devops Web / CMS Maven
  • Medium 4.8
    CVE-2019-10383

    Improper Neutralization of Input During Web Page Generation in Jenkins

    A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Unscored —
    CVE-2015-9359

    The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2019-15716

    WTF before 0.19.0 does not set the permissions of config.yml, which might make it easier for local attackers to read pa…

  • Unscored —
    CVE-2015-9379

    iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9378

    iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9377

    iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9376

    iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9375

    Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query…

  • Unscored —
    CVE-2015-9374

    Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9373

    PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9372

    Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9371

    Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_ar…

  • Unscored —
    CVE-2015-9370

    Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9369

    Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query…

  • Unscored —
    CVE-2015-9368

    Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and …

  • Unscored —
    CVE-2015-9367

    Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove…

  • Unscored —
    CVE-2015-9366

    Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query…

  • Unscored —
    CVE-2015-9365

    Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9364

    2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9363

    iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9362

    The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9361

    The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9360

    The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2019-15713 Scanner template

    The my-calendar plugin before 3.1.10 for WordPress has XSS.

  • Unscored —
    CVE-2019-15714

    cli/lib/main.js in Entropic before 2019-06-13 does not reject / and \ in command names, which might allow a directory t…

  • Unscored —
    CVE-2015-9358

    The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().

  • Unscored —
    CVE-2015-9357 Public exploit

    The akismet plugin before 3.1.5 for WordPress has XSS.

  • Unscored —
    CVE-2015-9356

    The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue…

  • Unscored —
    CVE-2017-18593

    The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to …

  • Unscored —
    CVE-2015-9355

    The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.

  • Unscored —
    CVE-2012-6719

    The sharebar plugin before 1.2.2 for WordPress has SQL injection.

  • Unscored —
    CVE-2012-6718

    The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.

  • Unscored —
    CVE-2011-5329

    The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.

  • Unscored —
    CVE-2012-6717

    The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.

  • Unscored —
    CVE-2015-9354

    The gigpress plugin before 2.3.11 for WordPress has XSS.

  • Unscored —
    CVE-2015-9353

    The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE…

  • Unscored —
    CVE-2019-15294

    An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service ac…