Skip to content
OpenAdvisories

Archive

20 September 2019

Vulnerabilities first published on this day (UTC), newest first.

← August 2019 2019 / September /20 October 2019 →
  1. 1 
  2. 21
  3. 336
  4. 437
  5. 559
  6. 655
  7. 7 
  8. 822
  9. 997
  10. 1057
  11. 11139
  12. 1242
  13. 1350
  14. 1411
  15. 158
  16. 1671
  17. 1772
  18. 1844
  19. 1918
  20. 2077
  21. 2117
  22. 226
  23. 2340
  24. 2430
  25. 25104
  26. 2668
  27. 27311
  28. 283
  29. 291
  30. 3064
All Critical High Medium Low Exploited only Public exploit

77 results · Feed

  • Unscored —
    CVE-2019-6145

    Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables lo…

    Forcepoint Forcepoint VPN Client for Windows Windows
  • Unscored —
    CVE-2019-6649

    F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 …

    F5 BIG-IP, Enterprise Manager Network devices
  • Unscored —
    CVE-2019-6650

    F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.…

    F5 BIG-IP ASM Network devices
  • Unscored —
    CVE-2014-10397

    The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/script…

  • Unscored —
    CVE-2014-10396

    The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/down…

  • Unscored —
    CVE-2015-9406 Public exploit Scanner template EPSS 59%

    Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrar…

  • High 7.5
    CVE-2019-15138

    Arbitrary File Read in html-pdf

    The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.

    html-pdf npm
  • High 8.8
    CVE-2019-11280

    Privilege escalation through the invitations service

    Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizatio…

    Pivotal Pivotal Application Service (PAS)
  • Medium 5.5
    CVE-2019-14814

    There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2019-14816

    There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Li…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2019-11327

    An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of th…

  • Unscored —
    CVE-2019-16645 Public exploit

    An issue was discovered in Embedthis GoAhead 2.5.0. Certain pages (such as goform/login and config/log_off_page.htm) cr…

  • Unscored —
    CVE-2019-11326

    An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of th…

  • Unscored —
    CVE-2018-17789

    Prospecta Master Data Online (MDO) allows CSRF.

  • Unscored —
    CVE-2019-5521

    VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.…

    VMware VMware ESXi VMware Workstation VMware Fusion Virtualization
  • Medium 6.1
    CVE-2018-11200

    XSS vulnerability in company name field in Mautic

    An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.

    mautic/core Packagist
  • Medium 5.9
    CVE-2019-4565

    IBM Security Key Lifecycle Manager 3.0 and 3.0.1 does not require that users should have strong passwords by default, w…

    IBM Security Key Lifecycle Manager
  • Low 3.7
    CVE-2019-4505

    IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sens…

    IBM WebSphere Application Server
  • Unscored —
    CVE-2019-16534

    On DrayTek Vigor2925 devices with firmware 3.8.4.3, XSS exists via a crafted WAN name on the General Setup screen. NOTE…

  • Unscored —
    CVE-2019-16533

    On DrayTek Vigor2925 devices with firmware 3.8.4.3, Incorrect Access Control exists in loginset.htm, and can be used to…

  • Unscored —
    CVE-2015-9408

    The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.

  • Unscored —
    CVE-2015-9407

    The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.

  • Unscored —
    CVE-2019-16644

    App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= …

  • Unscored —
    CVE-2015-9405

    The wp-piwik plugin before 1.0.5 for WordPress has XSS.

  • Unscored —
    CVE-2015-9404

    The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.

  • Unscored —
    CVE-2015-9403

    The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.

  • Unscored —
    CVE-2015-9402

    The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.

  • Unscored —
    CVE-2015-9401

    The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.

  • Unscored —
    CVE-2015-9400

    The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.

  • Unscored —
    CVE-2015-9399

    The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.

  • Unscored —
    CVE-2015-9398

    The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.

  • Unscored —
    CVE-2015-9397

    The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.

  • Unscored —
    CVE-2019-16643

    An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.

  • Unscored —
    CVE-2015-9396

    The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file…

  • Unscored —
    CVE-2015-9395

    The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.

  • Unscored —
    CVE-2015-9394

    The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.

  • Unscored —
    CVE-2015-9393

    The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.

  • Unscored —
    CVE-2015-9392

    The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.

  • Unscored —
    CVE-2015-9391

    The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.

  • Unscored —
    CVE-2015-9390

    The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are…