Skip to content
OpenAdvisories

Archive

September 2019

Vulnerabilities first published in this month (UTC), newest first.

← August 2019 2019 / September October 2019 →
  1. 1 
  2. 21
  3. 336
  4. 437
  5. 559
  6. 655
  7. 7 
  8. 822
  9. 997
  10. 1057
  11. 11139
  12. 1242
  13. 1350
  14. 1411
  15. 158
  16. 1671
  17. 1772
  18. 1844
  19. 1918
  20. 2077
  21. 2117
  22. 226
  23. 2340
  24. 2430
  25. 25104
  26. 2668
  27. 27311
  28. 283
  29. 291
  30. 3064
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.1
    CVE-2019-12562 Public exploit

    Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

    Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing conten…

    DotNetNuke.Core NuGet
  • Medium 6.1
    CVE-2017-18635 Public exploit

    Cross-Site Scripting in @novnc/novnc

    An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

    novnc @novnc/novnc novnc Debian Ubuntu npm
  • Medium 6.1
    CVE-2019-10089 Public exploit

    Cross-site scripting in Apache JSPWiki

    On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get so…

    org.apache.jspwiki:jspwiki-war Maven
  • Medium 6.1
    CVE-2019-16197 Public exploit

    Cross-site scripting in Dolibarr

    In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.5
    CVE-2019-12922 Public exploit EPSS 11%

    phpMyAdmin Cross-Site Request Forgery (CSRF)

    A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist
  • Medium 6.4
    CVE-2019-3759 Public exploit

    The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 con…

    Dell RSA Via Lifecycle and Governance RSA Identity Governance and Lifecycle
  • Medium 5.4
    CVE-2019-16172 Public exploit

    Cross-site Scripting in LimeSurvey

    LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.

    limesurvey/limesurvey Packagist
  • Medium 5.4
    CVE-2019-16173 Public exploit

    Cross-site Scripting in LimeSurvey

    LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,

    limesurvey/limesurvey Packagist
  • Medium 6.5
    CVE-2019-16097 Public exploit EPSS 22%

    Missing Authorization in Harbor

    core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. W…

    github.com/goharbor/harbor Go
  • Medium 6.1
    CVE-2019-14470 Public exploit EPSS 83%

    Cosenary Instagram-PHP-API contains reflected XSS vulnerability

    cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.

    cosenary/instagram Packagist
  • Medium 5.6
    CVE-2019-1125 Public exploit

    Windows Kernel Information Disclosure Vulnerability

    An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability,…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows Debian Ubuntu
  • Medium 6.1
    CVE-2019-15889 Public exploit EPSS 11%

    The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by …