Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial R…
-
Unscored —
A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a pos…
-
Unscored —
A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.…
-
Unscored —
A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.mo…
-
Unscored —
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501…
-
Unscored —
A Server-Side Request Forgery (SSRF): CWE-918 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX serv…
-
Unscored —
A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501…
-
Unscored —
A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG650…
-
Medium 5.4
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi…
-
Medium 4.3
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the fi…
-
Medium 5.3
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitiv…
-
Medium 5.3
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sy…
-
Medium 5.4
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulne…
-
Low 3.7
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or s…
-
Low 3.5
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pol…
-
Medium 5.9
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could …
-
Medium 6.1
IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the v…
-
Medium 5.9
IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send …
-
Unscored —
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to displ…
-
Unscored —
Data exposure in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.5…
-
Unscored —
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to sen…
-
Unscored —
Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34…
-
Unscored —
Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61,…
-
Unscored —
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this info…
-
Unscored —
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parse_req_queries…
-
Unscored —
Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of…
-
Unscored —
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to cras…
-
High 7.2
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that …
-
Medium 5.6
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attac…
-
Unscored —
A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary we…
-
Unscored —
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
-
Unscored —
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fro…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentio…
-
Unscored —
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
-
Unscored —
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
-
Unscored —
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
-
Unscored —
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption,…
-
Unscored —
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
-
Unscored —
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access…
-
Unscored —
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.