Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
-
Unscored —
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of …
-
Unscored —
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
-
Unscored —
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today…
-
Unscored —
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
-
Unscored —
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
-
Unscored —
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
-
Unscored —
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
-
Unscored —CVE-2016-10976 Scanner template
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
-
Unscored —
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
-
Unscored —
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
-
Unscored —
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over…
-
Unscored —
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may all…
-
Unscored —
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encodi…
-
Unscored —
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: …
-
Medium 4.7
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send speciall…
-
Critical 9.8CVE-2019-5482 EPSS 18%
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
-
Critical 9.8
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
-
Unscored —
LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a vic…
-
Low —
Use of a weak cryptographic algorithm in Gradle
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
-
Critical 9.8
Timing attack on HMAC signature comparison in Apache Tapestry
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct sig…
-
Unscored —
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a pr…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not be…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdow…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed impro…
-
Unscored —CVE-2019-8368 EPSS 46%
OpenEMR v5.0.1-6 allows XSS.
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipe…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch na…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to commen…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attack…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks …
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in m…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API t…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnera…
-
Unscored —
An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests cr…
-
Unscored —
OpenEMR v5.0.1-6 allows code execution.