Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS comm…
-
Unscored —
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long …
-
Unscored —
On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the dev…
-
Unscored —
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item par…
-
Medium 6.9
McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerability
DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with adm…
-
Unscored —
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' proc…
-
Unscored —
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' proc…
-
Medium 6.5
phpMyAdmin Cross-Site Request Forgery (CSRF)
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
-
Unscored —
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing	…
-
Unscored —
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_ma…
-
Unscored —
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality av…
-
Unscored —
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-a…
-
Unscored —
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
-
Unscored —
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
-
Unscored —
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
-
Unscored —
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page …
-
Unscored —
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
-
Unscored —
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
-
Unscored —
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
-
Unscored —
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
-
Unscored —
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
-
Unscored —
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
-
Unscored —
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
-
Unscored —
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
-
Unscored —
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
-
Unscored —
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id para…
-
Unscored —
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
-
Unscored —CVE-2016-10940 Scanner template
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
-
Unscored —
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
-
Unscored —
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
-
Unscored —
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
-
Unscored —
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
-
Unscored —
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
-
Unscored —
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
-
Unscored —
PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunction…
-
Unscored —
hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations…
-
Unscored —
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09,…
-
Unscored —
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09,…
-
High 8.8
An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a c…
-
Critical 9.9
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The ser…