Archive
September 2019
Vulnerabilities first published in this month (UTC), newest first.
1,540 results · Feed
-
Unscored —
SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and…
-
Unscored —
Under certain conditions SAP Business One client (B1_ON_HANA, SAP-M-BO), before versions 9.2 and 9.3, allows an attacke…
-
Unscored —
In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp)…
-
Unscored —
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arb…
-
Unscored —
OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which coul…
-
Unscored —
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the …
-
Unscored —CVE-2019-15896 Public exploit
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.l…
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete …
-
Unscored —
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove …
-
High 7.5CVE-2019-12401 Public exploit
Apache Solr vulnerable to XML Bomb
Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will ex…
-
Unscored —
MISP before 2.4.115 allows privilege escalation in certain situations. After updating to 2.4.115, escalation attempts a…
-
Unscored —
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css par…
-
Unscored —
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id para…
-
Unscored —
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
-
Unscored —
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
-
Unscored —
The avada theme before 5.1.5 for WordPress has CSRF.
-
Unscored —
The avada theme before 5.1.5 for WordPress has stored XSS.
-
Unscored —
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
-
Unscored —
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
-
Unscored —
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page…
-
Unscored —
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
-
Unscored —
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
-
Unscored —
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
-
Unscored —
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
-
Unscored —CVE-2017-18598 Scanner template
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2…
-
Unscored —
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tabl…
-
Unscored —
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
-
Unscored —
A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify …
-
Unscored —
res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by se…
-
Medium 6.1
Cross-site scripting in padrino-contrib
The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
-
Medium 6.1
Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title
Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
-
Unscored —
An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially …
-
Unscored —
A clickjacking vulnerability was found in Limesurvey before 3.17.14.
-
Unscored —
A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the pa…