Skip to content
OpenAdvisories

Archive

7 October 2019

Vulnerabilities first published on this day (UTC), newest first.

← September 2019 2019 / October /7 November 2019 →
  1. 147
  2. 275
  3. 353
  4. 432
  5. 58
  6. 615
  7. 756
  8. 878
  9. 9107
  10. 10131
  11. 1151
  12. 129
  13. 136
  14. 1442
  15. 1520
  16. 16243
  17. 17112
  18. 1813
  19. 193
  20. 203
  21. 2136
  22. 2224
  23. 2395
  24. 2439
  25. 2556
  26. 26 
  27. 27 
  28. 2856
  29. 2956
  30. 3034
  31. 3173
All Critical High Medium Low Exploited only Public exploit

56 results · Feed

  • Unscored —
    CVE-2019-17232 Scanner template

    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options i…

  • Unscored —
    CVE-2019-17233 Scanner template

    Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.

  • Unscored —
    CVE-2019-13120

    Amazon FreeRTOS up to and including v1.4.8 lacks length checking in prvProcessReceivedPublish, resulting in untargetabl…

  • Unscored —
    CVE-2019-16913

    PC Protect Antivirus v4.14.31 installs by default to %PROGRAMFILES(X86)%\PCProtect with very weak folder permissions, g…

  • Unscored —
    CVE-2019-17239

    includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for Wo…

  • Medium 6.7
    CVE-2019-3745

    The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint…

    Dell Dell Encryption Enterprise Dell Endpoint Security Suite Enterprise
  • Low —
    GHSA-mgv2-57vj-99xc

    Low severity vulnerability that affects eye.js

    ## Test breaking ### Impact In v1.2.0, tests are broken: all tests are always succeeding. If tests are looking for security vulnerabilities, these were compromised. ### Patches Users should upgrade to `v1.2.1` ### Workarounds Users who don't use eye.js for lo…

    eye.js npm
  • Unscored —
    CVE-2019-15894

    An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.…

  • Unscored —
    CVE-2019-17042

    An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for…

    rsyslog rsyslog rsyslog Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-17041 Public exploit

    An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in th…

    rsyslog rsyslog rsyslog Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-17292

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.

  • Unscored —
    CVE-2019-17293

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user.

  • Unscored —
    CVE-2019-17294

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.

  • Unscored —
    CVE-2019-17295

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.

  • Unscored —
    CVE-2019-17296

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user.

  • Unscored —
    CVE-2019-17297

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user.

  • Unscored —
    CVE-2019-17298

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.

  • Unscored —
    CVE-2019-17299

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.

  • Unscored —
    CVE-2019-17300

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.

  • Unscored —
    CVE-2019-17301

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.

  • Unscored —
    CVE-2019-17302

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.

  • Unscored —
    CVE-2019-17303

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.

  • Unscored —
    CVE-2019-17304

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.

  • Unscored —
    CVE-2019-17305

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.

  • Unscored —
    CVE-2019-17306

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.

  • Unscored —
    CVE-2019-17307

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.

  • Unscored —
    CVE-2019-17308

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.

  • Unscored —
    CVE-2019-17309

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.

  • Unscored —
    CVE-2019-17310

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.

  • Unscored —
    CVE-2019-17311

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

  • Unscored —
    CVE-2019-17312

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

  • Unscored —
    CVE-2019-17313

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

  • Unscored —
    CVE-2019-17314

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.

  • Unscored —
    CVE-2019-17315

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.

  • Unscored —
    CVE-2019-17316

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.

  • Unscored —
    CVE-2019-17317

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.

  • Unscored —
    CVE-2019-17318

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.

  • Unscored —
    CVE-2019-17319

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.

  • Unscored —
    CVE-2015-9456

    The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification v…

  • Unscored —
    CVE-2015-9455

    The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-a…