Skip to content
OpenAdvisories

Archive

26 December 2019

Vulnerabilities first published on this day (UTC), newest first.

← November 2019 2019 / December /26 January 2020 →
  1. 15
  2. 241
  3. 364
  4. 438
  5. 547
  6. 649
  7. 7 
  8. 89
  9. 927
  10. 10100
  11. 1177
  12. 12123
  13. 1359
  14. 14 
  15. 1510
  16. 1648
  17. 1771
  18. 18369
  19. 1956
  20. 2036
  21. 21 
  22. 222
  23. 2357
  24. 2421
  25. 253
  26. 2673
  27. 2766
  28. 281
  29. 2912
  30. 3079
  31. 3144
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.4
    CVE-2013-4318

    Features file injection vulnerability

    File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.

    Features Features features RubyGems
  • Medium 5.8
    CVE-2019-16781

    Stored cross-site scripting (XSS) in WordPress block editor

    In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  • Medium 5.8
    CVE-2019-16780

    Stored cross-site scripting (XSS) in WordPress block editor

    WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack …

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  • Medium 6.1
    CVE-2019-6035

    Athenz vulnerable to Open Redirect

    Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.

    Verison Media Athenz com.yahoo.athenz:athenz Maven
  • Medium 4.3
    CVE-2019-19980

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authentica…

    Web / CMS
  • Medium 5.4
    CVE-2019-19981

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on…

    Web / CMS
  • Medium 6.5
    CVE-2019-19982

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option …

    Web / CMS
  • Medium 4.3
    CVE-2019-19983

    In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application…

    Web / CMS
  • Medium 6.3
    CVE-2019-19984

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabi…

    Web / CMS
  • Medium 5.8
    CVE-2019-19985 Public exploit Scanner template EPSS 71%

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file downlo…

    Web / CMS