Skip to content
OpenAdvisories

Archive

December 2019

Vulnerabilities first published in this month (UTC), newest first.

← November 2019 2019 / December January 2020 →
  1. 15
  2. 241
  3. 364
  4. 438
  5. 547
  6. 649
  7. 7 
  8. 89
  9. 927
  10. 10100
  11. 1177
  12. 12123
  13. 1359
  14. 14 
  15. 1510
  16. 1648
  17. 1771
  18. 18369
  19. 1956
  20. 2036
  21. 21 
  22. 222
  23. 2357
  24. 2421
  25. 253
  26. 2673
  27. 2766
  28. 281
  29. 2912
  30. 3079
  31. 3144
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.1
    CVE-2019-9553 Public exploit

    Bolt Cross-site Scripting via the slug, teaser or title parameters

    Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.

    bolt/bolt Packagist
  • Medium 5.8
    CVE-2019-19985 Public exploit Scanner template EPSS 71%

    The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file downlo…

    Web / CMS
  • Medium 6.1
    CVE-2016-1000229 Public exploit

    Improper Neutralization of Input During Web Page Generation in swagger-ui

    swagger-ui has XSS in key names

    swagger-ui npm
  • Medium 6.4
    CVE-2019-7004 Public exploit

    Avaya IP Office XSS Vulnerability

    A Cross-Site Scripting (XSS) vulnerability in the WebUI component of IP Office Application Server could allow unauthorized code execution and potentially disclose sensitive information. All product versions 11.x are affected. Product versions prior to 11.0, i…

    Avaya IP Office Application Server
  • Medium 4.4
    CVE-2019-6192 Public exploit

    A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a…

    Lenovo Power Management driver
  • Medium 6.1
    CVE-2014-3656 Public exploit

    JBoss KeyCloak Cross-site Scripting Vulnerability

    JBoss KeyCloak: XSS in login-status-iframe.html

    JBoss KeyCloak JBoss KeyCloak org.keycloak:keycloak-core Maven
  • Medium 5.5
    CVE-2019-17554 Public exploit EPSS 12%

    Improper Restriction of XML External Entity Reference in Apache Olingo

    The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger…

    Apache Olingo org.apache.olingo:odata-client-core org.apache.olingo:odata-server-core Maven