CVEs published in September 2019
1,651 vulnerabilities, 183 critical, 11 exploited.
- sqlite, canonical ubuntu linux, debian linux +20 more +22 moreIn SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other...6.5 Medium
- k-takata onigmoOnigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of...7.5 High
- k-takata onigmoOnigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint...7.5 High
- oniguruma project oniguruma, canonical ubuntu linux, debian linux +1 more +3 moreOniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.7.5 High
- myhtml project myhtmlMyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c.6.5 Medium
- gnu cflowGNU cflow through 1.6 has a use-after-free in the reference function in parser.c.6.5 Medium
- gnu cflowGNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.6.5 Medium
- nic bird, debian linux, fedoraproject fedora +1 more +3 moreBIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer...7.5 High
- librenmsAn issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function...6.1 Medium
- librenmsSQL Injection in LibreNMS8.1 High
- librenmsPath Traversal in LibreNMS7.5 High
- librenmsImproper Encoding or Escaping of Output and Injection in LibreNMS8.8 High
- librenmsSQL Injection in LibreNMS8.8 High
- librenmsMissing Authentication for Critical Function in LibreNMS9.1 Critical
- librenmsExposure of Sensitive Information to an Unauthorized Actor in LibreNMS5.3 Medium
- librenmsAn issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script...8.1 High
- librenmsLibreNMS Information Disclosure9.8 Critical
- search exclude project excludesearch-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows...7.5 High
- digium asteriskmain/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a...7.5 High
- librenmsAn issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in...7.2 High
- sakailms sakaiCross-site scripting in Sakai6.1 Medium
- atutorIn ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to...9.8 Critical
- getgophish gophishGophish XSS Vulnerability4.8 Medium
- buddyboss buddymoss mediaThe buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.5.4 Medium
- upperthemes swapeThe Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by...9.8 Critical
- vsourz cf7 invisible recaptchaThe cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.6.1 Medium
- wpcharitable charitableThe charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation...7.5 High
- hgw168cc yii-cmsCross-site Scripting in YII2-CMS6.1 Medium
- phpok okliteframework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability...8.8 High
- phpok okliteAn issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote...6.5 Medium
- weaver eteams oaAn issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the...6.5 Medium
- youphptubeIn YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to...9.8 Critical
- jobberbaseIn Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading...9.8 Critical
- getgrav grav cmsCross-site Scripting in Grav6.1 Medium
- kartatopia piluscartIn Kartatopia PilusCart 1.4.1, the parameter filename in the file catalog.php is mishandled,...7.5 High
- sysstat project sysstat, canonical ubuntu linux, debian linux +2 more +4 moresysstat before 12.1.6 has memory corruption due to an Integer Overflow in remap_struct() in...5.5 Medium
- linux kernel, canonical ubuntu linux, opensuse leap +1 more +3 moreIn the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector...4.4 Medium
- linux kernel, canonical ubuntu linux, opensuse leap +1 more +3 moreIn the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector...4.4 Medium
- apache traffic serverApache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache...7.5 High
- 10web photo galleryCross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for...6.1 Medium
- 10web photo galleryCross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for...6.1 Medium
- 10web photo gallerySQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress...9.8 Critical
- liquidweb event ticketsCSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists...8.8 High
- glyphandcog xpdfreaderIn Xpdf 4.01.01, a stack-based buffer under-read could be triggered in IdentityFunction:...7.8 High
- bluditBludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code...8.8 High
- plataformatec deviseAuthentication Bypass in Devise5.3 Medium
- silver-peak unity edgeconnect sd-wan firmwareSilver Peak EdgeConnect SD-WAN before 8.1.7.x allows CSRF via JSON data to a .swf file.8.8 High
- silver-peak unity edgeconnect sd-wan firmwareSilver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to trigger a web-interface...7.5 High
- silver-peak unity edgeconnect sd-wan firmwareSilver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially...5.3 Medium
- silver-peak unity edgeconnect sd-wan firmwareSilver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for...9.8 Critical
- Show moreLoading…