CVEs published in September 2019
1,651 vulnerabilities, 183 critical, 11 exploited.
- supportflow project supportflowThe supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.6.1 Medium
- peepsoThe peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save()...8.8 High
- creativeinteractivemedia real3d flipbookThe real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d...6.1 Medium
- creativeinteractivemedia real3d flipbookThe real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file...7.5 High
- creativeinteractivemedia real3d flipbookThe real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file...7.5 High
- findshorty dwnldrThe dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.6.1 Medium
- icegram engageThe icegram plugin before 1.9.19 for WordPress has XSS.6.1 Medium
- icegram engageThe icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name...6.5 Medium
- inkthemes colorwayThe colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.6.1 Medium
- joomlaserviceprovider wsecureThe wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in...8.8 High
- estatikThe estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload ...6.5 Medium
- estatikThe estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via...7.5 High
- akal project akalThe Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce...6.1 Medium
- egpp sistema integrado de gestion academicaIn Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC)...9.8 Critical
- dolibarr erp\/crmCross-site scripting in Dolibarr6.1 Medium
- gitlabAn issue was discovered in GitLab Enterprise Edition 11.x and 12.x before 12.0.9, 12.1.x before...7.1 High
- d-link dns-320 storage device, dlink dns-320 firmware +1 moreThe login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command...9.8 Critical
- mail-masta project mail-mastaThe mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and...7.5 High
- tagdiv newspaperThe newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin...9.8 Critical
- telestar bobs rock radio firmware, dabman d10 firmware, dabman i30 stereo firmware +8 more +10 moreTELESTAR Bobs Rock Radio, Dabman D10, Dabman i30 Stereo, Imperial i110, Imperial i150, Imperial...9.8 Critical
- fasterxml jackson-databind, debian linux, fedoraproject fedora +14 more +16 morePolymorphic Typing issue in FasterXML jackson-databind9.8 Critical
- fasterxml jackson-databind, debian linux, fedoraproject fedora +16 more +18 morePolymorphic Typing issue in FasterXML jackson-databind9.8 Critical
- get-simple getsimple cmsGetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.5.4 Medium
- bluditIn Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -...4.8 Medium
- api bearer auth project bearer authIn the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not...6.1 Medium
- cobham sailor 600 vsat ku firmware, sailor 800 vsat firmware, sailor 900 vsat firmware +8 more +10 moreCobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially...5.3 Medium
- scadabrScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as...6.1 Medium
- wireshark, debian linux, opensuse leap +2 moreIn Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite...7.5 High
wiresharkMageiaUpdated wireguard packages fix security vulnerabilityNo score- mozilla thunderbirdEncrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when...6.5 Medium
- pimcorePimcore RCE via PHAR upload8.8 High
- pimcorePimcore Unrestricted Upload of File with Dangerous Type8.8 High
- fujixerox docushareA Reflected Cross-Site Scripting (XSS) vulnerability in the webEx module in webExMeetingLogin.jsp...6.1 Medium
- scintilla, notepad-plus-plus notepad\+\+ +1 moreSciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of...7.8 High
- flamecms project flamecmsFlameCMS 3.3.5 has SQL injection in account/login.php via accountName.9.8 Critical
- niushopNIUSHOP V1.11 has XSS via the index.php?s=/admin URI.5.4 Medium
- niushopNIUSHOP V1.11 has CSRF via search_info to index.php.8.8 High
- s-cmss-cms V3.0 has XSS in index.php?type=text via the S_id parameter.6.1 Medium
- ifw8 fr5-e firmware, fr5 firmware, fr6-s firmware +2 more +4 moreifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML...7.5 High
- indexhibitIndexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via ...9.8 Critical
- mobatek mobaxtermIn MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted...8.8 High
- portaudio-rs project portaudio-rsUse after free in portaudio-rs9.8 Critical
- linea project lineaDouble free in linea9.8 Critical
- jhipster, jhipster kotlin +1 moreJHipster Kotlin using insecure source of randomness `RandomStringUtils` before v1.2.09.8 Critical
- gitlabhook project gitlabhookCommand Injection in gitlabhook10.0 Critical
- bowerSymlink Arbitrary File Overwrite in bower7.5 High
- hewlett packard enterprise data protectorPrivileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04...7.8 High
- codesys control for beaglebone, control for empc-a\/imx6, control for iot2000 +10 more +12 moreCODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially...9.8 Critical
- codesys control for beaglebone, control for empc-a\/imx6, control for iot2000 +10 more +12 moreCODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially...7.5 High
- arubanetworks arubaosA command injection vulnerability is present in the web management interface of ArubaOS that...7.2 High
- Show moreLoading…