CVEs published in September 2019
1,651 vulnerabilities, 183 critical, 11 exploited.
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id...5.3 Medium
- usabilitydynamics wp-invoiceThe wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init...5.3 Medium
- elfsight instalinkerThe instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php...6.1 Medium
- elegantthemes monarchThe Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.8.8 High
- elegantthemes extraThe Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.8.8 High
- elegantthemes bloomThe Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.8.8 High
- plugin-planet user submitted postsThe user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted...6.1 Medium
- smackcoders ultimate exporterThe wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the...9.8 Critical
- yejiao tuzicmsApp\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the...9.8 Critical
- momizat goodnewsThe Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.6.1 Medium
- ocimscripts ocim-mp3The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages...6.1 Medium
- yourinspirationweb beauty-premiumThe beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in...6.5 Medium
- optinmonsterThe optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes...5.3 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker...8.8 High
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality...9.8 Critical
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used...7.2 High
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped,...6.1 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the...7.5 High
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to...6.5 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This...6.1 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the...9.1 Critical
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to...5.4 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto...6.1 Medium
- prise adasAn issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output...6.1 Medium
- layerbbLayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings...8.8 High
php5Debianphp5 - security updateNo score- qemu, canonical ubuntu linux, opensuse leap +2 moreIn QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8...3.8 Low
- libavA stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt...6.5 Medium
- libavA stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt...8.8 High
- libavIn Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a...6.5 Medium
- checklistAn XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill...6.1 Medium
- debian linux, linux kernel, canonical ubuntu linux +25 more +27 moreAn out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way...7.5 High
- pydioPydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can...7.7 High
- pydioPydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the...5.3 Medium
- firegiant wix toolsetAn issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment...5.5 Medium
- mz-automation libiec61850libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server...7.5 High
- tendacn n301 firmwareIn goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a...7.5 High
- keeper k5 firmwareOn Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD...6.8 Medium
- atlassian jira server, jira data center +1 moreThe Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before...7.2 High
- atlassian bitbucket, bitbucket server, bitbucket data center +2 moreThe commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed...9.8 Critical
- atlassian jira service desk data center, jira service desk server, jira service desk +2 moreThe Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data...7.5 High
- line corporation line(android), linecorp line +1 moreInteger overflow vulnerability in LINE(Android) from 4.4.0 to the version before 9.15.1 allows...7.8 High
- eclipse mosquitto, the eclipse foundation eclipse mosquitto, canonical ubuntu linux +4 more +6 moreIn Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE...6.5 Medium
- linux-nfs nfs-utils, suse linux enterprise server 12, linux enterprise server 15 +2 morenfs-utils: root-owned files stored in insecure /var/lib/nfs directory5.1 Medium
operaopenSUSESecurity update for operaNo score- valvesoftware counter-strike\vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to...8.8 High
- google chromeOut of bounds read in SwiftShader in Google Chrome prior to 77.0.3865.75 allowed a remote...8.1 High
- google chromeInsufficient policy enforcement in Blink in Google Chrome prior to 77.0.3865.75 allowed a remote...7.4 High
- google chromeInsufficient policy enforcement in extensions in Google Chrome prior to 77.0.3865.75 allowed an...6.5 Medium
- google chromeUse after free in V8 in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to...8.8 High
- Show moreLoading…