CVEs published in October 2019
1,571 vulnerabilities, 242 critical, 7 exploited.
- jenkins kubernetes ci, jenkins project elasticbox jenkins kubernetes ci/cd plugin +1 moreJenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery8.8 High
- jenkins sonar gerrit, jenkins project sonar gerrit plugin +1 moreJenkins Sonar Gerrit Plugin stores credentials unencrypted6.5 Medium
- jenkins 360 fireline, jenkins project 360 fireline plugin +1 moreJenkins 360 FireLine Plugin vulnerable to XML External Entity Reference8.1 High
- jenkins deploy weblogic, jenkins project deploy weblogic plugin +1 moreJenkins Deploy WebLogic Plugin missing permission check4.3 Medium
- jenkins deploy weblogic, jenkins project deploy weblogic plugin +1 moreJenkins Deploy WebLogic Plugin cross-site request forgery vulnerability8.8 High
- jenkins dynatrace application monitoring, jenkins project dynatrace application monitoring plugin +1 moreJenkins Dynatrace Plugin contains Incorrect Default Permissions6.5 Medium
- jenkins dynatrace application monitoring, jenkins project dynatrace application monitoring plugin +1 moreJenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery8.1 High
- jenkins dynatrace application monitoring, jenkins project dynatrace application monitoring plugin +1 moreJenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials7.8 High
- jenkins bitbucket oauth, jenkins project bitbucket oauth plugin +1 moreJenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials7.8 High
- jenkins mattermost notification, jenkins project mattermost notification plugin +1 moreJenkins Mattermost Notification Plugin contains unencrypted storage of secret token6.5 Medium
- xnatWUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.6.5 Medium
- mozilla firefoxIf upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged...4.3 Medium
- mozilla firefoxA Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to...6.1 Medium
- mozilla firefoxAn object tag with a data URI did not correctly inherit the document's Content Security Policy....6.1 Medium
- mozilla firefoxA compromised content process could send a message to the parent process that would cause the ...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMozilla developers and community members reported memory safety bugs present in Firefox 69 and...8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreFailure to correctly handle null bytes when processing HTML entities resulted in Firefox...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf two same-origin documents set document.domain differently to become cross-origin, it was...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy using a form with a data URI it was possible to gain access to the privileged JSONView object...5.4 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreA fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted...8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer...8.8 High
- fusionpbxIn FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized ...6.1 Medium
- fusionpbxIn FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id"...6.1 Medium
- fusionpbxIn FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized ...6.1 Medium
- artificial intelligence project intelligenceThe Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML...6.1 Medium
- exquisite ultimate newspaper project ultimate newspaperThe Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to...6.1 Medium
- adobe experience manager formsAdobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting...6.1 Medium
- themepunch showbiz proThe Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php...9.8 Critical
- wpserveur wps hide loginThe wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.8.8 High
- ad inserter project inserterThe ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin...8.8 High
- freshmail freshmail-newsletterThe freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the ...8.8 High
- loofah project loofah, canonical ubuntu linux, debian linux +1 more +3 moreLoofah Allows Cross-site Scripting5.4 Medium
- syndication links project linksThe syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html...6.1 Medium
- indieweb post kinds project post kindsThe indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example...6.1 Medium
- nlb-creationst my wish listThe my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.6.1 Medium
- avm fritz\!osInformation Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS...2.4 Low
- sangoma session border controller firmwareThe Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument...9.8 Critical
- sangoma session border controller firmwareThe Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an...9.8 Critical
- gnu libidn2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreGNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2...7.5 High
- themooltipass moolticuteStephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access...6.5 Medium
- microfocus netiq self service password resetMan-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all...5.9 Medium
- totemo totemodatatotemodata 3.0.0_b936 has XSS via a folder name.5.4 Medium
- ibm db2 high performance unload load for luw, db2 high performance unload load +1 moreIBM DB2 High Performance Unload load for LUW 6.1 and 6.5 is vulnerable to a buffer overflow,...8.4 High
- chacha20 project chacha20Counter overflow in chacha207.5 High
- nipper-ng project nipper-ngA stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in...7.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen following the value's prototype chain, it was possible to retain a reference to a locale,...8.8 High
- open-emr openemrAuthenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2...8.8 High
- universal office converter project office converterServer-Side Request Forgery in unoconv7.5 High
realms-shimnpmSandbox Breakout in realms-shim9.8 Critical- fusionpbxIn FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id"...6.1 Medium
- Show moreLoading…