| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-4442 | Med | 0.28 | 4.3 | 0.02 | Sep 17, 2019 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226. | ||
| CVE-2019-4342 | Med | 0.35 | 5.4 | 0.01 | Sep 17, 2019 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force… | ||
| CVE-2019-4271 | Low | 0.23 | 3.5 | 0.01 | Sep 17, 2019 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243. | ||
| CVE-2019-4270 | Med | 0.35 | 5.4 | 0.01 | Sep 17, 2019 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure… | ||
| CVE-2019-4268 | Med | 0.35 | 5.3 | 0.03 | Sep 17, 2019 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 160201. | ||
| CVE-2019-4183 | Hig | 0.49 | 7.5 | 0.04 | Sep 17, 2019 | IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would consume all available CPU and memory resources. IBM X-Force ID: 158973. | ||
| CVE-2019-4175 | Hig | 0.49 | 7.5 | 0.01 | Sep 17, 2019 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158880. | ||
| CVE-2019-4171 | Low | 0.24 | 3.7 | 0.01 | Sep 17, 2019 | IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876. | ||
| CVE-2019-4086 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and… | ||
| CVE-2019-13542 | Med | 0.42 | 6.5 | 0.02 | Sep 17, 2019 | 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition. | ||
| CVE-2019-11666 | Hig | 0.57 | 8.8 | 0.01 | Sep 17, 2019 | Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deserialization of untrusted data. | ||
| CVE-2019-11667 | Hig | 0.49 | 7.5 | 0.01 | Sep 17, 2019 | Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to private data. | ||
| CVE-2019-9681 | Med | 0.35 | 5.3 | 0.01 | Sep 17, 2019 | Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-… | ||
| CVE-2019-9009 | Hig | 0.49 | 7.5 | 0.02 | Sep 17, 2019 | An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash. | ||
| CVE-2019-14835 | Hig | 0.51 | 7.8 | 0.01 | Sep 17, 2019 | A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to… | ||
| CVE-2019-14826 | Med | 0.29 | 4.4 | 0.00 | Sep 17, 2019 | A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session. | ||
| CVE-2019-12755 | Med | 0.36 | 5.5 | 0.00 | Sep 17, 2019 | Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information. | ||
| CVE-2018-20336 | Hig | 0.49 | 7.5 | 0.02 | Sep 17, 2019 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parse_req_queries function in wanduck.c via a long string over UDP, which may lead to an information leak. | ||
| CVE-2019-15729 | Hig | 0.49 | 7.5 | 0.02 | Sep 17, 2019 | An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request. | ||
| CVE-2019-11559 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component. | ||
| CVE-2016-10993 | Med | 0.35 | 5.4 | 0.03 | Sep 17, 2019 | The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter. | ||
| CVE-2016-10992 | Med | 0.40 | 6.1 | 0.02 | Sep 17, 2019 | The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. | ||
| CVE-2016-10991 | Hig | 0.49 | 7.5 | 0.02 | Sep 17, 2019 | The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion. | ||
| CVE-2016-10990 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header. | ||
| CVE-2016-10989 | Hig | 0.57 | 8.8 | 0.01 | Sep 17, 2019 | The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF. | ||
| CVE-2016-10988 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer. | ||
| CVE-2016-10987 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS. | ||
| CVE-2016-10986 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret. | ||
| CVE-2016-10985 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | ||
| CVE-2016-10984 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | ||
| CVE-2016-10983 | Med | 0.35 | 6.5 | 0.02 | Sep 17, 2019 | The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data. | ||
| CVE-2016-10982 | Hig | 0.57 | 8.8 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF. | ||
| CVE-2016-10981 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text. | ||
| CVE-2016-10980 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo. | ||
| CVE-2016-10979 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS. | ||
| CVE-2016-10978 | Hig | 0.57 | 8.8 | 0.01 | Sep 17, 2019 | The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF. | ||
| CVE-2016-10977 | Med | 0.42 | 6.5 | 0.02 | Sep 17, 2019 | The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal. | ||
| CVE-2016-10976 | Med | 0.40 | 6.1 | 0.02 | Sep 17, 2019 | The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS. | ||
| CVE-2016-10975 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2019 | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter. | ||
| CVE-2016-10974 | Hig | 0.57 | 8.8 | 0.01 | Sep 17, 2019 | The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS. | ||
| CVE-2019-9008 | Hig | 0.57 | 8.8 | 0.02 | Sep 17, 2019 | An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime. | ||
| CVE-2019-16378 | Cri | 0.64 | 9.8 | 0.02 | Sep 17, 2019 | OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message. | ||
| CVE-2019-16239 | Cri | 0.57 | 9.8 | 0.03 | Sep 17, 2019 | process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes. | ||
| CVE-2019-15131 | Cri | 0.64 | 9.8 | 0.02 | Sep 17, 2019 | In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42… | ||
| CVE-2019-5482 | Cri | 0.58 | 9.8 | 0.18 | Sep 16, 2019 | Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. | ||
| CVE-2019-5481 | Cri | 0.57 | 9.8 | 0.07 | Sep 16, 2019 | Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. | ||
| CVE-2019-4147 | Hig | 0.47 | 7.2 | 0.01 | Sep 16, 2019 | IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413. | ||
| CVE-2019-8368 | Med | 0.43 | 6.1 | 0.46 | Sep 16, 2019 | OpenEMR v5.0.1-6 allows XSS. | ||
| CVE-2019-16371 | Hig | 0.53 | 8.2 | 0.01 | Sep 16, 2019 | LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking. | ||
| CVE-2019-16370 | Med | 0.31 | 5.9 | 0.01 | Sep 16, 2019 | The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900. |
- risk 0.28cvss 4.3epss 0.02
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
- risk 0.35cvss 5.4epss 0.01
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force…
- risk 0.23cvss 3.5epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin console is vulnerable to a Client-side HTTP parameter pollution vulnerability. IBM X-Force ID: 160243.
- risk 0.35cvss 5.4epss 0.01
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure…
- risk 0.35cvss 5.3epss 0.03
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 160201.
- risk 0.49cvss 7.5epss 0.04
IBM Cognos Analytics 11.0, and 11.1 is vulnerable to a denial of service attack that could allow a remote user to send specially crafted requests that would consume all available CPU and memory resources. IBM X-Force ID: 158973.
- risk 0.49cvss 7.5epss 0.01
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158880.
- risk 0.24cvss 3.7epss 0.01
IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 158876.
- risk 0.40cvss 6.1epss 0.01
IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and…
- risk 0.42cvss 6.5epss 0.02
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.
- risk 0.57cvss 8.8epss 0.01
Insecure deserialization of untrusted data in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow insecure deserialization of untrusted data.
- risk 0.49cvss 7.5epss 0.01
Unauthorized access to contact information in Micro Focus Service Manager, versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to private data.
- risk 0.35cvss 5.3epss 0.01
Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing firmware packages by specific means. Affected products include: IPC-HDW1X2X,IPC-HFW1X2X,IPC-HDW2X2X,IPC-HFW2X2X,IPC-HDW4X2X,IPC-HFW4X2X,IPC-…
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
- risk 0.51cvss 7.8epss 0.01
A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to…
- risk 0.29cvss 4.4epss 0.00
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.
- risk 0.36cvss 5.5epss 0.00
Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in ASUSWRT 3.0.0.4.384.20308. There is a stack-based buffer overflow issue in parse_req_queries function in wanduck.c via a long string over UDP, which may lead to an information leak.
- risk 0.49cvss 7.5epss 0.02
An issue was discovered in GitLab Community and Enterprise Edition 8.18 through 12.2.1. An internal endpoint unintentionally disclosed information about the last pipeline that ran for a merge request.
- risk 0.40cvss 6.1epss 0.01
A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component.
- risk 0.35cvss 5.4epss 0.03
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
- risk 0.40cvss 6.1epss 0.02
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
- risk 0.49cvss 7.5epss 0.02
The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
- risk 0.40cvss 6.1epss 0.01
The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
- risk 0.57cvss 8.8epss 0.01
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
- risk 0.40cvss 6.1epss 0.01
The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
- risk 0.40cvss 6.1epss 0.01
The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
- risk 0.40cvss 6.1epss 0.01
The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
- risk 0.40cvss 6.1epss 0.01
The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
- risk 0.35cvss 6.5epss 0.02
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
- risk 0.57cvss 8.8epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
- risk 0.40cvss 6.1epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
- risk 0.40cvss 6.1epss 0.01
The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
- risk 0.40cvss 6.1epss 0.01
The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
- risk 0.57cvss 8.8epss 0.01
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
- risk 0.42cvss 6.5epss 0.02
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
- risk 0.40cvss 6.1epss 0.02
The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
- risk 0.40cvss 6.1epss 0.01
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
- risk 0.57cvss 8.8epss 0.01
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
- risk 0.57cvss 8.8epss 0.02
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
- risk 0.64cvss 9.8epss 0.02
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.
- risk 0.57cvss 9.8epss 0.03
process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
- risk 0.64cvss 9.8epss 0.02
In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42…
- risk 0.58cvss 9.8epss 0.18
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
- risk 0.57cvss 9.8epss 0.07
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
- risk 0.47cvss 7.2epss 0.01
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
- risk 0.43cvss 6.1epss 0.46
OpenEMR v5.0.1-6 allows XSS.
- risk 0.53cvss 8.2epss 0.01
LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking.
- risk 0.31cvss 5.9epss 0.01
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.