| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-5333 | Cri | 0.68 | 9.8 | 0.16 | Sep 13, 2019 | The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable… | ||
| CVE-2019-16289 | Med | 0.35 | 5.4 | 0.01 | Sep 13, 2019 | The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter. | ||
| CVE-2019-16288 | Hig | 0.49 | 7.5 | 0.01 | Sep 13, 2019 | On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash. | ||
| CVE-2019-3646 | Med | 0.45 | 6.9 | 0.01 | Sep 13, 2019 | DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights. | ||
| CVE-2019-15031 | Med | 0.29 | 4.4 | 0.01 | Sep 13, 2019 | In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then… | ||
| CVE-2019-15030 | Med | 0.29 | 4.4 | 0.00 | Sep 13, 2019 | In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction… | ||
| CVE-2019-13364 | Cri | 0.63 | 9.6 | 0.01 | Sep 13, 2019 | admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF. | ||
| CVE-2019-13363 | Cri | 0.63 | 9.6 | 0.01 | Sep 13, 2019 | admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit… | ||
| CVE-2019-12922 | Med | 0.39 | 6.5 | 0.11 | Sep 13, 2019 | A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. | ||
| CVE-2019-12517 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later… | ||
| CVE-2019-12516 | Hig | 0.57 | 8.8 | 0.02 | Sep 13, 2019 | The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI. | ||
| CVE-2016-10955 | Cri | 0.64 | 9.8 | 0.02 | Sep 13, 2019 | The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking. | ||
| CVE-2016-10954 | Cri | 0.64 | 9.8 | 0.02 | Sep 13, 2019 | The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload. | ||
| CVE-2016-10953 | Med | 0.35 | 5.4 | 0.01 | Sep 13, 2019 | The Headway theme before 3.8.9 for WordPress has XSS via the license key field. | ||
| CVE-2016-10952 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter. | ||
| CVE-2016-10951 | Hig | 0.47 | 7.2 | 0.02 | Sep 13, 2019 | The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter. | ||
| CVE-2016-10950 | Hig | 0.57 | 8.8 | 0.02 | Sep 13, 2019 | The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter. | ||
| CVE-2016-10949 | Hig | 0.57 | 8.8 | 0.02 | Sep 13, 2019 | The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization. | ||
| CVE-2016-10948 | Hig | 0.53 | 8.1 | 0.02 | Sep 13, 2019 | The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function. | ||
| CVE-2016-10947 | Hig | 0.47 | 7.2 | 0.02 | Sep 13, 2019 | The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin. | ||
| CVE-2016-10946 | Hig | 0.57 | 8.8 | 0.01 | Sep 13, 2019 | The wp-d3 plugin before 2.4.1 for WordPress has CSRF. | ||
| CVE-2019-16277 | Hig | 0.51 | 7.8 | 0.01 | Sep 13, 2019 | PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c. | ||
| CVE-2017-18615 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The kama-clic-counter plugin before 3.5.0 for WordPress has XSS. | ||
| CVE-2017-18614 | Hig | 0.53 | 8.1 | 0.02 | Sep 13, 2019 | The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter. | ||
| CVE-2017-18613 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter. | ||
| CVE-2017-18612 | Med | 0.40 | 6.1 | 0.01 | Sep 13, 2019 | The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter. | ||
| CVE-2016-10945 | Hig | 0.57 | 8.8 | 0.01 | Sep 13, 2019 | The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF. | ||
| CVE-2016-10944 | Hig | 0.57 | 8.8 | 0.01 | Sep 13, 2019 | The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF. | ||
| CVE-2016-10943 | Hig | 0.47 | 7.2 | 0.02 | Sep 13, 2019 | The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter. | ||
| CVE-2016-10942 | Cri | 0.57 | 9.8 | 0.02 | Sep 13, 2019 | The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF. | ||
| CVE-2016-10941 | Med | 0.33 | 6.1 | 0.01 | Sep 13, 2019 | The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF. | ||
| CVE-2016-10940 | Hig | 0.47 | 7.2 | 0.05 | Sep 13, 2019 | The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter. | ||
| CVE-2016-10939 | Hig | 0.47 | 7.2 | 0.02 | Sep 13, 2019 | The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter. | ||
| CVE-2016-10938 | Med | 0.42 | 6.5 | 0.01 | Sep 13, 2019 | The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location. | ||
| CVE-2019-16275 | Med | 0.42 | 6.5 | 0.01 | Sep 12, 2019 | hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The… | ||
| CVE-2019-13534 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2019 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by… | ||
| CVE-2019-13530 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2019 | Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by… | ||
| CVE-2019-8076 | Hig | 0.51 | 7.8 | 0.04 | Sep 12, 2019 | Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user. | ||
| CVE-2019-8070 | Cri | 0.64 | 9.8 | 0.06 | Sep 12, 2019 | Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user. | ||
| CVE-2019-8069 | Cri | 0.64 | 9.8 | 0.04 | Sep 12, 2019 | Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user. | ||
| CVE-2019-11899 | Hig | 0.49 | 7.5 | 0.01 | Sep 12, 2019 | An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Professional Edition (APE) 3.8, client installations need to be authorized by the APE administrator. | ||
| CVE-2019-11898 | Cri | 0.64 | 9.9 | 0.01 | Sep 12, 2019 | Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8. | ||
| CVE-2019-14237 | Cri | 0.64 | 9.8 | 0.03 | Sep 12, 2019 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution. | ||
| CVE-2019-14236 | Cri | 0.64 | 9.8 | 0.02 | Sep 12, 2019 | On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution. | ||
| CVE-2019-11774 | Hig | 0.48 | 7.4 | 0.01 | Sep 12, 2019 | Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that… | ||
| CVE-2019-11773 | Hig | 0.51 | 7.8 | 0.00 | Sep 12, 2019 | Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. | ||
| CVE-2019-6009 | Med | 0.40 | 6.1 | 0.02 | Sep 12, 2019 | Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | ||
| CVE-2019-6007 | Hig | 0.57 | 8.8 | 0.02 | Sep 12, 2019 | Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arbitrary code via unspecified vectors. | ||
| CVE-2019-6005 | Cri | 0.64 | 9.8 | 0.02 | Sep 12, 2019 | Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's intent, such as installing arbitrary software or changing the device settings via Android Debug Bridge port 5555/TCP. | ||
| CVE-2019-6004 | Med | 0.40 | 6.1 | 0.01 | Sep 12, 2019 | Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. |
- risk 0.68cvss 9.8epss 0.16
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable…
- risk 0.35cvss 5.4epss 0.01
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.
- risk 0.49cvss 7.5epss 0.01
On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the device to crash.
- risk 0.45cvss 6.9epss 0.01
DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights.
- risk 0.29cvss 4.4epss 0.01
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via an interrupt. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction tbegin) and then…
- risk 0.29cvss 4.4epss 0.00
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' processes via a Facility Unavailable exception. To exploit the venerability, a local user starts a transaction (via the hardware transactional memory instruction…
- risk 0.63cvss 9.6epss 0.01
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. This is exploitable via CSRF.
- risk 0.63cvss 9.6epss 0.01
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_dates, or param_submit…
- risk 0.39cvss 6.5epss 0.11
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
- risk 0.40cvss 6.1epss 0.01
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later…
- risk 0.57cvss 8.8epss 0.02
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI.
- risk 0.64cvss 9.8epss 0.02
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
- risk 0.64cvss 9.8epss 0.02
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
- risk 0.35cvss 5.4epss 0.01
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
- risk 0.40cvss 6.1epss 0.01
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
- risk 0.47cvss 7.2epss 0.02
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
- risk 0.57cvss 8.8epss 0.02
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
- risk 0.57cvss 8.8epss 0.02
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
- risk 0.53cvss 8.1epss 0.02
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
- risk 0.47cvss 7.2epss 0.02
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
- risk 0.57cvss 8.8epss 0.01
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
- risk 0.51cvss 7.8epss 0.01
PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionCall in expression.c.
- risk 0.40cvss 6.1epss 0.01
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
- risk 0.53cvss 8.1epss 0.02
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
- risk 0.40cvss 6.1epss 0.01
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
- risk 0.40cvss 6.1epss 0.01
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
- risk 0.57cvss 8.8epss 0.01
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
- risk 0.57cvss 8.8epss 0.01
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
- risk 0.47cvss 7.2epss 0.02
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
- risk 0.57cvss 9.8epss 0.02
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
- risk 0.33cvss 6.1epss 0.01
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
- risk 0.47cvss 7.2epss 0.05
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
- risk 0.47cvss 7.2epss 0.02
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
- risk 0.42cvss 6.5epss 0.01
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
- risk 0.42cvss 6.5epss 0.01
hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled. This is a denial of service that should have been prevented by PMF (aka management frame protection). The…
- risk 0.47cvss 7.2epss 0.01
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by…
- risk 0.47cvss 7.2epss 0.01
Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09, Part #: M8096-67501, WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by Version C) and WLAN Version B, Firmware A.01.09, Part #: N/A (Replaced by…
- risk 0.51cvss 7.8epss 0.04
Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- risk 0.64cvss 9.8epss 0.06
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- risk 0.64cvss 9.8epss 0.04
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
- risk 0.49cvss 7.5epss 0.01
An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a client installation. With Bosch Access Professional Edition (APE) 3.8, client installations need to be authorized by the APE administrator.
- risk 0.64cvss 9.9epss 0.01
Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is discontinued with Bosch Access Professional Edition (APE) 3.8.
- risk 0.64cvss 9.8epss 0.03
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution.
- risk 0.64cvss 9.8epss 0.02
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.
- risk 0.48cvss 7.4epss 0.01
Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that…
- risk 0.51cvss 7.8epss 0.00
Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users.
- risk 0.40cvss 6.1epss 0.02
Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- risk 0.57cvss 8.8epss 0.02
Integer overflow vulnerability in apng-drawable 1.0.0 to 1.6.0 allows an attacker to cause a denial of service (DoS) condition or execute arbitrary code via unspecified vectors.
- risk 0.64cvss 9.8epss 0.02
Smart TV Box firmware version prior to 1300 allows remote attackers to bypass access restriction to conduct arbitrary operations on the device without user's intent, such as installing arbitrary software or changing the device settings via Android Debug Bridge port 5555/TCP.
- risk 0.40cvss 6.1epss 0.01
Open redirect vulnerability in ApeosWare Management Suite Ver.1.4.0.18 and earlier, and ApeosWare Management Suite 2 Ver.2.1.2.4 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.