| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10917 | Cri | 0.64 | 9.8 | 0.02 | Aug 22, 2019 | The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316. | ||
| CVE-2016-10916 | Cri | 0.64 | 9.8 | 0.02 | Aug 22, 2019 | The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319. | ||
| CVE-2015-9336 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The clean-login plugin before 1.5.1 for WordPress has reflected XSS. | ||
| CVE-2015-9335 | Cri | 0.64 | 9.8 | 0.02 | Aug 22, 2019 | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | ||
| CVE-2015-9333 | Cri | 0.64 | 9.8 | 0.02 | Aug 22, 2019 | The cforms2 plugin before 14.6.10 for WordPress has SQL injection. | ||
| CVE-2013-7481 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | ||
| CVE-2013-7480 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas. | ||
| CVE-2013-7479 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field. | ||
| CVE-2013-7478 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post. | ||
| CVE-2013-7477 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form. | ||
| CVE-2012-6716 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links. | ||
| CVE-2009-5158 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text. | ||
| CVE-2019-6177 | Cri | 0.64 | 9.8 | 0.01 | Aug 21, 2019 | A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that… | ||
| CVE-2019-5638 | Hig | 0.57 | 8.7 | 0.01 | Aug 21, 2019 | Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential… | ||
| CVE-2019-15316 | Hig | 0.46 | 7.0 | 0.00 | Aug 21, 2019 | Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition. | ||
| CVE-2019-15315 | Hig | 0.51 | 7.8 | 0.00 | Aug 21, 2019 | Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch. | ||
| CVE-2019-14686 | Hig | 0.51 | 7.8 | 0.01 | Aug 21, 2019 | A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micro Ransom Buster (1.0) tool in which, if exploited, would allow an attacker to load a malicious DLL, leading to elevated… | ||
| CVE-2019-14685 | Hig | 0.51 | 7.8 | 0.01 | Aug 21, 2019 | A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service. | ||
| CVE-2019-13476 | Med | 0.36 | 5.4 | 0.07 | Aug 21, 2019 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page. | ||
| CVE-2019-11603 | Hig | 0.49 | 7.5 | 0.02 | Aug 21, 2019 | A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root. | ||
| CVE-2019-11602 | Med | 0.35 | 5.3 | 0.01 | Aug 21, 2019 | Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure. | ||
| CVE-2019-11601 | Hig | 0.49 | 7.5 | 0.03 | Aug 21, 2019 | A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location. | ||
| CVE-2019-10687 | Cri | 0.64 | 9.8 | 0.03 | Aug 21, 2019 | KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request. | ||
| CVE-2018-17791 | Hig | 0.49 | 7.5 | 0.02 | Aug 21, 2019 | Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the… | ||
| CVE-2019-1984 | Med | 0.42 | 6.5 | 0.02 | Aug 21, 2019 | A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is… | ||
| CVE-2019-1974 | Cri | 0.64 | 9.8 | 0.04 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an… | ||
| CVE-2019-1948 | Med | 0.38 | 5.9 | 0.01 | Aug 21, 2019 | A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer (SSL) certificate. The vulnerability is due to insufficient SSL certificate validation… | ||
| CVE-2019-1938 | Cri | 0.64 | 9.8 | 0.05 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The… | ||
| CVE-2019-1937 | Cri | 0.73 | 9.8 | 0.76 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator… | ||
| CVE-2019-1936 | Hig | 0.53 | 7.2 | 0.39 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux… | ||
| CVE-2019-1935 | Cri | 0.73 | 9.8 | 0.83 | Aug 21, 2019 | A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which… | ||
| CVE-2019-1908 | Hig | 0.49 | 7.5 | 0.02 | Aug 21, 2019 | A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security… | ||
| CVE-2019-1907 | Hig | 0.57 | 8.8 | 0.01 | Aug 21, 2019 | A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations… | ||
| CVE-2019-1900 | Hig | 0.49 | 7.5 | 0.02 | Aug 21, 2019 | A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient… | ||
| CVE-2019-1896 | Hig | 0.47 | 7.2 | 0.02 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands and obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input… | ||
| CVE-2019-1885 | Hig | 0.47 | 7.2 | 0.04 | Aug 21, 2019 | A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of… | ||
| CVE-2019-1883 | Hig | 0.51 | 7.8 | 0.00 | Aug 21, 2019 | A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to… | ||
| CVE-2019-1871 | Hig | 0.47 | 7.2 | 0.03 | Aug 21, 2019 | A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device.… | ||
| CVE-2019-1865 | Hig | 0.57 | 8.8 | 0.04 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to… | ||
| CVE-2019-1864 | Hig | 0.57 | 8.8 | 0.03 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to… | ||
| CVE-2019-1863 | Hig | 0.53 | 8.1 | 0.02 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization… | ||
| CVE-2019-1850 | Hig | 0.47 | 7.2 | 0.04 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. An attacker would need to have… | ||
| CVE-2019-1839 | Med | 0.44 | 6.7 | 0.00 | Aug 21, 2019 | A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes… | ||
| CVE-2019-1634 | Hig | 0.47 | 7.2 | 0.03 | Aug 21, 2019 | A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The… | ||
| CVE-2019-15127 | Med | 0.35 | 5.4 | 0.01 | Aug 21, 2019 | REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file. | ||
| CVE-2019-15074 | Cri | 0.56 | 9.6 | 0.02 | Aug 21, 2019 | The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user… | ||
| CVE-2019-15045 | Med | 0.35 | 5.3 | 0.05 | Aug 21, 2019 | AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality | ||
| CVE-2019-14258 | Hig | 0.49 | 7.5 | 0.02 | Aug 21, 2019 | The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988. | ||
| CVE-2019-14257 | Hig | 0.51 | 7.8 | 0.01 | Aug 21, 2019 | pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765. | ||
| CVE-2019-14246 | Med | 0.42 | 6.5 | 0.02 | Aug 21, 2019 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account. |
- risk 0.64cvss 9.8epss 0.02
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
- risk 0.64cvss 9.8epss 0.02
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
- risk 0.40cvss 6.1epss 0.01
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
- risk 0.64cvss 9.8epss 0.02
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
- risk 0.64cvss 9.8epss 0.02
The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
- risk 0.40cvss 6.1epss 0.01
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
- risk 0.40cvss 6.1epss 0.01
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
- risk 0.64cvss 9.8epss 0.01
A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that…
- risk 0.57cvss 8.7epss 0.01
Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential…
- risk 0.46cvss 7.0epss 0.00
Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.
- risk 0.51cvss 7.8epss 0.00
Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch.
- risk 0.51cvss 7.8epss 0.01
A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micro Ransom Buster (1.0) tool in which, if exploited, would allow an attacker to load a malicious DLL, leading to elevated…
- risk 0.51cvss 7.8epss 0.01
A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.
- risk 0.36cvss 5.4epss 0.07
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
- risk 0.49cvss 7.5epss 0.02
A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root.
- risk 0.35cvss 5.3epss 0.01
Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.
- risk 0.49cvss 7.5epss 0.03
A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
- risk 0.64cvss 9.8epss 0.03
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
- risk 0.49cvss 7.5epss 0.02
Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the…
- risk 0.42cvss 6.5epss 0.02
A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is…
- risk 0.64cvss 9.8epss 0.04
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an…
- risk 0.38cvss 5.9epss 0.01
A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer (SSL) certificate. The vulnerability is due to insufficient SSL certificate validation…
- risk 0.64cvss 9.8epss 0.05
A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The…
- risk 0.73cvss 9.8epss 0.76
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator…
- risk 0.53cvss 7.2epss 0.39
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux…
- risk 0.73cvss 9.8epss 0.83
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the Intelligent Platform Management Interface (IPMI) implementation of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to insufficient security…
- risk 0.57cvss 8.8epss 0.01
A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to set sensitive configuration values and gain elevated privileges. The vulnerability is due to improper handling of substring comparison operations…
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to cause the web server process to crash, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient…
- risk 0.47cvss 7.2epss 0.02
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands and obtain root privileges. The vulnerability is due to insufficient validation of user-supplied input…
- risk 0.47cvss 7.2epss 0.04
A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of…
- risk 0.51cvss 7.8epss 0.00
A vulnerability in the command-line interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker with read-only credentials to inject arbitrary commands that could allow them to obtain root privileges. The vulnerability is due to…
- risk 0.47cvss 7.2epss 0.03
A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to cause a denial of service (DoS) condition and implement arbitrary commands with root privileges on an affected device.…
- risk 0.57cvss 8.8epss 0.04
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to…
- risk 0.57cvss 8.8epss 0.03
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. The vulnerability is due to…
- risk 0.53cvss 8.1epss 0.02
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to make unauthorized changes to the system configuration. The vulnerability is due to insufficient authorization…
- risk 0.47cvss 7.2epss 0.04
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on an affected device. An attacker would need to have…
- risk 0.44cvss 6.7epss 0.00
A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes…
- risk 0.47cvss 7.2epss 0.03
A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges on the underlying operating system (OS). The…
- risk 0.35cvss 5.4epss 0.01
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
- risk 0.56cvss 9.6epss 0.02
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user…
- risk 0.35cvss 5.3epss 0.05
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality
- risk 0.49cvss 7.5epss 0.02
The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.
- risk 0.51cvss 7.8epss 0.01
pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropped, aka ZEN-31765.
- risk 0.42cvss 6.5epss 0.02
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.