| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-14245 | Med | 0.42 | 6.5 | 0.02 | Aug 21, 2019 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account. | ||
| CVE-2019-13599 | Med | 0.35 | 5.3 | 0.04 | Aug 21, 2019 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times. | ||
| CVE-2019-13477 | Hig | 0.57 | 8.8 | 0.01 | Aug 21, 2019 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account. | ||
| CVE-2019-12634 | Hig | 0.49 | 7.5 | 0.02 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The… | ||
| CVE-2019-12627 | Hig | 0.49 | 7.5 | 0.01 | Aug 21, 2019 | A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to insufficient application identification.… | ||
| CVE-2019-12626 | Med | 0.31 | 4.8 | 0.01 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected… | ||
| CVE-2019-12624 | Hig | 0.62 | 8.8 | 0.18 | Aug 21, 2019 | A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The… | ||
| CVE-2018-20977 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page. | ||
| CVE-2018-20970 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues. | ||
| CVE-2017-18562 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18561 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The embed-comment-images plugin before 0.6 for WordPress has XSS. | ||
| CVE-2017-18559 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues. | ||
| CVE-2017-18535 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The smokesignal plugin before 1.2.7 for WordPress has XSS. | ||
| CVE-2017-18525 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The megamenu plugin before 2.4 for WordPress has XSS. | ||
| CVE-2017-18521 | Hig | 0.57 | 8.8 | 0.01 | Aug 21, 2019 | The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n. | ||
| CVE-2017-18516 | Med | 0.40 | 6.1 | 0.02 | Aug 21, 2019 | The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues. | ||
| CVE-2016-10891 | Med | 0.33 | 6.1 | 0.01 | Aug 21, 2019 | The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. | ||
| CVE-2016-10890 | Med | 0.33 | 6.1 | 0.01 | Aug 21, 2019 | The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. | ||
| CVE-2014-10379 | Cri | 0.64 | 9.8 | 0.02 | Aug 21, 2019 | The duplicate-post plugin before 2.6 for WordPress has SQL injection. | ||
| CVE-2014-10378 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The duplicate-post plugin before 2.6 for WordPress has XSS. | ||
| CVE-2014-10377 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php. | ||
| CVE-2012-6714 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The count-per-day plugin before 3.2.3 for WordPress has XSS via search words. | ||
| CVE-2019-5041 | Hig | 0.57 | 8.8 | 0.03 | Aug 21, 2019 | An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow, resulting in remote code execution. An attacker needs to provide… | ||
| CVE-2019-5033 | Hig | 0.57 | 8.8 | 0.03 | Aug 21, 2019 | An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim… | ||
| CVE-2019-5032 | Hig | 0.57 | 8.8 | 0.03 | Aug 21, 2019 | An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the… | ||
| CVE-2019-15295 | Hig | 0.51 | 7.8 | 0.01 | Aug 21, 2019 | An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the search path. | ||
| CVE-2019-12623 | Med | 0.28 | 4.3 | 0.01 | Aug 21, 2019 | A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server… | ||
| CVE-2019-12622 | Med | 0.36 | 5.5 | 0.00 | Aug 21, 2019 | A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could exploit this… | ||
| CVE-2019-12621 | Hig | 0.48 | 7.4 | 0.00 | Aug 21, 2019 | A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the… | ||
| CVE-2019-11897 | Hig | 0.56 | 8.6 | 0.02 | Aug 21, 2019 | A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially… | ||
| CVE-2019-11551 | Med | 0.36 | 5.5 | 0.00 | Aug 21, 2019 | In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write. | ||
| CVE-2017-18564 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The sender plugin before 1.2.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18563 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen. | ||
| CVE-2016-10912 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The universal-analytics plugin before 1.3.1 for WordPress has XSS. | ||
| CVE-2016-10911 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. | ||
| CVE-2016-10910 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The formbuilder plugin before 1.06 for WordPress has multiple XSS issues. | ||
| CVE-2015-9328 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The profile-builder plugin before 2.2.5 for WordPress has XSS. | ||
| CVE-2015-9327 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. | ||
| CVE-2014-10380 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. | ||
| CVE-2012-6715 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header. | ||
| CVE-2019-3634 | Med | 0.36 | 5.5 | 0.00 | Aug 21, 2019 | Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory. | ||
| CVE-2019-3633 | Med | 0.36 | 5.5 | 0.00 | Aug 21, 2019 | Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading… | ||
| CVE-2019-13458 | Med | 0.42 | 6.5 | 0.02 | Aug 21, 2019 | An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in… | ||
| CVE-2019-12746 | Med | 0.42 | 6.5 | 0.02 | Aug 21, 2019 | An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties.… | ||
| CVE-2019-15112 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The wp-slimstat plugin before 4.8.1 for WordPress has XSS. | ||
| CVE-2019-15111 | Cri | 0.64 | 9.8 | 0.02 | Aug 21, 2019 | The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue. | ||
| CVE-2019-15110 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS. | ||
| CVE-2017-18565 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The updater plugin before 1.35 for WordPress has multiple XSS issues. | ||
| CVE-2017-18560 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The content-audit plugin before 1.9.2 for WordPress has XSS. | ||
| CVE-2017-18558 | Med | 0.40 | 6.1 | 0.01 | Aug 21, 2019 | The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues. |
- risk 0.42cvss 6.5epss 0.02
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.
- risk 0.35cvss 5.3epss 0.04
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.
- risk 0.57cvss 8.8epss 0.01
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.
- risk 0.49cvss 7.5epss 0.02
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The…
- risk 0.49cvss 7.5epss 0.01
A vulnerability in the application policy configuration of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data. The vulnerability is due to insufficient application identification.…
- risk 0.31cvss 4.8epss 0.01
A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected…
- risk 0.62cvss 8.8epss 0.18
A vulnerability in the web-based management interface of Cisco IOS XE New Generation Wireless Controller (NGWC) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The…
- risk 0.40cvss 6.1epss 0.01
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.
- risk 0.40cvss 6.1epss 0.01
The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The embed-comment-images plugin before 0.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The smokesignal plugin before 1.2.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The megamenu plugin before 2.4 for WordPress has XSS.
- risk 0.57cvss 8.8epss 0.01
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
- risk 0.40cvss 6.1epss 0.02
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
- risk 0.33cvss 6.1epss 0.01
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
- risk 0.33cvss 6.1epss 0.01
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
- risk 0.64cvss 9.8epss 0.02
The duplicate-post plugin before 2.6 for WordPress has SQL injection.
- risk 0.40cvss 6.1epss 0.01
The duplicate-post plugin before 2.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
- risk 0.40cvss 6.1epss 0.01
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.
- risk 0.57cvss 8.8epss 0.03
An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow, resulting in remote code execution. An attacker needs to provide…
- risk 0.57cvss 8.8epss 0.03
An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim…
- risk 0.57cvss 8.8epss 0.03
An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the…
- risk 0.51cvss 7.8epss 0.01
An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the search path.
- risk 0.28cvss 4.3epss 0.01
A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server…
- risk 0.36cvss 5.5epss 0.00
A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could exploit this…
- risk 0.48cvss 7.4epss 0.00
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the…
- risk 0.56cvss 8.6epss 0.02
A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially…
- risk 0.36cvss 5.5epss 0.00
In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write.
- risk 0.40cvss 6.1epss 0.01
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
- risk 0.40cvss 6.1epss 0.01
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The profile-builder plugin before 2.2.5 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
- risk 0.40cvss 6.1epss 0.01
The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
- risk 0.36cvss 5.5epss 0.00
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.
- risk 0.36cvss 5.5epss 0.00
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading…
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in…
- risk 0.42cvss 6.5epss 0.02
An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties.…
- risk 0.40cvss 6.1epss 0.01
The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
- risk 0.64cvss 9.8epss 0.02
The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
- risk 0.40cvss 6.1epss 0.01
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The updater plugin before 1.35 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The content-audit plugin before 1.9.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.