| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-4294 | Hig | 0.51 | 7.8 | 0.01 | Aug 20, 2019 | IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection… | ||
| CVE-2019-4253 | Hig | 0.51 | 7.8 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local privileged Informix user to load a malicious shared library and gain root access privileges. IBM X-Force ID: 159941. | ||
| CVE-2019-4117 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158116. | ||
| CVE-2019-4049 | Med | 0.36 | 5.5 | 0.00 | Aug 20, 2019 | IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398. | ||
| CVE-2019-3968 | Hig | 0.58 | 8.8 | 0.10 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form. | ||
| CVE-2019-3753 | Med | 0.42 | 6.5 | 0.01 | Aug 20, 2019 | Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with… | ||
| CVE-2019-10745 | Hig | 0.42 | 7.5 | 0.01 | Aug 20, 2019 | assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload. | ||
| CVE-2018-1796 | Hig | 0.51 | 7.8 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user to load malicious libraries and gain root privileges. IBM X-Force ID: 149426. | ||
| CVE-2018-1636 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144441. | ||
| CVE-2018-1635 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144439. | ||
| CVE-2018-1634 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437. | ||
| CVE-2018-1633 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onsrvapd. IBM X-Force ID: 144434. | ||
| CVE-2018-1632 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in .infxdirs. IBM X-Force ID: 144432. | ||
| CVE-2018-1631 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431. | ||
| CVE-2018-1630 | Med | 0.44 | 6.7 | 0.00 | Aug 20, 2019 | IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430. | ||
| CVE-2019-3967 | Med | 0.45 | 6.5 | 0.29 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system. | ||
| CVE-2019-3966 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||
| CVE-2019-3965 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||
| CVE-2019-3964 | Med | 0.44 | 6.1 | 0.53 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||
| CVE-2019-3963 | Med | 0.44 | 6.1 | 0.53 | Aug 20, 2019 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||
| CVE-2019-11209 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition… | ||
| CVE-2018-18056 | Med | 0.30 | 4.6 | 0.00 | Aug 20, 2019 | An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in… | ||
| CVE-2018-20978 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.4.7 for WordPress has XSS. | ||
| CVE-2017-18566 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The user-role plugin before 1.5.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18533 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The rimons-twitter-widget plugin before 1.3 for WordPress has XSS. | ||
| CVE-2017-18532 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The realty plugin before 1.1.0 for WordPress has multiple XSS issues. | ||
| CVE-2017-18531 | Med | 0.33 | 6.1 | 0.01 | Aug 20, 2019 | The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288. | ||
| CVE-2017-18530 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The rating-bws plugin before 0.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18529 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18528 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. | ||
| CVE-2017-18527 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The pagination plugin before 1.0.7 for WordPress has multiple XSS issues. | ||
| CVE-2017-18526 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The moreads-se plugin before 1.4.7 for WordPress has XSS. | ||
| CVE-2017-18524 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues. | ||
| CVE-2017-18523 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book. | ||
| CVE-2017-18522 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book. | ||
| CVE-2017-18519 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages. | ||
| CVE-2017-18518 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. | ||
| CVE-2016-10895 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. | ||
| CVE-2016-10892 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues. | ||
| CVE-2015-9320 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. | ||
| CVE-2015-9319 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser. | ||
| CVE-2019-15238 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field. | ||
| CVE-2017-18569 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | The my-wp-translate plugin before 1.0.4 for WordPress has CSRF. | ||
| CVE-2017-18568 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The my-wp-translate plugin before 1.0.4 for WordPress has XSS. | ||
| CVE-2017-18567 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-all-import plugin before 3.4.6 for WordPress has XSS. | ||
| CVE-2017-18520 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php. | ||
| CVE-2017-18517 | Med | 0.40 | 6.1 | 0.02 | Aug 20, 2019 | The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues. | ||
| CVE-2016-10915 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. | ||
| CVE-2016-10914 | Hig | 0.57 | 8.8 | 0.01 | Aug 20, 2019 | The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. | ||
| CVE-2016-10913 | Med | 0.40 | 6.1 | 0.01 | Aug 20, 2019 | The wp-latest-posts plugin before 3.7.5 for WordPress has XSS. |
- risk 0.51cvss 7.8epss 0.01
IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.6, 7.6.0.0 through 7.6.0.15 and IBM MQ Appliance 8.0.0.0 through 8.0.0.12, 9.1.0.0 through 9.1.0.2, and 9.1.1 through 9.1.2 could allow a local attacker to execute arbitrary commands on the system, caused by a command injection…
- risk 0.51cvss 7.8epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local privileged Informix user to load a malicious shared library and gain root access privileges. IBM X-Force ID: 159941.
- risk 0.57cvss 8.8epss 0.01
IBM Cloud Private 3.1.1 and 3.1.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 158116.
- risk 0.36cvss 5.5epss 0.00
IBM MQ 9.1.0.0, 9.1.0.1, 9.1.1, and 9.1.0.2 is vulnerable to a denial of service due to a local user being able to fill up the disk space of the underlying filesystem using the error logging service. IBM X-Force ID: 156398.
- risk 0.58cvss 8.8epss 0.10
In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.
- risk 0.42cvss 6.5epss 0.01
Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACS\Radius credentials are stored in plain text in the system settings menu. An authenticated malicious user with…
- risk 0.42cvss 7.5epss 0.01
assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into adding or modifying properties of Object.prototype using either a constructor or a _proto_ payload.
- risk 0.51cvss 7.8epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user to load malicious libraries and gain root privileges. IBM X-Force ID: 149426.
- risk 0.44cvss 6.7epss 0.00
Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144441.
- risk 0.44cvss 6.7epss 0.00
Stack-based buffer overflow in oninit in IBM Informix Dynamic Server Enterprise Edition 12.1 allows an authenticated user to execute predefined code with root privileges, such as escalating to a root shell. IBM X-Force ID: 144439.
- risk 0.44cvss 6.7epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437.
- risk 0.44cvss 6.7epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onsrvapd. IBM X-Force ID: 144434.
- risk 0.44cvss 6.7epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in .infxdirs. IBM X-Force ID: 144432.
- risk 0.44cvss 6.7epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431.
- risk 0.44cvss 6.7epss 0.00
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430.
- risk 0.45cvss 6.5epss 0.29
In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.
- risk 0.40cvss 6.1epss 0.01
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- risk 0.40cvss 6.1epss 0.01
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- risk 0.44cvss 6.1epss 0.53
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- risk 0.44cvss 6.1epss 0.53
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
- risk 0.57cvss 8.8epss 0.01
The realm configuration component of TIBCO Software Inc.'s TIBCO FTL Community Edition, TIBCO FTL Developer Edition, TIBCO FTL Enterprise Edition contains a vulnerability that theoretically fails to properly enforce access controls. This issue affects TIBCO FTL Community Edition…
- risk 0.30cvss 4.6epss 0.00
An issue was discovered in the Texas Instruments (TI) TM4C, MSP432E and MSP432P microcontroller series. The eXecute-Only-Memory (XOM) implementation prevents code read-outs on protected memory by generating bus faults. However, single-stepping and using breakpoints is allowed in…
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.4.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
- risk 0.33cvss 6.1epss 0.01
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
- risk 0.40cvss 6.1epss 0.01
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.02
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The moreads-se plugin before 1.4.7 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
- risk 0.57cvss 8.8epss 0.01
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
- risk 0.40cvss 6.1epss 0.01
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
- risk 0.40cvss 6.1epss 0.01
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
- risk 0.40cvss 6.1epss 0.02
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
- risk 0.40cvss 6.1epss 0.01
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
- risk 0.40cvss 6.1epss 0.01
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
- risk 0.57cvss 8.8epss 0.01
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
- risk 0.57cvss 8.8epss 0.01
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
- risk 0.40cvss 6.1epss 0.01
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
- risk 0.40cvss 6.1epss 0.02
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
- risk 0.57cvss 8.8epss 0.01
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
- risk 0.57cvss 8.8epss 0.01
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
- risk 0.40cvss 6.1epss 0.01
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.