| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-9517 | Hig | 0.51 | 7.5 | 0.28 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually… | ||
| CVE-2019-9516 | Med | 0.47 | 6.5 | 0.57 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations… | ||
| CVE-2019-9515 | Hig | 0.56 | 7.5 | 0.87 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame… | ||
| CVE-2019-9514 | Hig | 0.48 | 7.5 | 0.83 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the… | ||
| CVE-2019-9513 | Hig | 0.55 | 7.5 | 0.82 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can… | ||
| CVE-2019-9512 | Hig | 0.48 | 7.5 | 0.83 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can… | ||
| CVE-2019-9511 | Hig | 0.54 | 7.5 | 0.60 | Aug 13, 2019 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size… | ||
| CVE-2019-5299 | Hig | 0.51 | 7.8 | 0.01 | Aug 13, 2019 | Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. Attackers can induce users to install malicious applications. Due to a defect in the signature verification logic, the malicious applications can… | ||
| CVE-2019-5280 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2019 | The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks, leading to the affected… | ||
| CVE-2019-5223 | Hig | 0.51 | 7.8 | 0.01 | Aug 13, 2019 | PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not perform a validation of user-mode data properly, successful exploit could result in malicious code execution. | ||
| CVE-2019-14809 | Cri | 0.64 | 9.8 | 0.08 | Aug 13, 2019 | net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port… | ||
| CVE-2019-12479 | Cri | 0.59 | 9.1 | 0.02 | Aug 13, 2019 | An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating and reading files outside of the specified basepath. If the application using this library does not sanitize… | ||
| CVE-2019-11207 | Hig | 0.57 | 8.8 | 0.01 | Aug 13, 2019 | The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as… | ||
| CVE-2019-14986 | Hig | 0.53 | 8.1 | 0.03 | Aug 13, 2019 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as "Set root password") are exposed. | ||
| CVE-2019-14985 | Cri | 0.64 | 9.8 | 0.08 | Aug 13, 2019 | eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28. | ||
| CVE-2019-14984 | Hig | 0.53 | 8.1 | 0.06 | Aug 13, 2019 | eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request. | ||
| CVE-2019-12808 | Hig | 0.51 | 7.8 | 0.00 | Aug 13, 2019 | ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges. | ||
| CVE-2019-12807 | Hig | 0.51 | 7.8 | 0.02 | Aug 13, 2019 | Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing of crafted ISO archive file format. By persuading a victim to open a specially-crafted ISO archive file, an attacker could execution… | ||
| CVE-2019-12806 | Hig | 0.58 | 8.8 | 0.04 | Aug 13, 2019 | UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, due to a buffer overflow in a library. That leads remote attacker to execute arbitrary code via crafted https packets. | ||
| CVE-2019-13416 | Med | 0.42 | 6.5 | 0.01 | Aug 13, 2019 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s). | ||
| CVE-2019-13415 | Med | 0.42 | 6.5 | 0.01 | Aug 13, 2019 | Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see. | ||
| CVE-2019-10943 | Hig | 0.49 | 7.5 | 0.01 | Aug 13, 2019 | A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC… | ||
| CVE-2019-10942 | Hig | 0.56 | 8.6 | 0.01 | Aug 13, 2019 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X204RNA (HSR) (All versions), SCALANCE X204RNA (PRP) (All… | ||
| CVE-2019-10929 | Med | 0.38 | 5.9 | 0.01 | Aug 13, 2019 | A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC HMI Panel (incl.… | ||
| CVE-2019-10928 | Med | 0.43 | 6.6 | 0.00 | Aug 13, 2019 | A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by… | ||
| CVE-2019-10927 | Med | 0.42 | 6.5 | 0.01 | Aug 13, 2019 | A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may… | ||
| CVE-2019-14993 | Hig | 0.42 | 7.5 | 0.02 | Aug 13, 2019 | Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API. | ||
| CVE-2017-18488 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. | ||
| CVE-2017-18487 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues. | ||
| CVE-2016-10867 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. | ||
| CVE-2016-10866 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues. | ||
| CVE-2018-20964 | Hig | 0.57 | 8.8 | 0.01 | Aug 13, 2019 | The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF. | ||
| CVE-2018-20963 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-to-email plugin before 1.2.66 for WordPress has XSS. | ||
| CVE-2017-18507 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS. | ||
| CVE-2017-18498 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. | ||
| CVE-2017-18497 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The liveforms plugin before 3.4.0 for WordPress has XSS. | ||
| CVE-2017-18496 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18495 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS. | ||
| CVE-2017-18494 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. | ||
| CVE-2017-18493 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues. | ||
| CVE-2017-18492 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. | ||
| CVE-2017-18491 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. | ||
| CVE-2017-18490 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues. | ||
| CVE-2017-18489 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS. | ||
| CVE-2016-10871 | Med | 0.33 | 6.1 | 0.01 | Aug 13, 2019 | The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page. | ||
| CVE-2016-10870 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The google-language-translator plugin before 5.0.06 for WordPress has XSS. | ||
| CVE-2016-10869 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The contact-form-plugin plugin before 4.0.2 for WordPress has XSS. | ||
| CVE-2016-10868 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages. | ||
| CVE-2015-9302 | Med | 0.40 | 6.1 | 0.01 | Aug 13, 2019 | The simple-fields plugin before 1.4.11 for WordPress has XSS. | ||
| CVE-2015-9301 | Cri | 0.64 | 9.8 | 0.02 | Aug 13, 2019 | The liveforms plugin before 3.2.0 for WordPress has SQL injection. |
- risk 0.51cvss 7.5epss 0.28
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually…
- risk 0.47cvss 6.5epss 0.57
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations…
- risk 0.56cvss 7.5epss 0.87
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame…
- risk 0.48cvss 7.5epss 0.83
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the…
- risk 0.55cvss 7.5epss 0.82
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can…
- risk 0.48cvss 7.5epss 0.83
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can…
- risk 0.54cvss 7.5epss 0.60
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size…
- risk 0.51cvss 7.8epss 0.01
Huawei mobile phones Hima-AL00Bhave with Versions earlier than HMA-AL00C00B175 have a signature verification bypass vulnerability. Attackers can induce users to install malicious applications. Due to a defect in the signature verification logic, the malicious applications can…
- risk 0.42cvss 6.5epss 0.00
The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specific parameters of the TLS server certificate, attackers can perform man-in-the-middle attacks, leading to the affected…
- risk 0.51cvss 7.8epss 0.01
PCManager 9.1.3.1 has an improper authentication vulnerability. The certain driver interface of the software does not perform a validation of user-mode data properly, successful exploit could result in malicious code execution.
- risk 0.64cvss 9.8epss 0.08
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port…
- risk 0.59cvss 9.1epss 0.02
An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvider allows creating and reading files outside of the specified basepath. If the application using this library does not sanitize…
- risk 0.57cvss 8.8epss 0.01
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as…
- risk 0.53cvss 8.1epss 0.03
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn before 2.3.0 installed allow administrative operations by unauthenticated attackers with access to the web interface, because features such as File-Browser and Shell Command (as well as "Set root password") are exposed.
- risk 0.64cvss 9.8epss 0.08
eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because this interface can access the CMD_EXEC virtual device type 28.
- risk 0.53cvss 8.1epss 0.06
eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface, because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.
- risk 0.51cvss 7.8epss 0.00
ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges.
- risk 0.51cvss 7.8epss 0.02
Alzip 10.83 and earlier version contains a stack-based buffer overflow vulnerability, caused by improper bounds checking during the parsing of crafted ISO archive file format. By persuading a victim to open a specially-crafted ISO archive file, an attacker could execution…
- risk 0.58cvss 8.8epss 0.04
UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack with arbitrary data, due to a buffer overflow in a library. That leads remote attacker to execute arbitrary code via crafted https packets.
- risk 0.42cvss 6.5epss 0.01
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).
- risk 0.42cvss 6.5epss 0.01
Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users can gain read access to data they are not authorized to see.
- risk 0.49cvss 7.5epss 0.01
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC…
- risk 0.56cvss 8.6epss 0.01
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X204RNA (HSR) (All versions), SCALANCE X204RNA (PRP) (All…
- risk 0.38cvss 5.9epss 0.01
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8), SIMATIC HMI Panel (incl.…
- risk 0.43cvss 6.6epss 0.00
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by…
- risk 0.42cvss 6.5epss 0.01
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may…
- risk 0.42cvss 7.5epss 0.02
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
- risk 0.40cvss 6.1epss 0.01
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
- risk 0.57cvss 8.8epss 0.01
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
- risk 0.40cvss 6.1epss 0.01
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
- risk 0.40cvss 6.1epss 0.01
The liveforms plugin before 3.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
- risk 0.40cvss 6.1epss 0.01
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
- risk 0.33cvss 6.1epss 0.01
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
- risk 0.40cvss 6.1epss 0.01
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
- risk 0.40cvss 6.1epss 0.01
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
- risk 0.40cvss 6.1epss 0.01
The simple-fields plugin before 1.4.11 for WordPress has XSS.
- risk 0.64cvss 9.8epss 0.02
The liveforms plugin before 3.2.0 for WordPress has SQL injection.