| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-5398 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. | ||
| CVE-2019-5397 | Cri | 0.61 | 9.4 | 0.04 | Aug 9, 2019 | A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. | ||
| CVE-2019-12257 | Hig | 0.64 | 8.8 | 0.84 | Aug 9, 2019 | Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc. | ||
| CVE-2019-12256 | Cri | 0.66 | 9.8 | 0.27 | Aug 9, 2019 | Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options. | ||
| CVE-2019-5396 | Cri | 0.62 | 9.4 | 0.05 | Aug 9, 2019 | A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. | ||
| CVE-2019-5395 | Hig | 0.57 | 8.8 | 0.02 | Aug 9, 2019 | A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1. | ||
| CVE-2019-12805 | Hig | 0.57 | 8.8 | 0.03 | Aug 9, 2019 | NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target must visit a… | ||
| CVE-2017-18486 | Hig | 0.47 | 7.2 | 0.05 | Aug 9, 2019 | Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the… | ||
| CVE-2018-20858 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | Recommender before 2018-07-18 allows XSS. | ||
| CVE-2019-14806 | Hig | 0.42 | 7.5 | 0.02 | Aug 9, 2019 | Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id. | ||
| CVE-2019-14805 | Med | 0.31 | 4.8 | 0.01 | Aug 9, 2019 | studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing. | ||
| CVE-2019-14804 | Med | 0.34 | 4.8 | 0.03 | Aug 9, 2019 | studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing. | ||
| CVE-2019-14801 | Cri | 0.64 | 9.8 | 0.02 | Aug 9, 2019 | The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. | ||
| CVE-2019-14798 | Med | 0.32 | 4.9 | 0.04 | Aug 9, 2019 | The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter. | ||
| CVE-2019-14797 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS. | ||
| CVE-2019-14796 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter. | ||
| CVE-2019-14794 | Hig | 0.49 | 7.5 | 0.01 | Aug 9, 2019 | The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders. | ||
| CVE-2019-14791 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. | ||
| CVE-2019-14799 | Med | 0.40 | 6.1 | 0.02 | Aug 9, 2019 | The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS. | ||
| CVE-2019-14793 | Med | 0.42 | 6.5 | 0.02 | Aug 9, 2019 | The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter. | ||
| CVE-2019-14792 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter. | ||
| CVE-2019-14787 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. | ||
| CVE-2019-14785 | Med | 0.35 | 5.4 | 0.01 | Aug 9, 2019 | The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter. | ||
| CVE-2019-14312 | Med | 0.47 | 6.5 | 0.21 | Aug 9, 2019 | Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI. | ||
| CVE-2019-14234 | Cri | 0.61 | 9.8 | 0.48 | Aug 9, 2019 | An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField,… | ||
| CVE-2016-10865 | Med | 0.40 | 6.1 | 0.01 | Aug 9, 2019 | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS. | ||
| CVE-2019-14783 | Med | 0.36 | 5.5 | 0.00 | Aug 8, 2019 | On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764. | ||
| CVE-2018-20960 | Hig | 0.53 | 8.1 | 0.01 | Aug 8, 2019 | Nespresso Prodigio devices lack Bluetooth connection security. | ||
| CVE-2018-20957 | Hig | 0.57 | 8.8 | 0.01 | Aug 8, 2019 | The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks. | ||
| CVE-2018-20956 | Med | 0.36 | 5.5 | 0.00 | Aug 8, 2019 | Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31. | ||
| CVE-2018-20955 | Cri | 0.64 | 9.8 | 0.02 | Aug 8, 2019 | Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31. | ||
| CVE-2018-20954 | Hig | 0.49 | 7.5 | 0.01 | Aug 8, 2019 | The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys. | ||
| CVE-2017-18485 | Med | 0.35 | 5.4 | 0.00 | Aug 8, 2019 | Cognitoys Dino devices allow profiles_add.html CSRF. | ||
| CVE-2017-18484 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | Cognitoys Dino devices allow XSS via the SSID. | ||
| CVE-2016-10863 | Hig | 0.57 | 8.8 | 0.01 | Aug 8, 2019 | Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure. | ||
| CVE-2016-10862 | Hig | 0.57 | 8.8 | 0.01 | Aug 8, 2019 | Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page. | ||
| CVE-2015-9292 | Hig | 0.57 | 8.8 | 0.01 | Aug 8, 2019 | 6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter). | ||
| CVE-2019-14774 | Med | 0.40 | 6.1 | 0.01 | Aug 8, 2019 | The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter. | ||
| CVE-2019-14773 | Hig | 0.49 | 7.5 | 0.02 | Aug 8, 2019 | admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion. | ||
| CVE-2019-14683 | Med | 0.37 | 5.7 | 0.01 | Aug 8, 2019 | The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF. | ||
| CVE-2019-14682 | Med | 0.28 | 4.3 | 0.01 | Aug 8, 2019 | The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF. | ||
| CVE-2019-14681 | Hig | 0.57 | 8.8 | 0.01 | Aug 8, 2019 | The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF. | ||
| CVE-2019-14680 | Med | 0.37 | 5.7 | 0.01 | Aug 8, 2019 | The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF. | ||
| CVE-2019-14679 | Med | 0.42 | 6.5 | 0.01 | Aug 8, 2019 | core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. | ||
| CVE-2018-20962 | Med | 0.33 | 6.1 | 0.01 | Aug 8, 2019 | The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type. | ||
| CVE-2019-14353 | Med | 0.27 | 4.2 | 0.00 | Aug 8, 2019 | On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the… | ||
| CVE-2019-14693 | Hig | 0.56 | 8.5 | 0.04 | Aug 8, 2019 | Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | ||
| CVE-2019-12994 | Cri | 0.60 | 9.1 | 0.04 | Aug 8, 2019 | Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL. | ||
| CVE-2019-12959 | Hig | 0.57 | 8.8 | 0.03 | Aug 8, 2019 | Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter. | ||
| CVE-2019-12397 | Med | 0.40 | 6.1 | 0.03 | Aug 8, 2019 | Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix. |
- risk 0.35cvss 5.4epss 0.01
A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
- risk 0.61cvss 9.4epss 0.04
A remote bypass of security restrictions vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
- risk 0.64cvss 8.8epss 0.84
Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
- risk 0.66cvss 9.8epss 0.27
Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
- risk 0.62cvss 9.4epss 0.05
A remote authentication bypass vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
- risk 0.57cvss 8.8epss 0.02
A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.
- risk 0.57cvss 8.8epss 0.03
NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target must visit a…
- risk 0.47cvss 7.2epss 0.05
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the…
- risk 0.40cvss 6.1epss 0.01
Recommender before 2018-07-18 allows XSS.
- risk 0.42cvss 7.5epss 0.02
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
- risk 0.31cvss 4.8epss 0.01
studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.
- risk 0.34cvss 4.8epss 0.03
studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.
- risk 0.64cvss 9.8epss 0.02
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.
- risk 0.32cvss 4.9epss 0.04
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcode_bwg tagtext parameter.
- risk 0.35cvss 5.4epss 0.01
The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.
- risk 0.35cvss 5.4epss 0.01
The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.
- risk 0.49cvss 7.5epss 0.01
The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.
- risk 0.40cvss 6.1epss 0.01
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
- risk 0.40cvss 6.1epss 0.02
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.
- risk 0.42cvss 6.5epss 0.02
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.
- risk 0.35cvss 5.4epss 0.01
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.
- risk 0.35cvss 5.4epss 0.01
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter.
- risk 0.35cvss 5.4epss 0.01
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
- risk 0.47cvss 6.5epss 0.21
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.
- risk 0.61cvss 9.8epss 0.48
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField,…
- risk 0.40cvss 6.1epss 0.01
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
- risk 0.36cvss 5.5epss 0.00
On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create privileged files. The Samsung ID is SVE-2019-14764.
- risk 0.53cvss 8.1epss 0.01
Nespresso Prodigio devices lack Bluetooth connection security.
- risk 0.57cvss 8.8epss 0.01
The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.
- risk 0.36cvss 5.5epss 0.00
Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31.
- risk 0.64cvss 9.8epss 0.02
Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31.
- risk 0.49cvss 7.5epss 0.01
The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.
- risk 0.35cvss 5.4epss 0.00
Cognitoys Dino devices allow profiles_add.html CSRF.
- risk 0.40cvss 6.1epss 0.01
Cognitoys Dino devices allow XSS via the SSID.
- risk 0.57cvss 8.8epss 0.01
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
- risk 0.57cvss 8.8epss 0.01
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
- risk 0.57cvss 8.8epss 0.01
6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
- risk 0.40cvss 6.1epss 0.01
The woo-variation-swatches (aka Variation Swatches for WooCommerce) plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter.
- risk 0.49cvss 7.5epss 0.02
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion.
- risk 0.37cvss 5.7epss 0.01
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acui_delete_attachment CSRF.
- risk 0.28cvss 4.3epss 0.01
The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
- risk 0.57cvss 8.8epss 0.01
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
- risk 0.37cvss 5.7epss 0.01
The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
- risk 0.42cvss 6.5epss 0.01
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
- risk 0.33cvss 6.1epss 0.01
The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
- risk 0.27cvss 4.2epss 0.00
On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the…
- risk 0.56cvss 8.5epss 0.04
Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing license XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
- risk 0.60cvss 9.1epss 0.04
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version 6.2.0 for the AJaxServlet servlet via a parameter in a URL.
- risk 0.57cvss 8.8epss 0.03
Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet servlet via a URL in a parameter.
- risk 0.40cvss 6.1epss 0.03
Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.