2019

Advantech WebAccess/HMI Designer 2.1.9.31 has a User Mode Write AV starting at MSVCR90!memcpy+0x000000000000015c.

In Advantech WebAccess/HMI Designer 2.1.9.31, Data from a Faulting Address controls Code Flow starting at PM_V3!CTagInfo

The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=micro

The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.

The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page

The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-

The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=

The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?actio

The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opan

The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=mult

The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields

The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?

The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?a

The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_p

The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.

The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.

The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.

The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.

The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.

The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?

The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-download

The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.

The Postmatic plugin before 1.4.6 for WordPress has XSS.

The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.

The Text-to-speech Engine (aka SamsungTTS) application before 3.0.02.7 and 3.0.00.101 for Android allows a local attacke

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML int

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the unco

Halo 1.1.0 has XSS via a crafted authorUrl in JSON data to api/content/posts/comments.

A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco NX-OS Software could allow an aut

A vulnerability in a CLI command related to the virtualization manager (VMAN) in Cisco IOS XR Software for Cisco ASR 900

A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker with physical ac

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on

A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker within the IOx G

A vulnerability in the RADIUS Change of Authorization (CoA) code of Cisco TrustSec, a feature within Cisco IOS XE Softwa

A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote at

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to cond

A vulnerability in the Guest Shell of Cisco IOS XE Software could allow an authenticated, local attacker to perform dire

A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attac

A vulnerability in the Dialer interface feature for ISDN connections in Cisco IOS XE Software for Cisco 4000 Series Inte

A vulnerability in the Cisco TrustSec (CTS) Protected Access Credential (PAC) provisioning module of Cisco IOS XE Softwa

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with vali

A vulnerability in a Virtualization Manager (VMAN) related CLI command of Cisco IOS XE Software could allow an authentic

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to write values to the

A vulnerability in the HTTP server code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to caus

A vulnerability in the filesystem resource management code of Cisco IOS XE Software could allow an unauthenticated, remo

A vulnerability in Unified Threat Defense (UTD) in Cisco IOS XE Software could allow an unauthenticated, remote attacker

A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote at

A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT), NAT

A vulnerability in the common Session Initiation Protocol (SIP) library of Cisco IOS and IOS XE Software could allow an

A vulnerability in the Raw Socket Transport feature of Cisco IOS XE Software could allow an unauthenticated, remote atta