2019

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback abo

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.ex

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, l

Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated adm

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter,

A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith

An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices

An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwi

An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from B

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.

The ad-inserter plugin before 2.4.20 for WordPress has path traversal.

The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay

The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.

The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or use

The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.

The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.

The ebook-download plugin before 1.2 for WordPress has directory traversal.

The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.

The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJ

The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.

The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.

The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.

The reflex-gallery plugin before 1.4.3 for WordPress has XSS.

The tubepress plugin before 1.6.5 for WordPress has XSS.

The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.

The give plugin before 2.4.7 for WordPress has XSS via a donor name.

tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the inter

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library a

The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Expo

The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.

The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in