2019

Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vu

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component,

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and do

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote

Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges v

Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via

The "HTML Include and replace macro" plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=fal

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacke

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An a

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_AvccAtom class at Core/Ap4A

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the AP4_Dec3Atom class at Core/Ap4D

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer overflow in the AP4_RtpAtom class at Core/Ap4Rtp

An issue was discovered in Bento4 1.5.1.0. There is a heap-based buffer over-read in the function AP4_BitReader::SkipBit

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.

The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.

The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.

The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.

The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.

The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actio

The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.

The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.

The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.

The wp-editor plugin before 1.2.6 for WordPress has CSRF.

The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.

The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.

The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.

The google-document-embedder plugin before 2.6.2 for WordPress has XSS.

The google-document-embedder plugin before 2.6.1 for WordPress has XSS.

The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.

The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.

Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful e

Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exp

Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Succes

Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Succes

Zoho ManageEngine ServiceDesk Plus 10 before 10509 allows unauthenticated sensitive information leakage during Fail Over

The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.

SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.

The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppoll

The newstatpress plugin before 1.0.1 for WordPress has SQL injection.

The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.

The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.

The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.