2019

The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.

The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.

The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.

The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.

The liveforms plugin before 3.4.0 for WordPress has XSS.

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.

The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.

The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.

The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.

The google-language-translator plugin before 5.0.06 for WordPress has XSS.

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.

The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and fil

The simple-fields plugin before 1.4.11 for WordPress has XSS.

The liveforms plugin before 3.2.0 for WordPress has SQL injection.

The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.

The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.

The events-manager plugin before 5.6 for WordPress has code injection.

The events-manager plugin before 5.6 for WordPress has XSS.

The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.

The contact-form-plugin plugin before 3.96 for WordPress has XSS.

The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg

The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.

The contact-form-plugin plugin before 3.52 for WordPress has XSS.

The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.

The login.jsp resource in Jira before version 7.13.4, and from version 8.0.0 before version 8.2.2 allows remote attacker

NVIDIA Shield TV Experience prior to v8.0, contains a vulnerability in the custom NVIDIA API used in the mount system se

Search Guard versions before 21.0 had an timing side channel issue when using the internal user database.

Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked.

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks agains

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an att

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.

In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpim

In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftIma

In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob fu

On BC Vault devices, a side channel for the row-based SSD1309 OLED display was found. The power consumption of each row-

iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.

Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized.

Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fie

Netwrix Auditor before 9.8 has insecure permissions on %PROGRAMDATA%\Netwrix Auditor\Logs\ActiveDirectory\ and sub-folde

An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action.

An issue was discovered in Frappe Framework 10, 11 before 11.1.46, and 12. There exists an XSS vulnerability.