2019

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection.

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. A server side template injection (SSTI) issue e

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.

The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanis

The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.

The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.

The ultimate-member plugin before 2.0.54 for WordPress has XSS.

The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.

The ultimate-member plugin before 2.0.4 for WordPress has XSS.

The twitter-plugin plugin before 2.55 for WordPress has XSS.

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.

The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.

The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.

The simple-membership plugin before 3.5.7 for WordPress has XSS.

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.

The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.

The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg()

The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates'

In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent in

An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open

3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation direc

An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value,

Bagisto 0.1.5 allows CSRF under /admin URIs.

An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExt

On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-b

On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each ro

On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of e

In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/sp

Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET se

Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vuln

Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: Do

Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TC

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators an