2019

Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 an

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.

The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.

Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.

deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into add

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked in

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep coul

Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.

openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.

openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.

drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via crafted USB d

drivers/net/wireless/rsi/rsi_91x_usb.c in the Linux kernel through 5.2.9 has a Double Free via crafted USB device traffi

The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.

The email-newsletter plugin through 20.15 for WordPress has SQL injection.

The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.

The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the auto-update feature of IDVRUpdateService2 in DVRServer.ex

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Mirasys.Common.Utils.Security.DataCrypt method in Common.

The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.

The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay

The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.

The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or use

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.

The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.

The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.

The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.

The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.

The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Expo

The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulner

The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download En

The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.

The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different v

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CV

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.

The cforms2 plugin before 14.6.10 for WordPress has SQL injection.

A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log file

KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?m

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco