2019

The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.

The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.

The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.

The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.

Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability. Successful exploitation coul

Creative Cloud Desktop Application versions 4.6.1 and earlier have a using components with known vulnerabilities vulnera

Creative Cloud Desktop Application versions 4.6.1 and earlier have an insecure inherited permissions vulnerability. Succ

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Rub

The note-press plugin before 0.1.2 for WordPress has SQL injection.

The olimometer plugin before 2.57 for WordPress has SQL injection.

The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.

The visitors-online plugin before 0.4 for WordPress has SQL injection.

filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary fil

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera

An issue was discovered in Zoho ManageEngine OpManager in builds before 14310. One can bypass the user password requirem

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitra

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitra

The COSPAS-SARSAT protocol allows remote attackers to forge messages, replay encrypted messages, conduct denial of servi

An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of

In ClickHouse before 18.10.3, unixODBC allowed loading arbitrary shared objects from the file system which led to a Remo

Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database.

Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitat

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Met

eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an

A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted pac

A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets. A

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memo

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an

A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an

stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information

An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via t

The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentic

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP respon

The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If th

Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vu

A potential authorization bypass issue was found in Micro Focus Self Service Password Reset (SSPR) versions prior to: 4.

The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.

The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.

The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.

The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.

The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.

The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.

The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppoll

The newstatpress plugin before 1.0.1 for WordPress has SQL injection.

The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.

A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator Sy