2019

Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of

A vulnerability in the web-based interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker t

A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote

An issue was discovered in servletcontroller in the secure portal in Publisure 2.1.2. One can bypass authentication and

IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A use

The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on w

SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 chara

SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.

SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other

A CWE-863: Incorrect Authorization vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-

A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all version

A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a poss

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the fil

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbit

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site scripting. This vulner

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys

IBM Cloud Application Performance Management 8.1.4 could allow a remote attacker to hijack the clicking action of the vi

3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this infor

A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attack

Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of

A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web

The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from

The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.

The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption,

The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_

The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.

The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of e

The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_

The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.

The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.

The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.

The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.

The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.

OpenEMR v5.0.1-6 allows XSS.

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an a

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not bei

An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improv

An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, c

An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch nam