2019

A cryptographic issue in OpenPGP.js <=4.2.0 allows an attacker who is able provide forged messages and gain feedback abo

Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow

An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices

An insecure storage of sensitive information vulnerability is present in Hickory Smart for iOS mobile devices from Belwi

An insecure storage of sensitive information vulnerability is present in Hickory Smart for Android mobile devices from B

The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.

The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.

The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.

The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.

The reflex-gallery plugin before 1.4.3 for WordPress has XSS.

The tubepress plugin before 1.6.5 for WordPress has XSS.

The give plugin before 2.4.7 for WordPress has XSS via a donor name.

tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting

The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library a

The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

The gnucommerce plugin before 1.4.2 for WordPress has XSS.

The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.

The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a di

The clean-login plugin before 1.5.1 for WordPress has reflected XSS.

The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.

The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.

The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.

The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.

The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.

The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API te

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to

Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch Io

A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an auth

A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorize

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on

REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data im

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete d

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a usern

A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow

The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.

The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.

The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.

The embed-comment-images plugin before 0.6 for WordPress has XSS.

The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.

The smokesignal plugin before 1.2.7 for WordPress has XSS.

The megamenu plugin before 2.4 for WordPress has XSS.

The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.

The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.