2019

The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.

The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.

The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.

The simple-membership plugin before 3.5.7 for WordPress has XSS.

The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.

The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.

The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on

The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.

The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.

The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.

The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg()

In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent in

An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open

In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/sp

Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker

The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript

The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request

Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPN

In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the p

OnCommand Insight versions through 7.3.6 may disclose sensitive account information to an authenticated user.

Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hos

A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ve

A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software M

A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.

A remote multiple multiple cross-site vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.

Recommender before 2018-07-18 allows XSS.

studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template

The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversa

The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.

The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows X

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea para

The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.

The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=r

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity

The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslette

The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/a

Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This v

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.p

On Samsung mobile devices with N(7.x), and O(8.x), P(9.0) software, FotaAgent allows a malicious application to create p

Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by