Search
Total
46623 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-6995 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues. | |||||
| CVE-2019-6791 | 1 Gitlab | 1 Gitlab | 2019-09-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility. | |||||
| CVE-2019-16179 | 1 Limesurvey | 1 Limesurvey | 2019-09-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration. | |||||
| CVE-2019-16147 | 1 Liferay | 1 Liferay Portal | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib. | |||||
| CVE-2017-18598 | 1 Designmodo | 1 Qards | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php. | |||||
| CVE-2017-18599 | 1 Pinfinity Project | 1 Pinfinity | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter. | |||||
| CVE-2017-18609 | 1 Magicfields | 1 Magic Fields | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter. | |||||
| CVE-2017-18608 | 1 Spot | 1 Spot.im Comments | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues. | |||||
| CVE-2019-16182 | 1 Limesurvey | 1 Limesurvey | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files. | |||||
| CVE-2019-16178 | 1 Limesurvey | 1 Limesurvey | 2019-09-10 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page. | |||||
| CVE-2019-10670 | 1 Librenms | 1 Librenms | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these contexts, leading to attacker controlled JavaScript executing in the browser. One example of this is the string parameter in html/pages/inventory.inc.php. | |||||
| CVE-2019-16164 | 1 Myhtml Project | 1 Myhtml | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| MyHTML through 4.0.5 has a NULL pointer dereference in myhtml_tree_node_remove in tree.c. | |||||
| CVE-2019-16132 | 1 Phpok | 1 Oklite | 2019-09-10 | 5.5 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote attackers to delete arbitrary files via a title directory-traversal pathname followed by a crafted substring. | |||||
| CVE-2019-16133 | 1 Weaver | 1 Eteams Oa | 2019-09-10 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in eteams OA v4.0.34. Because the session is not strictly checked, the account names and passwords of all employees in the company can be obtained by an ordinary account. Specifically, the attacker sends a jsessionid value for URIs under app/profile/summary/. | |||||
| CVE-2019-16165 | 1 Gnu | 1 Cflow | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| GNU cflow through 1.6 has a use-after-free in the reference function in parser.c. | |||||
| CVE-2019-16166 | 1 Gnu | 1 Cflow | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c. | |||||
| CVE-2019-16148 | 1 Sakailms | 1 Sakai | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Sakai through 12.6 allows XSS via a chat user name. | |||||
| CVE-2017-1000426 | 1 Omniscale | 1 Mapproxy | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure. | |||||
| CVE-2019-16146 | 1 Getgophish | 1 Gophish | 2019-09-10 | 3.5 LOW | 4.8 MEDIUM |
| Gophish through 0.8.0 allows XSS via a username. | |||||
| CVE-2018-21014 | 1 Buddyboss | 1 Buddymoss Media | 2019-09-10 | 3.5 LOW | 5.4 MEDIUM |
| The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS. | |||||
| CVE-2019-9451 | 1 Google | 1 Android | 2019-09-10 | 4.6 MEDIUM | 6.7 MEDIUM |
| In the Android kernel in the touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-15757 | 1 Libmirage Project | 1 Libmirage | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c. | |||||
| CVE-2019-16118 | 1 10web | 1 Photo Gallery | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php. | |||||
| CVE-2019-16117 | 1 10web | 1 Photo Gallery | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php. | |||||
| CVE-2018-18373 | 1 Schiocco | 1 Support Board - Chat And Help Desk | 2019-09-10 | 3.5 LOW | 5.4 MEDIUM |
| In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action. | |||||
| CVE-2015-9383 | 2 Debian, Freetype | 2 Debian Linux, Freetype | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c. | |||||
| CVE-2015-9382 | 2 Debian, Freetype | 2 Debian Linux, Freetype | 2019-09-10 | 4.3 MEDIUM | 6.5 MEDIUM |
| FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. | |||||
| CVE-2019-15833 | 1 Simple Mail Address Encoder Project | 1 Simple Mail Address Encoder | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS. | |||||
| CVE-2017-18539 | 1 Deepsoft | 1 Weblibrarian | 2019-09-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes. | |||||
| CVE-2018-21012 | 1 Vsourz | 1 Cf7 Invisible Recaptcha | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS. | |||||
| CVE-2019-6796 | 1 Gitlab | 1 Gitlab | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS. | |||||
| CVE-2019-10667 | 1 Librenms | 1 Librenms | 2019-09-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths. | |||||
| CVE-2019-16126 | 1 Getgrav | 1 Grav Cms | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images. | |||||
| CVE-2019-16130 | 1 Hgw168cc | 1 Yii-cms | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html. | |||||
| CVE-2019-9866 | 1 Gitlab | 1 Gitlab | 2019-09-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.7.7 and 11.8.x before 11.8.3. It allows Information Disclosure. | |||||
| CVE-2019-9245 | 1 Google | 1 Android | 2019-09-09 | 2.1 LOW | 4.4 MEDIUM |
| In the Android kernel in the f2fs driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-9452 | 1 Google | 1 Android | 2019-09-09 | 2.1 LOW | 4.4 MEDIUM |
| In the Android kernel in SEC_TS touch driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-9454 | 1 Google | 1 Android | 2019-09-09 | 4.6 MEDIUM | 6.7 MEDIUM |
| In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-9248 | 1 Google | 1 Android | 2019-09-09 | 4.6 MEDIUM | 6.7 MEDIUM |
| In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-9271 | 1 Google | 1 Android | 2019-09-09 | 4.4 MEDIUM | 6.4 MEDIUM |
| In the Android kernel in the mnh driver there is a race condition due to insufficient locking. This could lead to a use-after-free which could lead to escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-9426 | 1 Google | 1 Android | 2019-09-09 | 4.6 MEDIUM | 6.7 MEDIUM |
| In the Android kernel in Bluetooth there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-16104 | 1 Silver-peak | 2 Unity Edgeconnect Sd-wan, Unity Edgeconnect Sd-wan Firmware | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Silver Peak EdgeConnect SD-WAN before 8.1.7.x has reflected XSS via the rest/json/configdb/download/ PATH_INFO. | |||||
| CVE-2019-9274 | 1 Google | 1 Android | 2019-09-09 | 4.6 MEDIUM | 6.7 MEDIUM |
| In the Android kernel in the mnh driver there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-15944 | 1 Valvesoftware | 1 Counter-strike\ | 2019-09-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message. | |||||
| CVE-2019-12588 | 1 Espressif | 2 Arduino Esp8266, Esp8266 Nonos Sdk | 2019-09-09 | 3.3 LOW | 6.5 MEDIUM |
| The client 802.11 mac implementation in Espressif ESP8266_NONOS_SDK 2.2.0 through 3.1.0 does not validate correctly the RSN AuthKey suite list count in beacon frames, probe responses, and association responses, which allows attackers in radio range to cause a denial of service (crash) via a crafted message. | |||||
| CVE-2019-10677 | 1 Dasanzhone | 2 Znid Gpon 2426a Eu, Znid Gpon 2426a Eu Firmware | 2019-09-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg). | |||||
| CVE-2019-9444 | 1 Google | 1 Android | 2019-09-09 | 2.1 LOW | 4.4 MEDIUM |
| In the Android kernel in sync debug fs driver there is a kernel pointer leak due to the usage of printf with %p. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-16105 | 1 Silver-peak | 2 Unity Edgeconnect Sd-wan, Unity Edgeconnect Sd-wan Firmware | 2019-09-09 | 4.0 MEDIUM | 4.9 MEDIUM |
| Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows ..%2f directory traversal via a rest/json/configdb/download/ URI. | |||||
| CVE-2019-9448 | 1 Google | 1 Android | 2019-09-09 | 4.6 MEDIUM | 6.7 MEDIUM |
| In the Android kernel in the FingerTipS touchscreen driver there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2019-9449 | 1 Google | 1 Android | 2019-09-09 | 2.1 LOW | 4.4 MEDIUM |
| In the Android kernel in FingerTipS touchscreen driver there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with system execution privileges needed. User interaction is not needed for exploitation. | |||||