Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-16721 | 1 5none | 1 Nonecms | 2019-09-23 | 5.8 MEDIUM | 6.5 MEDIUM |
| NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user. | |||||
| CVE-2019-16720 | 1 Zzzcms | 1 Zzzphp | 2019-09-23 | 5.0 MEDIUM | 7.5 HIGH |
| ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file. | |||||
| CVE-2018-18381 | 1 Zblogcn | 1 Z-blogphp | 2019-09-23 | 3.5 LOW | 5.4 MEDIUM |
| Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments. | |||||
| CVE-2010-0287 | 1 Dokuwiki | 1 Dokuwiki | 2019-09-23 | 5.0 MEDIUM | N/A |
| Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter. | |||||
| CVE-2010-0288 | 1 Dokuwiki | 1 Dokuwiki | 2019-09-23 | 7.5 HIGH | N/A |
| A typo in the administrator permission check in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to gain privileges and access closed wikis by editing current ACL statements, as demonstrated in the wild in January 2010. | |||||
| CVE-2010-0289 | 1 Dokuwiki | 1 Dokuwiki | 2019-09-23 | 6.8 MEDIUM | N/A |
| Multiple cross-site request forgery (CSRF) vulnerabilities in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25c allow remote attackers to hijack the authentication of administrators for requests that modify access control rules, and other unspecified requests, via unknown vectors. | |||||
| CVE-2019-16703 | 1 Phpmywind | 1 Phpmywind | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| admin/infolist_add.php in PHPMyWind 5.6 has stored XSS. | |||||
| CVE-2019-16696 | 1 Phpipam | 1 Phpipam | 2019-09-23 | 7.5 HIGH | 9.8 CRITICAL |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used. | |||||
| CVE-2019-16694 | 1 Phpipam | 1 Phpipam | 2019-09-23 | 7.5 HIGH | 9.8 CRITICAL |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used. | |||||
| CVE-2019-16695 | 1 Phpipam | 1 Phpipam | 2019-09-23 | 7.5 HIGH | 9.8 CRITICAL |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used. | |||||
| CVE-2019-16693 | 1 Phpipam | 1 Phpipam | 2019-09-23 | 7.5 HIGH | 9.8 CRITICAL |
| phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used. | |||||
| CVE-2019-11327 | 1 Topcon | 2 Net-g5, Net-g5 Firmware | 2019-09-23 | 4.0 MEDIUM | 4.9 MEDIUM |
| An issue was discovered on Topcon Positioning Net-G5 GNSS Receiver devices with firmware 5.2.2. The web interface of the product has a local file inclusion vulnerability. An attacker with administrative privileges can craft a special URL to read arbitrary files from the device's files system. | |||||
| CVE-2015-9388 | 1 Mtouch Quiz Project | 1 Mtouch Quiz | 2019-09-23 | 4.3 MEDIUM | 6.5 MEDIUM |
| The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. | |||||
| CVE-2015-9402 | 1 Usersultra | 1 Users Ultra Membership | 2019-09-23 | 6.8 MEDIUM | 8.8 HIGH |
| The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. | |||||
| CVE-2015-9387 | 1 Mtouch Quiz Project | 1 Mtouch Quiz | 2019-09-23 | 4.3 MEDIUM | 6.5 MEDIUM |
| The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. | |||||
| CVE-2015-9390 | 1 Admin Management Xtended Project | 1 Admin Management Xtended | 2019-09-23 | 4.0 MEDIUM | 4.3 MEDIUM |
| The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. | |||||
| CVE-2019-16678 | 1 Yzmcms | 1 Yzmcms | 2019-09-23 | 4.3 MEDIUM | 6.5 MEDIUM |
| admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. | |||||
| CVE-2019-16704 | 1 Phpmywind | 1 Phpmywind | 2019-09-23 | 3.5 LOW | 4.8 MEDIUM |
| admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS. | |||||
| CVE-2014-10397 | 1 Para | 1 Antioch | 2019-09-23 | 5.0 MEDIUM | 7.5 HIGH |
| The Antioch theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to lib/scripts/download.php. | |||||
| CVE-2015-9403 | 1 Neuvoo | 1 Neuvoo-jobroll | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. | |||||
| CVE-2019-16657 | 1 Tuzicms | 1 Tuzicms | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| TuziCMS 2.0.6 has XSS via the PATH_INFO to a group URI, as demonstrated by index.php/article/group/id/2/. | |||||
| CVE-2019-16658 | 1 Tuzicms | 1 Tuzicms | 2019-09-23 | 6.8 MEDIUM | 8.8 HIGH |
| TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF. | |||||
| CVE-2019-16661 | 1 Digimute | 1 Ogma Cms | 2019-09-23 | 3.5 LOW | 5.4 MEDIUM |
| Ogma CMS 0.5 has XSS via creation of a new blog. | |||||
| CVE-2019-14915 | 1 Prise | 1 Adas | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate. | |||||
| CVE-2019-14914 | 1 Prise | 1 Adas | 2019-09-23 | 7.5 HIGH | 9.1 CRITICAL |
| An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via Directory Traversal. | |||||
| CVE-2019-14913 | 1 Prise | 1 Adas | 2019-09-23 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel. | |||||
| CVE-2018-16379 | 1 Digimute | 1 Ogma Cms | 2019-09-23 | 3.5 LOW | 4.8 MEDIUM |
| Ogma CMS 0.4 Beta has XSS via the "Footer Text footer" field on the "Theme/Theme Options" screen. | |||||
| CVE-2018-16380 | 1 Digimute | 1 Ogma Cms | 2019-09-23 | 6.8 MEDIUM | 8.8 HIGH |
| An issue was discovered in Ogma CMS 0.4 Beta. There is a CSRF vulnerability in users.php?action=createnew that can add an admin account. | |||||
| CVE-2019-16659 | 1 Tuzicms | 1 Tuzicms | 2019-09-23 | 6.8 MEDIUM | 8.8 HIGH |
| TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF. | |||||
| CVE-2019-14912 | 1 Prise | 1 Adas | 2019-09-23 | 5.8 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie. | |||||
| CVE-2019-16660 | 1 Joyplus Project | 1 Joyplus | 2019-09-23 | 6.8 MEDIUM | 8.8 HIGH |
| joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF. | |||||
| CVE-2019-14911 | 1 Prise | 1 Adas | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS. | |||||
| CVE-2019-16664 | 1 Thinksaas | 1 Thinksaas | 2019-09-23 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter. | |||||
| CVE-2019-5521 | 1 Vmware | 3 Esxi, Fusion, Workstation | 2019-09-23 | 5.5 MEDIUM | 9.6 CRITICAL |
| VMware ESXi (6.7 before ESXi670-201904101-SG and 6.5 before ESXi650-201903001), Workstation (15.x before 15.0.3 and 14.x before 14.1.6) and Fusion (11.x before 11.0.3 and 10.x before 10.1.6) contain an out-of-bounds read vulnerability in the pixel shader functionality. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on the host. Exploitation of this issue require an attacker to have access to a virtual machine with 3D graphics enabled. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion. | |||||
| CVE-2019-16665 | 1 Thinksaas | 1 Thinksaas | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element. | |||||
| CVE-2018-11200 | 1 Acquia | 1 Mautic | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field. | |||||
| CVE-2019-16691 | 2019-09-23 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. | |||||
| CVE-2019-11563 | 2019-09-21 | N/A | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. | |||||
| CVE-2015-9400 | 1 Typomedia | 1 Wordpress Meta Robots | 2019-09-20 | 6.5 MEDIUM | 8.8 HIGH |
| The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. | |||||
| CVE-2016-7398 | 1 Php | 1 Ext-http | 2019-09-20 | 7.5 HIGH | 9.8 CRITICAL |
| A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests. | |||||
| CVE-2015-9399 | 1 Trivetechnology | 1 Wp-stats-dashboard | 2019-09-20 | 6.5 MEDIUM | 7.2 HIGH |
| The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. | |||||
| CVE-2015-9405 | 1 Wp-piwik Project | 1 Wp-piwik | 2019-09-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| The wp-piwik plugin before 1.0.5 for WordPress has XSS. | |||||
| CVE-2015-9404 | 1 Neuvoo | 1 Neuvoo-jobroll | 2019-09-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. | |||||
| CVE-2019-11559 | 1 Hrworks | 1 Hrworks | 2019-09-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected Cross-site scripting (XSS) vulnerability in HRworks V 1.16.1 allows remote attackers to inject arbitrary web script or HTML via the URL parameter to the Login component. | |||||
| CVE-2015-9385 | 1 Bestwebsoft | 1 Quotes And Tips | 2019-09-20 | 4.3 MEDIUM | 6.1 MEDIUM |
| The quotes-and-tips plugin before 1.20 for WordPress has XSS. | |||||
| CVE-2019-16644 | 1 Tuzicms | 1 Tuzicms | 2019-09-20 | 7.5 HIGH | 9.8 CRITICAL |
| App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring. | |||||
| CVE-2019-16643 | 1 Zrlog | 1 Zrlog | 2019-09-20 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area. | |||||
| CVE-2015-9397 | 1 Webmaster-source | 1 Gocodes | 2019-09-20 | 3.5 LOW | 5.4 MEDIUM |
| The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. | |||||
| CVE-2015-9395 | 1 Usersultra | 1 Users Ultra Membership | 2019-09-20 | 6.5 MEDIUM | 8.8 HIGH |
| The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. | |||||
| CVE-2015-9401 | 1 Websimon-tables Project | 1 Websimon-tables | 2019-09-20 | 3.5 LOW | 4.8 MEDIUM |
| The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. | |||||