WordPress wp-all-import plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-all-import is an XML, CSV file import plugin used in it. A cross-site scripting vulnerability exists in WordPress wp-all-import...

Linux kernel resource management error vulnerability (CNVD-2019-38288)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A resource management error vulnerability exists in versions of Linux kernel prior to 4.18. The vulnerability arises from mismanagement of system resources e.g., memor...

PT-2019-7279 · WordPress · Option-Tree

Name of the Vulnerable Software and Affected Versions: option-tree plugin versions prior to 2.5.4 Description: The issue is related to a Cross-Site Scripting XSS problem in the add query arg function. Recommendations: For versions prior to 2.5.4, update to version 2.5.4 or later to resolve the...

PT-2019-14031

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.4.0 Description The issue is related to how Roundcube Webmail handles Punycode xn-- domain names, which can lead to homograph attacks. Recommendations For versions prior to 1.4.0, update to version 1.4.0 o...

Ghostscript -- Security bypass vulnerabilities

Cedric Buissart Red Hat reports: A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protecti...

PT-2019-13999 · Joomla · Kunena

Name of the Vulnerable Software and Affected Versions: Kunena extension versions prior to 5.1.14 for Joomla! Description: The issue allows for XSS via BBCode, which can be exploited to execute malicious scripts. Recommendations: For versions prior to 5.1.14, update to version 5.1.14 or later to...

PT-2019-7283 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: easy-digital-downloads plugin versions prior to 2.3.3 Description: The issue is related to SQL injection in the easy-digital-downloads plugin for WordPress. Recommendations: For versions prior to 2.3.3, update to version 2.3.3 or later to...

PT-2019-6433 · Live Networks +2 · Live555 +2

Name of the Vulnerable Software and Affected Versions: Live555 versions prior to 2019.08.16 Description: The issue is related to a Use-After-Free error in the GenericMediaServer::createNewClientSessionWithId function, which can generate the same client session ID in succession. This is mishandled...

Directory traversal

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

mysql: Server: Connection unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Connection. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successf...

mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Pluggable Auth. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...

mysql: Server: Replication unspecified vulnerability (CPU Jan 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Replication. Supported versions that are affected are 8.0.13 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

mysql: Server: Compiling unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server : Compiling. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple...

mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Optimizer. Supported versions that are affected are 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Group Replication Plugin. Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via MySQL Procotol to compromise MySQL...

PT-2019-13905 · Artifex +1 · Mupdf +1

Name of the Vulnerable Software and Affected Versions: Artifex MuPDF versions prior to 1.16.0 Description: The issue is related to a heap-based buffer over-read in the fz chartorune function in fitz/string.c. This occurs because pdf/pdf-op-filter.c does not check for a missing string, leading to...

WordPress wp-editor plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by WordPress Foundation using PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-editor plugin is an editor plugin used in it. A cross-site scripting vulnerability exists in WordPress wp-editor plugin...

HPE 3PAR Service Processor Authorization Issue Vulnerability

HPE 3PAR Service Processor SP is a suite of virtual service processors deployed on the VMware vSphere hypervisor from HPE, USA. An authorization issue vulnerability exists in HPE 3PAR Service Processor versions prior to 5.0.5.1. An attacker could exploit the vulnerability to reuse sessions...