CVE-2019-15819

The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.

Source: CVE-2019-15819

CVE-2019-15822

The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.

Source: CVE-2019-15822

CVE-2019-15821

The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.

Source: CVE-2019-15821

CVE-2019-15820

The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.

Source: CVE-2019-15820

CVE-2019-15825

The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.

Source: CVE-2019-15825

CVE-2015-9380

The photo-gallery plugin before 1.2.42 for WordPress has CSRF.

Source: CVE-2015-9380

CVE-2019-15818

The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.

Source: CVE-2019-15818

CVE-2019-15817

The easy-property-listings plugin before 3.4 for WordPress has XSS.

Source: CVE-2019-15817

CVE-2019-15824

The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.

Source: CVE-2019-15824

CVE-2019-5612

In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read handler that is not thread-safe. A multi-threaded program can exploit races in the handler to copy out kernel memory outside the boundaries of midistat’s data buffer.

Source: CVE-2019-5612