CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
JetBrains YouTrack before 2019.2.53938 was using incorrect settings, allowing a user without necessary permissions to get other project names.
In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no password expiration policy was implemented.
JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http connection.
Youtrack, Firefox, Firefox_esr, Thunderbird, Bleach, Bonsai, Bugzilla, Camino, Convict, Durian_web_application_server, Firefox_focus
2019-10-02
N/A
6.1 MEDIUM
JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.
JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.
The Telenav Scout GPS Link app 1.x for iOS, as used with Toyota and Lexus vehicles, has an incorrect protection mechanism against brute-force attacks on the authentication process, which makes it easier for attackers to obtain multimedia-screen access via port 7050 on the cellular network, as demonstrated by a DrivingRestriction method call to uma/jsonrpc/mobile.
Phone_system_firmware, Phone_system, 3cx_web_server, Call_flow_designer, Crm_template_generator, Live_chat, Wp-live_chat
2019-08-15
N/A
6.1 MEDIUM
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.