Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
NVD-CWE-noinfo
CVE-2019-15854
An issue was discovered in Maarch RM before 2.5. A privilege escalation vulnerability allows an authenticated user with lowest privileges to give herself highest administration privileges via a crafted PUT request to an unauthorized resource.
CVE-2019-15863
The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.
CVE-2019-15804
An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. By sending a signal to the CLI process, undocumented functionality is triggered. Specifically, a menu can be triggered by sending the SIGQUIT signal to the CLI application (e.g., through CTRL+ via SSH). The access control check for this menu does work and prohibits accessing the menu, which contains “Password recovery for specific user” options. The menu is believed to be accessible using a serial console.
CVE-2019-15821
The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.
CVE-2019-15823
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.