Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2704▼ 598 respecto a la semana anterior

Críticas / altas1288▼ 199 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)299▼ 211 respecto a la semana anterior

80 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2019-16251	Modificada	Media (4.3)	0.95%	—	Yithemes Yith Woocommerce Wishlist Yithemes Yith Woocommerce Compare Yithemes Yith Woocommerce Quick View Yithemes Yith Woocommerce Zoom Magnifier+34	31/10/2019	17/6/2026	plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.
CVE-2015-9521	Modificada	Media (6.1)	0.92%	—	Awesomemotive Easy Digital Downloads Easydigitaldownloads Pushover Notifications	23/10/2019	17/6/2026	The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVE-2019-15827	Modificada	Media (5.4)	1.1%	—	Onesignal-free-web-push-notifications	30/8/2019	17/6/2026	The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.
CVE-2019-3800	Modificada	Alta (7.8)	2.1%	—	Pivotal Cloud Foundry Command Line Interface Pivotal Cloud Foundry Command Line Interface Release Pivotal Cloud Foundry Deployment Pivotal Cloud Foundry Deployment Concourse Tasks+51	5/8/2019	17/6/2026	CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag. A local authenticated malicious user with access to the CF CLI config file can act as that client, who is the owner of the leaked credentials.
CVE-2018-4943	Modificada	Alta (8.8)	6.5%	—	Adobe Push Notifications	19/5/2018	17/6/2026	Adobe PhoneGap Push Plugin versions 1.8.0 and earlier have an exploitable Same-Origin Method Execution vulnerability. Successful exploitation could lead to JavaScript code execution in the context of the PhoneGap app.