TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.

Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection

Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1

Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin

Blind SQL Injection in wordpress plugin dukapress v2.5.9

Remote file download in simple-image-manipulator v1.0 wordpress plugin

Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05

Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2

Remote file download vulnerability in wptf-image-gallery v1.03

Remote file download vulnerability in recent-backups v0.7 wordpress plugin

Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin

XSS in filedownload v1.4 wordpress plugin

Blind SQL Injection in filedownload v1.4 wordpress plugin

Open Proxy in filedownload v1.4 wordpress plugin

Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin

Remote file upload vulnerability in mailcwp v1.99 wordpress plugin

The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials.

Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682.

The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.

Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leveraging CLI access, aka Bug ID CSCva30370.

The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.

Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349.

Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuy75036 and CSCuy81654.

Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652.

The DHCP Relay implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4.7.29 and 9.1.7.4 allows remote attackers to cause a denial of service (interface wedge) via a crafted rate of DHCP packet transmission, aka Bug ID CSCuy66942.