#php

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.

wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.

The events-manager plugin before 5.6 for WordPress has code injection.

The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.

The simple-membership plugin before 3.5.7 for WordPress has XSS.

The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.

The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.