Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-4245 State: PUBLISHED Published: 2012-08-31T18:00:00 Last Updated: 2024-08-06T20:28:07.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/08/20/1 - http://archives.neohapsis.com/archives/bugtraq/2012-08/0106.html - https://security.gentoo.org/glsa/201603-01 - http://www.openwall.com/lists/oss-security/2012/08/16/6 - http://www.reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-e
penwall.com/lists/oss-security/2012/08/16/6 - http://www.reactionpenetrationtesting.co.uk/GIMP-scriptfu-python-command-execution.html - http://www.securityfocus.com/bid/55089 - http://www.openwall.com/lists/oss-security/2012/08/17/2 - http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
CVE ID: CVE-2012-4246 State: PUBLISHED Published: 2012-08-12T00:00:00Z Last Updated: 2024-09-17T02:21:49.445Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page. Additional Analyst Notes: - CVE Program Container: References: - https://www.httpcs.com/advisory/httpcs25 - http://www.phplist.com/?lid=579 - https://www.httpcs.com/advisory/httpcs24 - https://www.httpcs.com/advisories - https://www.httpcs.com/advisory/httpcs23
https://www.httpcs.com/advisory/httpcs24 - https://www.httpcs.com/advisories - https://www.httpcs.com/advisory/httpcs23 - https://www.httpcs.com/advisory/httpcs26
CVE ID: CVE-2012-4247 State: PUBLISHED Published: 2012-08-12T00:00:00Z Last Updated: 2024-09-16T18:54:38.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page. Additional Analyst Notes: - CVE Program Container: References: - http://www.phplist.com/?lid=579 - https://www.httpcs.com/advisory/httpcs1 - https://www.httpcs.com/advisories -
ences: - http://www.phplist.com/?lid=579 - https://www.httpcs.com/advisory/httpcs1 - https://www.httpcs.com/advisories - https://www.httpcs.com/advisory/httpcs4 - https://www.httpcs.com/advisory/httpcs3 - https://www.httpcs.com/advisory/httpcs2 - https://www.httpcs.com/advisory/httpcs6 - https://www.httpcs.com/advisory/httpcs7
CVE ID: CVE-2012-4248 State: PUBLISHED Published: 2012-08-12T17:00:00Z Last Updated: 2024-09-16T22:41:26.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the (1) dev.log, (2) lipc.set, (3) lipc.get, or (4) todo.scheduleItems method, a different vulnerability than CVE-2012-4249. Additional Analyst Notes: - CVE Program Container: References: - http://www.mobileread.com/forums/showthread.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368 - http://www.kb.cert.org/vuls/id/122656 -
bileread.com/forums/showthread.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368 - http://www.kb.cert.org/vuls/id/122656 - http://www.kb.cert.org/vuls/id/MORO-8WKGBN
CVE ID: CVE-2012-4249 State: PUBLISHED Published: 2012-08-12T17:00:00Z Last Updated: 2024-09-17T04:04:24.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than CVE-2012-4248. Additional Analyst Notes: - CVE Program Container: References: - http://www.mobileread.com/forums/showthread.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368 - http://www.kb.cert.org/vuls/id/122656 - http://www.kb.cert.org/vu
read.php?s=c7953cc553a4aaa36e880b25aa1a6bf6&t=175368 - http://www.kb.cert.org/vuls/id/122656 - http://www.kb.cert.org/vuls/id/MORO-8WKGBN
CVE ID: CVE-2012-4250 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the RequestScreenOptimization function in the XProcessControl.ocx ActiveX control in msls31.dll in Samsung NET-i viewer 1.37 allows remote attackers to execute arbitrary code via a long string in the first argument. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53317 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75310 - http://www.exploit-db.com/exploits/18808
CVE ID: CVE-2012-4251 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php, (2) phase parameter to install.php, (3) tablename or (4) dbid parameter to sql.php, or (5) filename parameter to restore.php in learn/cubemail/. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/81611 - http://www.osvdb.org/81612 - http://www.osvdb.org/81610 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75284
1 - http://www.osvdb.org/81612 - http://www.osvdb.org/81610 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75284 - http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html - http://www.securityfocus.com/bid/53306
CVE ID: CVE-2012-4252 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to hijack the authentication of administrators for requests that (1) remove file access restriction via a deletehtaccess action, (2) drop a database via a kill value in a db action, (3) uninstall the application via a 101 value in the phase parameter to learn/cubemail/install.php, (4) delete config.php via a 2 value in the phase parameter to learn/cubemail/install.php, (5) change a password via a schutz action, or (6) execut
a 2 value in the phase parameter to learn/cubemail/install.php, (5) change a password via a schutz action, or (6) execute arbitrary SQL commands via the sql_statement parameter to learn/cubemail/sql.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75285 - http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html - http://www.securityfocus.com/bid/53306 - http://www.osvdb.org/81613
CVE ID: CVE-2012-4253 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in MySQLDumper 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to learn/cubemail/install.php or (2) f parameter learn/cubemail/filemanagement.php, or execute arbitrary local files via a .. (dot dot) in the (3) config parameter to learn/cubemail/menu.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75286 - http://packetstormsecurity.org/files/112304/MySQLDu
nces: - https://exchange.xforce.ibmcloud.com/vulnerabilities/75286 - http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html - http://www.securityfocus.com/bid/53306 - http://www.osvdb.org/81609 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75283 - http://www.osvdb.org/81615
CVE ID: CVE-2012-4254 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information (Notices) via a direct request to (1) learn/cubemail/restore.php or (2) learn/cubemail/dump.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html - http://www.securityfocus.com/bid/53306 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75287 - http://www.osvdb.org/81616
CVE ID: CVE-2012-4255 State: PUBLISHED Published: 2012-08-13T18:00:00Z Last Updated: 2024-09-17T04:04:39.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQLDumper 1.24.4 allows remote attackers to obtain sensitive information via a direct request to learn/cubemail/refresh_dblist.php, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/112304/MySQLDumper-1.24.4-LFI-XSS-CSRF-Code-Execution-Traversal.html - http://www.securityfocus.com/bid/53306 - http://www.osvdb.org/81616
CVE ID: CVE-2012-4256 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jNews (com_jnews) component 7.5.1 for Joomla! allows remote attackers to obtain sensitive information via the emailsearch parameter, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/112233/jNews-7.5.1-Information-Disclosure.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/75198 - http://hauntit.blogspot.com/2012/04/en-jnews-jnewscore751-information.html
CVE ID: CVE-2012-4257 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yaqas (Yet Another Question & Answer System) 1.0 Alpha 1 allows remote attackers to obtain sensitive information via an invalid character in the PHPSESSID, which reveals the installation path in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/112248/Yaqas-CMS-Alpha1-Information-Disclosure.html - http://hauntit.blogspot.com/2012/03/en-yaqas-cms-alpha1-information.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/75205
CVE ID: CVE-2012-4258 State: PUBLISHED Published: 2012-08-13T18:00:00Z Last Updated: 2024-09-17T00:21:34.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in MYRE Real Estate Software (2012 Q2) allow remote attackers to execute arbitrary SQL commands via the (1) link_idd parameter to 1_mobile/listings.php or (2) userid parameter to 1_mobile/agentprofile.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/18843 - http://packetstormsecurity.org/files/112480/MYRE-Real-Estate-Mobile-2012-2-Cross-Site-Scripting-SQL-Injection.html - http://www.securityfocus.com/bid/53394 - http://www.vulnerabi
te-Mobile-2012-2-Cross-Site-Scripting-SQL-Injection.html - http://www.securityfocus.com/bid/53394 - http://www.vulnerability-lab.com/get_content.php?id=516
CVE ID: CVE-2012-4259 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the contacts in (1) XPhone UC Web and the (2) web frontend for XPhone Virtual Directory in C4B XPhone Unified Communications (UC) 2011 Web 4.1.890S R1 allows remote attackers to inject arbitrary web script or HTML via the company name. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53283 - http://secunia.com/advisories/48979 - http://archives.neohapsis.com/archive
: - http://www.securityfocus.com/bid/53283 - http://secunia.com/advisories/48979 - http://archives.neohapsis.com/archives/bugtraq/2012-04/0216.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/75221 - http://osvdb.org/81559 - http://security.inshell.net/advisory/16 - http://www.exploit-db.com/exploits/18802
CVE ID: CVE-2012-4260 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in myCare2x allow remote attackers to execute arbitrary SQL commands via the (1) aktion or (2) callurl parameter to modules/patient/mycare2x_pat_info.php; (3) dept_nr or (4) pid parameter to modules/importer/mycare2x_importer.php; (5) myOpsEintrag or (6) keyword parameter in a Suchen action to modules/drg/mycare2x_proc_search.php; or (7) name_last or (8) pid parameter to modules/patient/mycare_pid.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/8
modules/patient/mycare_pid.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/81686 - http://www.vulnerability-lab.com/get_content.php?id=524 - http://www.exploit-db.com/exploits/18844 - http://www.osvdb.org/81685 - http://www.securityfocus.com/bid/53392 - http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.html - http://secunia.com/advisories/49029 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75390
CVE ID: CVE-2012-4261 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in modules/patient/mycare2x_pat_info.php in myCare2x allows remote attackers to execute arbitrary SQL commands via the lang parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/49029 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75390 - http://www.osvdb.org/81684
CVE ID: CVE-2012-4262 State: PUBLISHED Published: 2012-08-13T18:00:00 Last Updated: 2024-08-06T20:28:07.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in myCare2x allow remote attackers to inject arbitrary web script or HTML via the (1) name_last, (2) name_first, (3) name_middle, or (4) name_maiden parameter to modules/patient/mycare_pid.php; (5) favorites or (6) lang parameter to modules/nursing/mycare_ward_print.php; (7) aktion or (8) callurl parameter to modules/patient/mycare2x_pat_info.php; or (9) ln parameter to modules/drg/mycare2x_proc_search.php. Additional Analyst Notes: - CVE Program Container: References: - http
parameter to modules/drg/mycare2x_proc_search.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.osvdb.org/81689 - http://www.osvdb.org/81687 - http://www.osvdb.org/81690 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75391 - http://www.vulnerability-lab.com/get_content.php?id=524 - http://www.exploit-db.com/exploits/18844 - http://www.securityfocus.com/bid/53392 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75392 - http://packetstormsecurity.org/files/112462/myCare2x-CMS-Cross-Site-Scripting-SQL-Injection.html - http://secunia.com/advisories/49029 - http://www.osvdb.org/81688
CVE ID: CVE-2012-4263 State: PUBLISHED Published: 2012-08-13T22:00:00 Last Updated: 2024-08-06T20:28:07.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header. Additional Analyst Notes: - CVE Program Container: References: - http://plugins.trac.wordpress.org/changeset?old_path=%2Fbetter-wp-security&old=542852&new_path=%2Fbetter-wp-security&new=542852 - http://www.securityfocus.com/bid/53480 - https://exchange.xforce.ibmcloud.com/vulnerabilities/7
wp-security&new=542852 - http://www.securityfocus.com/bid/53480 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75523 - http://packetstormsecurity.org/files/112617/WordPress-Better-WP-Security-Cross-Site-Scripting.html - http://bit51.com/software/better-wp-security/changelog/
CVE ID: CVE-2012-4264 State: PUBLISHED Published: 2012-08-13T22:00:00Z Last Updated: 2024-09-16T18:39:35.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263. Additional Analyst Notes: - CVE Program Container: References: - http://plugins.trac.wordpress.org/changeset?old_path=%2Fbetter-wp-security&old=542852&new_path=%2Fbetter-wp-security&new=542852 - http://bit51.com/software/better-wp-secu
th=%2Fbetter-wp-security&old=542852&new_path=%2Fbetter-wp-security&new=542852 - http://bit51.com/software/better-wp-security/changelog/
CVE ID: CVE-2012-4265 State: PUBLISHED Published: 2012-08-13T22:00:00Z Last Updated: 2024-09-17T02:16:10.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in category_edit.php in Proman Xpress 5.0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.vulnerability-lab.com/get_content.php?id=512 - http://www.exploit-db.com/exploits/18872
CVE ID: CVE-2012-4266 State: PUBLISHED Published: 2012-08-13T22:00:00Z Last Updated: 2024-09-17T01:16:49.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in client_details.php in Proman Xpress 5.0.1 allows remote attackers to inject arbitrary web script or HTML via the cl_comments parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.vulnerability-lab.com/get_content.php?id=512 - http://secunia.com/advisories/49127 - http://www.exploit-db.com/exploits/18872
CVE ID: CVE-2012-4267 State: PUBLISHED Published: 2012-08-13T22:00:00Z Last Updated: 2024-09-17T04:18:55.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in user/register in Sockso 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the name parameter. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/49148 - http://www.exploit-db.com/exploits/18868 - https://github.com/rodnaph/sockso/commit/fe2d895ea8eb8b8ccad5a3319f472e45d6ba5136 - https://github.com/rodnaph/sockso/pull/99/files - https://github.com/rodnaph/sockso/issues/93 - http://smwyg.com/blog/#sockso-pers
thub.com/rodnaph/sockso/pull/99/files - https://github.com/rodnaph/sockso/issues/93 - http://smwyg.com/blog/#sockso-persistant-xss-attack
CVE ID: CVE-2012-4268 State: PUBLISHED Published: 2012-08-13T22:00:00 Last Updated: 2024-08-06T20:28:07.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in bulletproof-security/admin/options.php in the BulletProof Security plugin before .47.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_ACCEPT_ENCODING header. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/extend/plugins/bulletproof-security/changelog/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/75522 - http://packetstormsecurity.org/files/112618/WordPress-BulletProof-Security-Cross-Site-Scrip
.com/vulnerabilities/75522 - http://packetstormsecurity.org/files/112618/WordPress-BulletProof-Security-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/53478 - http://plugins.trac.wordpress.org/changeset?old_path=%2Fbulletproof-security&old=543044&new_path=%2Fbulletproof-security&new=543044
CVE ID: CVE-2012-4269 State: PUBLISHED Published: 2012-08-13T22:00:00 Last Updated: 2024-08-06T20:28:07.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in eFront 3.6.11 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension via an attachment in a message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53412 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75443 - http://packetstormsecurity.org/files/112496/Efront-3.6.11-Cross-Site-Scripting-Shell-Upload.html
CVE ID: CVE-2012-4270 State: PUBLISHED Published: 2012-08-13T22:00:00 Last Updated: 2024-08-06T20:28:07.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in eFront 3.6.11 allows remote authenticated users to inject arbitrary web script or HTML via the subject box of a message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/53412 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75442 - http://packetstormsecurity.org/files/112496/Efront-3.6.11-Cross-Site-Scripting-Shell-Upload.html
CVE ID: CVE-2012-4271 State: PUBLISHED Published: 2012-08-13T22:00:00 Last Updated: 2024-08-06T20:28:07.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) httpbl_key, (3) httpbl_maxage, (4) httpbl_threat, (5) reverse_proxy_addresses, or (6) reverse_proxy_header parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.org/files/112619/WordPress-Bad-Behavior-Cross-Site-Scripting.html -
Container: References: - http://packetstormsecurity.org/files/112619/WordPress-Bad-Behavior-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/53477 - http://plugins.trac.wordpress.org/changeset?old_path=%2Fbad-behavior&old=543807&new_path=%2Fbad-behavior&new=543807 - https://exchange.xforce.ibmcloud.com/vulnerabilities/75521
CVE ID: CVE-2012-4272 State: PUBLISHED Published: 2012-08-13T22:00:00Z Last Updated: 2024-09-17T02:31:54.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "processing of the buttons of Xing and Pinterest". Additional Analyst Notes: - CVE Program Container: References: - http://plugins.trac.wordpress.org/changeset?old_path=%2F2-click-socialmedia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798 - http://wordpress.org/extend/plugins/2-click-s
ia-buttons&old=532798&new_path=%2F2-click-socialmedia-buttons&new=532798 - http://wordpress.org/extend/plugins/2-click-socialmedia-buttons/changelog/