Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-10146 State: PUBLISHED Published: 2025-10-29T09:27:56.750Z Last Updated: 2025-10-29T14:05:43.855Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: nik00726 Products: Thumbnail Slider With Lightbox Problem Types: CWE-89 Description: The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already e
for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/70f04f90-a0b7-46d1-85da-e898a6981fa2?source=cve - https://wordpress.org/plugins/wp-responsive-slider-with-lightbox
CVE ID: CVE-2015-10147 State: PUBLISHED Published: 2025-10-29T09:27:57.650Z Last Updated: 2025-10-29T13:54:08.317Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: nik00726 Products: Easy Testimonial Slider and Form Problem Types: CWE-89 Description: The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into alrea
ible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f44483df-e50d-4dcf-8a6f-499e2bd05b89?source=cve - https://wordpress.org/plugins/easy-testimonial-rotator
CVE ID: CVE-2015-1142857 State: PUBLISHED Published: 2018-01-23T14:00:00Z Last Updated: 2024-09-16T20:26:35.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected. Additional Analyst Notes: - CVE Program Container: References: - https://security-center.intel.com/adv
ware is affected. Additional Analyst Notes: - CVE Program Container: References: - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr - http://seclists.org/oss-sec/2015/q4/425 - https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf
CVE ID: CVE-2015-1000 State: PUBLISHED Published: 2015-06-05T10:00:00 Last Updated: 2024-08-06T04:26:11.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter. Additional Analyst Notes: - CVE Program Container: References: - http://zerodayinitiative.com/advisories/ZDI-15-120/ - https://ics-cert.us-cert.gov/advisories/ICSA-15-153-02 - http://www.securityfocus.com/bid/74966
CVE ID: CVE-2015-1001 State: PUBLISHED Published: 2015-10-25T01:00:00 Last Updated: 2024-08-06T04:26:11.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02
CVE ID: CVE-2015-1002 State: PUBLISHED Published: 2015-10-25T01:00:00 Last Updated: 2024-08-06T04:26:11.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02
CVE ID: CVE-2015-1003 State: PUBLISHED Published: 2015-10-25T01:00:00 Last Updated: 2024-08-06T04:26:11.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02
CVE ID: CVE-2015-1004 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2015-1005 State: PUBLISHED Published: 2015-10-25T01:00:00 Last Updated: 2024-08-06T04:26:11.456Z Vendors: n/a Products: n/a Problem Types: n/a Description: IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-293-01
CVE ID: CVE-2015-1006 State: PUBLISHED Published: 2019-05-10T13:47:27 Last Updated: 2024-08-06T04:26:11.549Z Vendors: Opto 22 Products: PAC Project Professional, PAC Project Basic, PAC Display Basic, PAC Display Professional, OptoOPCServer, OptoDataLink Problem Types: CWE-121 Description: A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-base
nd prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01
CVE ID: CVE-2015-1007 State: PUBLISHED Published: 2019-03-25T18:38:25 Last Updated: 2024-08-06T04:26:11.562Z Vendors: Opto 22 Products: PAC Project Professional, PAC Project Basic, PAC Display Basic, PAC Display Professional, OptoOPCServer, OptoDataLink Problem Types: CWE-121 Description: A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were i
ions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01
CVE ID: CVE-2015-1008 State: PUBLISHED Published: 2015-05-26T01:00:00 Last Updated: 2024-08-06T04:26:11.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input. Additional Analyst Notes: - CVE Program Container: References: - http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability - https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 - http://www.securityfocus.com/bid/74774
CVE ID: CVE-2015-1009 State: PUBLISHED Published: 2015-08-01T01:00:00 Last Updated: 2024-08-06T04:26:11.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01 - https://gcsresource.invensys.com/support/docs/_securitybulletins/Security_bulletin_LFSEC00000110.pdf - http://download.schneider-electric.com/files?p_Doc_Ref=
rt/docs/_securitybulletins/Security_bulletin_LFSEC00000110.pdf - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-100-01
CVE ID: CVE-2015-1010 State: PUBLISHED Published: 2015-05-31T17:00:00 Last Updated: 2024-08-06T04:26:11.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack. Additional Analyst Notes: - CVE Program Container: References: - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/700915 - https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02
CVE ID: CVE-2015-1011 State: PUBLISHED Published: 2015-07-06T19:10:00 Last Updated: 2024-08-06T04:26:11.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm - https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A
CVE ID: CVE-2015-1012 State: PUBLISHED Published: 2019-03-25T18:20:12 Last Updated: 2024-08-06T04:26:11.620Z Vendors: Hospira Products: LifeCare PCA Infusion System Problem Types: CWE-312 Description: Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET cl
ion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01
CVE ID: CVE-2015-1013 State: PUBLISHED Published: 2015-05-26T01:00:00 Last Updated: 2024-08-06T04:26:11.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements. Additional Analyst Notes: - CVE Program Container: References: - https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00280 - https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01
CVE ID: CVE-2015-1014 State: PUBLISHED Published: 2019-03-25T18:07:36 Last Updated: 2024-08-06T04:33:19.231Z Vendors: Schneider Electric Products: OFS v3.5 Problem Types: CWE-427 Description: A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulner
file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01
CVE ID: CVE-2015-1015 State: PUBLISHED Published: 2015-10-03T10:00:00 Last Updated: 2024-08-06T04:33:19.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
CVE ID: CVE-2015-1026 State: PUBLISHED Published: 2015-03-11T14:00:00 Last Updated: 2024-08-06T04:33:20.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534833/100/0/th
7/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534833/100/0/threaded
CVE ID: CVE-2015-1027 State: PUBLISHED Published: 2017-09-28T19:00:00 Last Updated: 2024-08-06T04:33:19.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/percona-toolkit
on of MySQL. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/percona-toolkit/+bug/1408375 - https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/
CVE ID: CVE-2015-1028 State: PUBLISHED Published: 2015-01-21T15:00:00 Last Updated: 2024-08-06T04:33:19.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer). Additional A
sh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer). Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35751 - http://www.exploit-db.com/exploits/35747 - http://www.xlabs.com.br/blog/?p=339 - http://www.exploit-db.com/exploits/35750
CVE ID: CVE-2015-1029 State: PUBLISHED Published: 2015-01-16T16:00:00 Last Updated: 2024-08-06T04:33:19.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache. Additional Analyst Notes: - CVE Program Container: References: - http://puppetlabs.com/security/cve/cve-2015-1029 - http://secunia.com/advisories/62328
CVE ID: CVE-2015-1030 State: PUBLISHED Published: 2015-01-20T15:00:00 Last Updated: 2024-08-06T04:33:19.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62123 - http://www.openwall.com/lists/oss-security/2015/01/11/1 - http://www.privoxy.org/announce.txt
CVE ID: CVE-2015-1031 State: PUBLISHED Published: 2015-02-10T19:00:00 Last Updated: 2024-08-06T04:33:19.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3133 - http://secunia.com/advisories/62123 - http://www.openwall.com/lists/oss-security/2015/01/11/1
g/security/2015/dsa-3133 - http://secunia.com/advisories/62123 - http://www.openwall.com/lists/oss-security/2015/01/11/1 - http://www.privoxy.org/announce.txt
CVE ID: CVE-2015-1032 State: PUBLISHED Published: 2015-01-21T15:00:00 Last Updated: 2024-08-06T04:33:19.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Kiwix before 0.9.1, when using kiwix-serve, allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to /search. Additional Analyst Notes: - CVE Program Container: References: - http://sourceforge.net/p/kiwix/bugs/763/ - http://www.securityfocus.com/archive/1/534502/100/0/threaded - http://sourceforge.net/p/kiwix/kiwix/ci/d1af5f0375c6db24d4071acf4806735725fd206e - http://packetstormsecurity.com/files/130007/Kiwix-Cross-Site-Scripting.html
CVE ID: CVE-2015-1038 State: PUBLISHED Published: 2015-01-21T18:00:00 Last Updated: 2024-08-06T04:33:19.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-07/msg00000.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660 - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174245.html - https://bugzilla.redhat.com/show_bug.cgi?id=1179505 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.security
ug.cgi?id=1179505 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.securityfocus.com/bid/71890 - http://www.debian.org/security/2015/dsa-3289 - http://www.openwall.com/lists/oss-security/2015/01/11/2 - http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173245.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99970
CVE ID: CVE-2015-1039 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T04:33:20.058Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZF-Commons/ZfcUser/issues/550 - http://www.openwall.com/lists/oss-security/2015/01/11/4 - https://github.com/ZF-Commons/ZfcUser/commit/baf0e460 - http://www.securityfocus.com/bid/71931
CVE ID: CVE-2015-1040 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T04:33:20.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) data[title] or (3) data[description] field in the addQuickItem form to index.php; the (4) "note text" field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view. Additional Analyst Notes: -
(5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/16 - http://packetstormsecurity.com/files/129865/CMS-BEdita-3.4.0-Cross-Site-Scripting.html - http://seclists.org/oss-sec/2015/q1/115 - https://github.com/bedita/bedita/issues/566 - http://sroesemann.blogspot.de/2014/12/sroeadv-2014-10.html - http://www.securityfocus.com/bid/71949
CVE ID: CVE-2015-1041 State: PUBLISHED Published: 2015-01-15T15:00:00 Last Updated: 2024-08-06T04:33:19.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING. Additional Analyst Notes: - CVE Program Container: References: - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-05.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99898 - https://github.com/e107inc/e107v1/issues/2 - http://packetstormsecurity.com/files/129872/CMS-e107-1.0.4-Cross-Site-Scripting.h
//github.com/e107inc/e107v1/issues/2 - http://packetstormsecurity.com/files/129872/CMS-e107-1.0.4-Cross-Site-Scripting.html - http://www.openwall.com/lists/oss-security/2015/01/11/6 - http://www.securityfocus.com/bid/71977 - http://sroesemann.blogspot.de/2014/12/sroeadv-2014-05.html - http://seclists.org/fulldisclosure/2015/Jan/18
CVE ID: CVE-2015-1042 State: PUBLISHED Published: 2015-02-10T20:00:00 Last Updated: 2024-08-06T04:33:20.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. Additional Analyst Notes: - CVE Program Container: References: - https://www.mantisbt.org/bugs/view.php?id=17997 - http://www.securitytracker.com/id/1031633 - http://www.openwall.com/lists/oss