Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3275 State: PUBLISHED Published: 2016-02-22T02:00:00 Last Updated: 2024-08-06T05:39:32.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/07/13/2 - https://moodle.org/mod/forum/discuss.php?d=316665 - http://www.securitytracker.com/id/1032877 - http
rity/2015/07/13/2 - https://moodle.org/mod/forum/discuss.php?d=316665 - http://www.securitytracker.com/id/1032877 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50614
CVE ID: CVE-2015-3276 State: PUBLISHED Published: 2015-12-07T20:00:00 Last Updated: 2024-08-06T05:39:32.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-2131.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - https://bugzilla.redhat.com/show_bug.cgi?id=1238322
.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - https://bugzilla.redhat.com/show_bug.cgi?id=1238322 - http://www.securitytracker.com/id/1034221
CVE ID: CVE-2015-3277 State: PUBLISHED Published: 2017-08-09T18:00:00 Last Updated: 2024-08-06T05:39:32.033Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170607.html - https://bugzilla.redhat.com/show_bug.cgi?id=1243518 - https://bugzilla.redhat.com/show_bug.cgi?id=1238324
CVE ID: CVE-2015-3278 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-06T05:39:32.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which allows attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1238326
CVE ID: CVE-2015-3279 State: PUBLISHED Published: 2015-07-14T16:00:00 Last Updated: 2024-08-06T05:39:32.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in filter/texttopdf.c in texttopdf in cups-filters before 1.0.71 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted line size in a print job, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://ubuntu.com/usn/usn-2659-1 - https://security.gentoo.org/glsa/201510-08 - http://www.openwall.com/lists/oss-security/2015/07/03/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1238990 - http://www.o
://www.openwall.com/lists/oss-security/2015/07/03/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1238990 - http://www.openwall.com/lists/oss-security/2015/07/03/2 - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7365 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7366#NEWS - http://lists.opensuse.org/opensuse-updates/2015-07/msg00033.html - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7369 - http://www.debian.org/security/2015/dsa-3303 - http://www.securityfocus.com/bid/75557 - http://rhn.redhat.com/errata/RHSA-20
://www.debian.org/security/2015/dsa-3303 - http://www.securityfocus.com/bid/75557 - http://rhn.redhat.com/errata/RHSA-2015-2360.html
CVE ID: CVE-2015-3280 State: PUBLISHED Published: 2015-10-26T17:00:00 Last Updated: 2024-08-06T05:39:32.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1898.html - https://launchpad.net/bugs/1392527 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://www.securityfoc
t/bugs/1392527 - http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html - http://www.securityfocus.com/bid/76553 - https://security.openstack.org/ossa/OSSA-2015-017.html
CVE ID: CVE-2015-3281 State: PUBLISHED Published: 2015-07-06T14:55:00 Last Updated: 2024-08-06T05:39:32.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-1741.html - http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00023.html - http://www.haproxy.org/news.html - http://rhn.redh
lists.opensuse.org/opensuse-security-announce/2015-10/msg00023.html - http://www.haproxy.org/news.html - http://rhn.redhat.com/errata/RHSA-2015-2666.html - http://www.ubuntu.com/usn/USN-2668-1 - http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html - http://git.haproxy.org/?p=haproxy-1.5.git%3Ba=commit%3Bh=7ec765568883b2d4e5a2796adbeb492a22ec9bd4 - http://www.debian.org/security/2015/dsa-3301 - http://www.securityfocus.com/bid/75554
CVE ID: CVE-2015-3282 State: PUBLISHED Published: 2015-08-12T14:00:00 Last Updated: 2024-08-06T05:39:32.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: vos in OpenAFS before 1.6.13, when updating VLDB entries, allows remote attackers to obtain stack data by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033262 - https://www.openafs.org/dl/openafs/1.6.13/RELNOTES-1.6.13 - http://www.openafs.org/pages/security/OPENAFS-SA-2015-001.txt - http://www.debian.org/security/2015/dsa-3320 - https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html
CVE ID: CVE-2015-3283 State: PUBLISHED Published: 2015-08-12T14:00:00 Last Updated: 2024-08-06T05:39:32.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenAFS before 1.6.13 allows remote attackers to spoof bos commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033262 - https://www.openafs.org/dl/openafs/1.6.13/RELNOTES-1.6.13 - http://www.debian.org/security/2015/dsa-3320 - https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html - http://www.openafs.org/pages/security/OPENAFS-SA-2015-002.txt
CVE ID: CVE-2015-3284 State: PUBLISHED Published: 2015-08-12T14:00:00 Last Updated: 2024-08-06T05:39:32.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: pioctls in OpenAFS 1.6.x before 1.6.13 allows local users to read kernel memory via crafted commands. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033262 - https://www.openafs.org/dl/openafs/1.6.13/RELNOTES-1.6.13 - http://www.openafs.org/pages/security/OPENAFS-SA-2015-003.txt - http://www.debian.org/security/2015/dsa-3320 - https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html
CVE ID: CVE-2015-3285 State: PUBLISHED Published: 2015-08-12T14:00:00 Last Updated: 2024-08-06T05:39:32.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pioctl for the OSD FS command in OpenAFS before 1.6.13 uses the wrong pointer when writing the results of the RPC, which allows local users to cause a denial of service (memory corruption and kernel panic) via a crafted OSD FS command. Additional Analyst Notes: - CVE Program Container: References: - http://www.openafs.org/pages/security/OPENAFS-SA-2015-004.txt - http://www.securitytracker.com/id/1033262 - https://www.openafs.org/dl/openafs/1.6.13/RELNOTES-1.6.13 - http://www.debian.org/security/2015/dsa-3320 - https://list
https://www.openafs.org/dl/openafs/1.6.13/RELNOTES-1.6.13 - http://www.debian.org/security/2015/dsa-3320 - https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html
CVE ID: CVE-2015-3286 State: PUBLISHED Published: 2015-08-12T14:00:00 Last Updated: 2024-08-06T05:39:32.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the Solaris kernel extension in OpenAFS before 1.6.13 allows local users to cause a denial of service (panic or deadlock) or possibly have other unspecified impact via a large group list when joining a PAG. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033262 - http://www.openafs.org/pages/security/OPENAFS-SA-2015-005.txt - https://www.openafs.org/dl/openafs/1.6.13/RELNOTES-1.6.13 - https://lists.openafs.org/pipermail/openafs-announce/2015/000486.html
CVE ID: CVE-2015-3287 State: REJECTED Published: 2015-08-12T14:00:00 Last Updated: 2015-09-02T06:57:04 Description: No description available.
CVE ID: CVE-2015-3288 State: PUBLISHED Published: 2016-10-16T21:00:00 Last Updated: 2024-08-06T05:39:32.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/6b7339f4c31ad69c8e9c0b2859276e22cf72176d - https://source.android.com/security/bulletin/2017-01-01.html - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4 - https://security-tracker.debian.or
letin/2017-01-01.html - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4 - https://security-tracker.debian.org/tracker/CVE-2015-3288 - http://www.securityfocus.com/bid/93591 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b7339f4c31ad69c8e9c0b2859276e22cf72176d - https://bugzilla.redhat.com/show_bug.cgi?id=1333830
CVE ID: CVE-2015-3289 State: PUBLISHED Published: 2015-08-14T18:00:00 Last Updated: 2024-08-06T05:39:32.072Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Glance before 2015.1.1 (kilo) allows remote authenticated users to cause a denial of service (disk consumption) by repeatedly using the import task flow API to create images and then deleting them. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76068 - http://lists.openstack.org/pipermail/openstack-announce/2015-July/000481.html - https://bugs.launchpad.net/glance/+bug/1454087
CVE ID: CVE-2015-3290 State: PUBLISHED Published: 2015-08-31T10:00:00 Last Updated: 2024-08-06T05:39:32.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1243465 - http://www.openwall.com/lists/oss-security/2015/08/04/8 - http://www.securityfocus.com/bid/76004 - https://www.exploit-db.com/exploits/37722/ - http://www.ubuntu.com/usn
8/04/8 - http://www.securityfocus.com/bid/76004 - https://www.exploit-db.com/exploits/37722/ - http://www.ubuntu.com/usn/USN-2689-1 - http://www.ubuntu.com/usn/USN-2690-1 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b6e6a8334d56354853f9c255d1395c2ba570e0a - http://www.ubuntu.com/usn/USN-2691-1 - http://www.ubuntu.com/usn/USN-2688-1 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://www.debian.org/security/2015/dsa-3313 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6 - http://www.openwall.com/lists/oss-security/2015/07/22/7 - https://github.com/torvalds/linux/commit/9b6e6a8334d56354853f9c255d1395c2ba570e0a - http
sts/oss-security/2015/07/22/7 - https://github.com/torvalds/linux/commit/9b6e6a8334d56354853f9c255d1395c2ba570e0a - http://www.ubuntu.com/usn/USN-2687-1
CVE ID: CVE-2015-3291 State: PUBLISHED Published: 2015-08-31T10:00:00 Last Updated: 2024-08-06T05:39:32.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1243489 - http://www.securityfocus.com/bid/76003 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commi
=1243489 - http://www.securityfocus.com/bid/76003 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=810bc075f78ff2c221536eb3008eac6a492dba2d - https://github.com/torvalds/linux/commit/810bc075f78ff2c221536eb3008eac6a492dba2d - http://www.ubuntu.com/usn/USN-2689-1 - http://www.ubuntu.com/usn/USN-2690-1 - http://www.ubuntu.com/usn/USN-2691-1 - http://www.ubuntu.com/usn/USN-2688-1 - http://www.debian.org/security/2015/dsa-3313 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6 - http://www.openwall.com/lists/oss-security/2015/07/22/7 - http://www.ubuntu.com/usn/USN-2687-1
CVE ID: CVE-2015-3292 State: PUBLISHED Published: 2015-05-31T17:00:00 Last Updated: 2024-08-06T05:39:32.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74891 - https://kb.netapp.com/support/index?page=content&id=9010037
CVE ID: CVE-2015-3293 State: PUBLISHED Published: 2015-04-14T18:00:00 Last Updated: 2024-08-06T05:39:32.085Z Vendors: n/a Products: n/a Problem Types: n/a Description: FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032185 - http://www.fortiguard.com/advisory/FG-IR-15-009/
CVE ID: CVE-2015-3294 State: PUBLISHED Published: 2015-05-08T14:00:00 Last Updated: 2024-08-06T05:39:32.054Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcp_request function in Dnsmasq before 2.73rc4 does not properly handle the return value of the setup_reply function, which allows remote attackers to read process memory and cause a denial of service (out-of-bounds read and crash) via a malformed DNS request. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3251 - http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009382.html - http://lists.opensuse.org/opensuse-updates/2015-05/msg00013.html - http://the
rmail/dnsmasq-discuss/2015q2/009382.html - http://lists.opensuse.org/opensuse-updates/2015-05/msg00013.html - http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commitdiff%3Bh=ad4a8ff7d9097008d7623df8543df435bfddeac8 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.ubuntu.com/usn/USN-2593-1 - https://security.gentoo.org/glsa/201512-01 - http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q2/009387.html - http://www.securitytracker.com/id/1032195 - http://www.securityfocus.com/bid/74452 - http://www.securityfocus.com/archive/1/535354/100/1100/threaded
CVE ID: CVE-2015-3295 State: PUBLISHED Published: 2017-06-07T21:00:00 Last Updated: 2024-08-06T05:39:32.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: markdown-it before 4.1.0 does not block data: URLs. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/10/10 - http://www.securityfocus.com/bid/71824 - https://github.com/markdown-it/markdown-it/commit/f76d3beb46abd121892a2e2e5c78376354c214e3
CVE ID: CVE-2015-3296 State: PUBLISHED Published: 2017-09-21T14:00:00 Last Updated: 2024-08-06T05:39:32.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/10/10 - http://www.securityfocus.com/bid/71824 - https://github.com/julianlam/nodebb-plugin-markdown/commit/ab7f2684750882f7baefbfa31db8d5aac71e6ec3
CVE ID: CVE-2015-3297 State: PUBLISHED Published: 2017-07-07T16:00:00 Last Updated: 2024-08-06T05:39:32.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replacement of backslashes with slashes in the path parameter of HTTP API requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/04/11/1 - http://www.securityfocus.com/bid/74056 - https://github.com/ether/etherpad-lite/commit/9d4e5f6 - http://www.openwall.com/lists/oss-security/2015/04/12/1
CVE ID: CVE-2015-3298 State: PUBLISHED Published: 2022-03-29T23:16:10 Last Updated: 2024-08-06T05:39:32.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated. Additional Analyst Notes: - CVE Program Container: References: - https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html
CVE ID: CVE-2015-3299 State: PUBLISHED Published: 2017-09-19T15:00:00 Last Updated: 2024-08-06T05:39:32.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order. Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/1129648/floating-social-bar/trunk - http://www.securityfocus.com/bid/74053 - http://www.openwall.com/lists/oss-security/2015/04/13/10
CVE ID: CVE-2015-3300 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T05:39:32.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the (1) billing_firstname, (2) billing_lastname, (3) billing_company, (4) billing_tax_id_number, (5) billing_city, (6) billing_street, (7) billing_street_2, (8) billing_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shippi
ling_postcode, (9) billing_telephone_1, (10) billing_telephone_2, (11) billing_fax, (12) shipping_firstname, (13) shipping_lastname, (14) shipping_company, (15) shipping_tax_id_number, (16) shipping_city, (17) shipping_street, (18) shipping_street_2, (19) shipping_postcode, (20) shipping_telephone_1, (21) shipping_telephone_2, or (22) shipping_fax parameter to shopping-cart/checkout/; the (23) search_by parameter in the admin/AddressesList.php page to wp-admin/admin.php; the (24) address_id, (25) address_name, (26) firstname, (27) lastname, (28) street, (29) city, (30) postcode, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type
code, or (31) email parameter in the admin/AddressEdit.php page to wp-admin/admin.php; the (32) post_id or (33) rel_type parameter in the admin/AssignedCategoriesList.php page to wp-admin/admin.php; or the (34) post_type parameter in the admin/CustomFieldsList.php page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/show/osvdb/121472 - http://osvdb.org/show/osvdb/121471 - https://www.htbridge.com/advisory/HTB23254 - https://wordpress.org/plugins/thecartpress/changelog/ - http://osvdb.org/show/osvdb/121469 - http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html - http://osvdb.org/show/osv
ketstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html - http://osvdb.org/show/osvdb/121470 - http://www.securityfocus.com/bid/74395 - https://www.exploit-db.com/exploits/36860/ - http://www.securityfocus.com/archive/1/535396/100/0/threaded - http://osvdb.org/show/osvdb/121438
CVE ID: CVE-2015-3301 State: PUBLISHED Published: 2015-05-14T14:00:00 Last Updated: 2024-08-06T05:39:32.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. (dot dot) in the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23254 - https://wordpress.org/plugins/thecartpress/changelog/ - http://packetstormsecurity.com/files/131
com/advisory/HTB23254 - https://wordpress.org/plugins/thecartpress/changelog/ - http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html - http://osvdb.org/show/osvdb/121439 - http://www.securityfocus.com/bid/74395 - https://www.exploit-db.com/exploits/36860/ - http://www.securityfocus.com/archive/1/535396/100/0/threaded
CVE ID: CVE-2015-3302 State: PUBLISHED Published: 2017-12-29T22:00:00 Last Updated: 2024-08-06T05:39:32.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism." Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23254 - http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.html - http://www.securityfocus.com/archive/1/535396/100/1100/threaded - http
heCartPress-1.3.9-XSS-Local-File-Inclusion.html - http://www.securityfocus.com/archive/1/535396/100/1100/threaded - http://www.securityfocus.com/bid/74395 - https://www.exploit-db.com/exploits/36860/