Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-9363 State: PUBLISHED Published: 2014-12-10T20:00:00Z Last Updated: 2024-09-17T00:45:36.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the path-based meta tag editing form in the Meta tags quick module 7.x-2.x before 7.x-2.8 for Drupal allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2296511 - https://www.drupal.org/node/2295975
CVE ID: CVE-2014-9364 State: PUBLISHED Published: 2014-12-10T20:00:00Z Last Updated: 2024-09-16T20:42:02.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2300369 - https://www.drupal.org/node/2299467
CVE ID: CVE-2014-9365 State: PUBLISHED Published: 2014-12-12T11:00:00 Last Updated: 2024-08-06T13:40:25.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP clients in the (1) httplib, (2) urllib, (3) urllib2, and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: Re
attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1162 - https://www.python.org/dev/peps/pep-0476/ - http://www.securityfocus.com/bid/71639 - https://access.redhat.com/errata/RHSA-2016:1166 - https://access.redhat.com/errata/RHSA-2017:1868 - http://bugs.python.org/issue22417 - https://security.gentoo.org/glsa/201503-10 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - https://www.python.org/downloads/release/python-279/ - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://www.openwall.com/lists/oss-securit
tp://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://www.openwall.com/lists/oss-security/2014/12/11/1 - https://support.apple.com/kb/HT205031 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2014-9367 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a "'" (single quote) in the scope parameter to do/view/TWiki/WebSearch. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129655/TWiki-6.0.0-6.0.1-WebSearch-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/Dec/82 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-9367 - http
http://seclists.org/fulldisclosure/2014/Dec/82 - http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-9367 - http://www.securitytracker.com/id/1031400
CVE ID: CVE-2014-9368 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the twitterDash plugin 2.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the username_twitterDash parameter in the twitterDash.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129579/WordPress-twitterDash-2.1-CSRF-XSS.html
CVE ID: CVE-2014-9369 State: PUBLISHED Published: 2015-03-07T02:00:00 Last Updated: 2024-08-06T13:40:25.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Siemens SPC controllers SPC4000, SPC5000, and SPC6000 before 3.6.0 allow remote attackers to cause a denial of service (device restart) via crafted packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-335471.pdf
CVE ID: CVE-2014-9371 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:40:25.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NativeAppServlet in ManageEngine Desktop Central MSP before 90075 allows remote attackers to execute arbitrary code via a crafted JSON object. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-420/
CVE ID: CVE-2014-9372 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:40:25.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files via a .. (dot dot) in a filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-421/ - http://www.manageengine.com/products/passwordmanagerpro/release-notes.html
CVE ID: CVE-2014-9373 State: PUBLISHED Published: 2014-12-16T18:00:00 Last Updated: 2024-08-06T13:40:25.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. (dot dot) in the filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-14-422/
CVE ID: CVE-2014-9374 State: PUBLISHED Published: 2014-12-12T15:00:00 Last Updated: 2024-08-06T13:40:25.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame. Additional Analyst Notes: - CVE Program Container: References: - http://advisories.mageia.org/MGASA-2015-0010.html - http://downloads.asterisk.org/pub/security/AST-2014-019.html - http://www.mandri
ories.mageia.org/MGASA-2015-0010.html - http://downloads.asterisk.org/pub/security/AST-2014-019.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:018 - http://www.securityfocus.com/archive/1/534197/100/0/threaded - http://packetstormsecurity.com/files/129473/Asterisk-Project-Security-Advisory-AST-2014-019.html - http://www.securityfocus.com/bid/71607 - http://seclists.org/fulldisclosure/2014/Dec/48 - http://secunia.com/advisories/60251 - http://www.securitytracker.com/id/1031345
CVE ID: CVE-2014-9375 State: PUBLISHED Published: 2015-02-16T15:00:00 Last Updated: 2024-08-06T13:40:25.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the LibraryFileUploadServlet servlet in Lexmark Markvision Enterprise allows remote authenticated users to write to and execute arbitrary files via a .. (dot dot) in a file path in a ZIP archive. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-15-046/ - http://support.lexmark.com/index?page=content&id=TE677
CVE ID: CVE-2014-9376 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code via a small (1) size variable value in the dissector_dhcp function in dissectors/ec_dhcp.c, (2) length value to the dissector_gg function in dissectors/ec_gg.c, or (3) string length to the get_decode_len function in ec_utils.c or a request without a (4) username or (5) password to the dissector_TN3270 function in dissectors/ec_TN3270.c. Additional Analyst Notes: - CVE Program Contai
(5) password to the dissector_TN3270 function in dissectors/ec_TN3270.c. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://github.com/Ettercap/ettercap/pull/606 - http://www.securityfocus.com/bid/71696 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - https://github.com/Ettercap/ettercap/pull/602 - https://github.com/Ettercap/ettercap/pull/605 - http://www.securityfocus.com/archive/1/534248/100/0/threaded - https://github.com/Ettercap/ettercap/pull/609
CVE ID: CVE-2014-9377 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the nbns_spoof function in plug-ins/nbns_spoof/nbns_spoof.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large netbios packet. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://github.com/Ettercap/ettercap/pull/603 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - http://www.securityfocus.com/bid/71690 - http://www.securityfocus.com/ar
curity-labs/advisories/osi-advisory-osi-1402/ - http://www.securityfocus.com/bid/71690 - http://www.securityfocus.com/archive/1/534248/100/0/threaded
CVE ID: CVE-2014-9378 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parse_line function in mdns_spoof/mdns_spoof.c or (2) base64 encoded password to the dissector_imap function in dissectors/ec_imap.c. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - https://github.com/Ett
rg/glsa/201505-01 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - https://github.com/Ettercap/ettercap/pull/610 - http://www.securityfocus.com/archive/1/534248/100/0/threaded - http://www.securityfocus.com/bid/71695 - https://github.com/Ettercap/ettercap/pull/604
CVE ID: CVE-2014-9379 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:24.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: The radius_get_attribute function in dissectors/ec_radius.c in Ettercap 0.8.1 performs an incorrect cast, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which triggers a stack-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://github.com/Ettercap/ettercap/pull/607 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - http://www.securi
rcap/ettercap/pull/607 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - http://www.securityfocus.com/bid/71698 - http://www.securityfocus.com/archive/1/534248/100/0/threaded
CVE ID: CVE-2014-9380 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVS_LOGIN signature. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://github.com/Ettercap/ettercap/pull/608 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - http://www.securityfocus.com/archive/1/534248/100/0/threaded - http://www.securityfocus.com/bid/71691
CVE ID: CVE-2014-9381 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T13:40:25.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - http://www.securityfocus.com/bid/71693 - http://www.securityfocus.com/archive/1/534248/100/0/threaded - https://github.co
ttp://www.securityfocus.com/bid/71693 - http://www.securityfocus.com/archive/1/534248/100/0/threaded - https://github.com/Ettercap/ettercap/pull/609
CVE ID: CVE-2014-9382 State: PUBLISHED Published: 2020-01-13T13:42:07 Last Updated: 2024-08-06T13:40:24.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Freebox OS Web interface 3.0.2 has CSRF which can allow VPN user account creation Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132121/FreeBox-3.0.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/74936 - http://seclists.org/fulldisclosure/2015/Jun/1
CVE ID: CVE-2014-9385 State: PUBLISHED Published: 2014-12-15T17:27:00 Last Updated: 2024-08-06T13:40:25.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger arbitrary code execution via a ZenPack upload, aka ZEN-15388. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/449452 - https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing
CVE ID: CVE-2014-9386 State: PUBLISHED Published: 2014-12-15T17:27:00 Last Updated: 2024-08-06T13:40:24.989Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workstation, aka ZEN-12691. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/449452 - https://docs.google.com/spreadsheets/d/1dHAc4PxUbs-4Dxzm1wSCE0sMz5UCMY6SW3PlMHSyuuQ/edit?usp=sharing
CVE ID: CVE-2014-9387 State: PUBLISHED Published: 2014-12-17T19:00:00 Last Updated: 2024-08-06T13:40:25.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call, aka SAP Note 2039905. Additional Analyst Notes: - CVE Program Container: References: - http://www.onapsis.com/research/security-advisories/sap-business-objects-search-token-privilege-escalation-via-corba - http://seclists.org/fulldisclosure/2014/Dec/60 - http://www.securityfocus.com/archive/1/534249/100/0/threaded
CVE ID: CVE-2014-9388 State: PUBLISHED Published: 2014-12-17T19:00:00 Last Updated: 2024-08-06T13:40:25.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q4/955 - https://www.mantisbt.org/bugs/view.php?id=17878 - http://secunia.com/advisories/62101 - https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 - http://www.debian.org/security/2015/dsa-3120
CVE ID: CVE-2014-9389 State: PUBLISHED Published: 2015-01-05T20:00:00 Last Updated: 2024-08-06T13:40:25.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Sonatype Nexus OSS and Pro before 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.sonatype.org/advisories/archive/2014-12-23-Nexus/ - http://secunia.com/advisories/61134 - https://support.sonatype.com/entries/84705937-CVE-2014-9389-Nexus-Security-Advisory-Directory-Traversal
CVE ID: CVE-2014-9390 State: PUBLISHED Published: 2020-02-12T01:58:27 Last Updated: 2024-08-06T13:40:25.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (
e containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=8769667 - http://article.gmane.org/gmane.linux.kernel/1853266 - http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html - http://mercurial.selenic.com/wiki/WhatsNew - http://support.apple.com/kb/HT204147 - https://github.com/blog/1938-git-client-vulnerability-announced - http://securitytracker.com/id?1031404 - https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a
ounced - http://securitytracker.com/id?1031404 - https://github.com/libgit2/libgit2/commit/928429c5c96a701bcbcafacb2421a82602b36915 - https://libgit2.org/security/
CVE ID: CVE-2014-9391 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) rss, (2) display_time or (3) transistion_time parameter in the gslideshow.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129637/WordPress-gSlideShow-0.1-CSRF-XSS.html
CVE ID: CVE-2014-9392 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:24.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the pictoBrowserFlickrUser parameter in the options-page.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129638/WordPress-PictoBrowser-0.3.1-CSRF-XSS.html
CVE ID: CVE-2014-9393 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) idptt_twitter_username or (2) idptt_tweet_prefix parameter to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99482 - http://packetstormsecurity.com/files/129639/WordPres
ces: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99482 - http://packetstormsecurity.com/files/129639/WordPress-Twitter-0.7-CSRF-XSS.html
CVE ID: CVE-2014-9394 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) pwgrandom_title or (2) pwgrandom_category parameter in the pwgrandom page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129640/WordPress-PWG-Random-1.11-CSRF-XSS.html - https://exchange.
r: References: - http://packetstormsecurity.com/files/129640/WordPress-PWG-Random-1.11-CSRF-XSS.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/99437
CVE ID: CVE-2014-9395 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) simplehoverback, (2) simplehovertext, (3) flickrback, or (4) simple_flimit parameter in the simplelife.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129641/WordPress-Simplelife-
Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/129641/WordPress-Simplelife-1.2-CSRF-XSS.html
CVE ID: CVE-2014-9396 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) simpleflickr_width, (2) simpleflickr_bgcolor, or (3) simpleflickr_xmldatapath parameter in the simpleFlickr.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/993
dditional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99395 - http://packetstormsecurity.com/files/129642/WordPress-SimpleFlickr-3.0.3-CSRF-XSS.html
CVE ID: CVE-2014-9397 State: PUBLISHED Published: 2014-12-31T21:00:00 Last Updated: 2024-08-06T13:40:25.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the message_format parameter in the twimp-wp.php page to wp-admin/options-general.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/99380 - http://packetstormsecurity.com/files/129643/WordPress-twimp-wp-Cross-Site-Request-Forgery-Cross-Si
lnerabilities/99380 - http://packetstormsecurity.com/files/129643/WordPress-twimp-wp-Cross-Site-Request-Forgery-Cross-Site-Scripting.html