Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-1390 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T20:11:53.407Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE ID: CVE-2015-1391 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T19:18:54.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE ID: CVE-2015-1392 State: PUBLISHED Published: 2015-05-28T14:00:00 Last Updated: 2024-08-06T04:40:18.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt
CVE ID: CVE-2015-1393 State: PUBLISHED Published: 2015-02-02T15:00:00 Last Updated: 2024-08-06T04:40:18.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534569/100/0/threaded - https://plugins.trac.wordpress.org/changeset/1074134/photo-gallery
CVE ID: CVE-2015-1394 State: PUBLISHED Published: 2020-02-08T16:45:44 Last Updated: 2024-08-06T04:40:18.584Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/photo-gallery/changelog/ - http://www.securityfocus
- CVE Program Container: References: - https://wordpress.org/plugins/photo-gallery/changelog/ - http://www.securityfocus.com/archive/1/archive/1/534568/100/0/threaded - https://plugins.trac.wordpress.org/changeset/1073334/ - https://plugins.trac.wordpress.org/changeset/1076678/photo-gallery - https://seclists.org/bugtraq/2015/Jan/140
CVE ID: CVE-2015-1395 State: PUBLISHED Published: 2017-08-25T18:00:00 Last Updated: 2024-08-06T04:40:18.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775873 - http://www.securityfocus.com/bid/72846 - http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148953.html - https://savannah.gnu.org/bugs/?44059 - http://ww
fedoraproject.org/pipermail/package-announce/2015-January/148953.html - https://savannah.gnu.org/bugs/?44059 - http://www.openwall.com/lists/oss-security/2015/01/27/28 - https://git.savannah.gnu.org/cgit/patch.git/commit/?id=17953b5893f7c9835f0dd2a704ba04e0371d2cbd - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154214.html - http://www.ubuntu.com/usn/USN-2651-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1184490
CVE ID: CVE-2015-1396 State: PUBLISHED Published: 2019-11-25T15:44:16 Last Updated: 2024-08-06T04:40:18.555Z Vendors: n/a Products: n/a Problem Types: directory traversal Description: A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/01/27/29 - http://www.securityfocus.com/bid/75358 - https://bugzilla.redhat.com/show_bug.cgi?id=1186764 - http://www.securityfocus.com/bid/75358 - http://www.ubuntu.com/usn
https://bugzilla.redhat.com/show_bug.cgi?id=1186764 - http://www.securityfocus.com/bid/75358 - http://www.ubuntu.com/usn/USN-2651-1 - http://www.openwall.com/lists/oss-security/2015/01/27/29
CVE ID: CVE-2015-1397 State: PUBLISHED Published: 2015-04-29T22:00:00 Last Updated: 2024-08-06T04:40:18.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set. Additional Analyst Notes: - CVE Program Container: References: - http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability - http://www.securit
ttp://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability - http://www.securitytracker.com/id/1032194 - https://blog.sucuri.net/2015/04/magento-shoplift-supee-5344-exploits-in-the-wild.html - http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
CVE ID: CVE-2015-1398 State: PUBLISHED Published: 2015-04-29T22:00:00 Last Updated: 2024-08-06T04:40:18.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators migh
function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files. Additional Analyst Notes: - CVE Program Container: References: - http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability - http://www.securitytracker.com/id/1032194 - http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
CVE ID: CVE-2015-1399 State: PUBLISHED Published: 2015-04-29T22:00:00 Last Updated: 2024-08-06T04:40:18.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files. Additional Analyst Notes: - CVE Program Container: References: -
ght already have privileges to include arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability - http://www.securitytracker.com/id/1032194 - http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/
CVE ID: CVE-2015-1400 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.npds.org/viewtopic.php?topic=26189&forum=12 - http://www.npds.org/viewtopic.php?topic=26233&forum=12 - http://packetstormsecurity.com/files/130179/NPDS-CMS-Revolution-13-SQL-Injection.html - http://websecgeeks.com/npds-cms-sql-injection/
CVE ID: CVE-2015-1401 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T04:40:18.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71981 - http://www.openwall.com/lists/oss-security/2015/01/27/31 - http://www.openwall.com/lists/oss-security/2015/01/11/7
CVE ID: CVE-2015-1402 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71984 - http://www.openwall.com/lists/oss-security/2015/01/11/7 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/ - http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE ID: CVE-2015-1403 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71984 - http://www.openwall.com/lists/oss-security/2015/01/11/7 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/ - http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE ID: CVE-2015-1404 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.693Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71985 - http://www.openwall.com/lists/oss-security/2015/01/11/7 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/ - http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE ID: CVE-2015-1405 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/71985 - http://www.openwall.com/lists/oss-security/2015/01/11/7 - http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/ - http://www.openwall.com/lists/oss-security/2015/01/27/31
CVE ID: CVE-2015-1414 State: PUBLISHED Published: 2015-02-27T15:00:00 Last Updated: 2024-08-06T04:40:18.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3175 - http://www.securityfocus.com/bid/72777 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc - https://kc.mcafee.com/corporate/ind
/bid/72777 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:04.igmp.asc - https://kc.mcafee.com/corporate/index?page=content&id=SB10107 - http://www.securitytracker.com/id/1031798 - https://www.pfsense.org/security/advisories/pfSense-SA-15_02.igmp.asc
CVE ID: CVE-2015-1415 State: PUBLISHED Published: 2015-04-10T14:00:00 Last Updated: 2024-08-06T04:40:18.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1032042 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:08.bsdinstall.asc - http://www.securityfocus.com/archive/1/535209/100/0/threaded - http://packetstormsecuri
reeBSD-SA-15:08.bsdinstall.asc - http://www.securityfocus.com/archive/1/535209/100/0/threaded - http://packetstormsecurity.com/files/131338/FreeBSD-10.x-ZFS-encryption.key-Disclosure.html
CVE ID: CVE-2015-1416 State: PUBLISHED Published: 2018-02-05T16:00:00 Last Updated: 2024-08-06T04:40:18.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/08/02/1 - http://www.openwall.com/lists/oss-security/2015/07/30/9 - http://www.openwall.com/lists/oss-security/2015/08/01/4 - https://www.fre
openwall.com/lists/oss-security/2015/07/30/9 - http://www.openwall.com/lists/oss-security/2015/08/01/4 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:14.bsdpatch.asc - http://www.securitytracker.com/id/1033110 - http://www.securityfocus.com/bid/76116 - http://www.openwall.com/lists/oss-security/2015/08/02/6
CVE ID: CVE-2015-1417 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-06T04:40:18.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033111 - http://www.securityfocus.com/bid/76112 - https://ww
Container: References: - http://www.securitytracker.com/id/1033111 - http://www.securityfocus.com/bid/76112 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:15.tcp.asc
CVE ID: CVE-2015-1418 State: PUBLISHED Published: 2018-02-05T16:00:00 Last Updated: 2024-08-06T04:40:18.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program. Additional Analyst Notes: - CVE Program Container: References: - https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig - http://www.securityfocus.com/bid/76236 - http://www
ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig - http://www.securityfocus.com/bid/76236 - http://www.securitytracker.com/id/1033188 - https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc - http://rachelbythebay.com/w/2018/04/05/bangpatch/ - https://bugs.debian.org/894667
CVE ID: CVE-2015-1419 State: PUBLISHED Published: 2015-01-28T11:00:00 Last Updated: 2024-08-06T04:40:18.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00023.html - http://lists.opensuse.org/opensuse-updates/2015-01/msg00041.html - http://secunia.com/advisories/62415
CVE ID: CVE-2015-1420 State: PUBLISHED Published: 2015-03-16T10:00:00 Last Updated: 2024-08-06T04:40:18.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3170 - http://www.ubuntu.com/usn/USN-2660-1 - http://www.openwall.com/lists/oss-security/2015/01/29/12 - http://www.ubuntu.c
- http://www.ubuntu.com/usn/USN-2660-1 - http://www.openwall.com/lists/oss-security/2015/01/29/12 - http://www.ubuntu.com/usn/USN-2665-1 - http://marc.info/?l=linux-kernel&m=142247707318982&w=2 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html - http://www.ubuntu.com/usn/USN-2661-1 - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - https://bugzilla.redhat.com/show_bug.cgi?id=1187534 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html - http://www.securityfocus.com/bid/72357 - http://www.ubuntu.com/usn/USN-2667-1 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.
com/usn/USN-2667-1 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
CVE ID: CVE-2015-1421 State: PUBLISHED Published: 2015-03-16T10:00:00 Last Updated: 2024-08-06T04:40:18.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3170 - http://www.ubuntu.com/usn/USN-2542-1 - http://www.ubuntu.com/usn/USN-2562-1 - http://www.ubu
rg/security/2015/dsa-3170 - http://www.ubuntu.com/usn/USN-2542-1 - http://www.ubuntu.com/usn/USN-2562-1 - http://www.ubuntu.com/usn/USN-2546-1 - http://rhn.redhat.com/errata/RHSA-2015-1082.html - http://www.ubuntu.com/usn/USN-2541-1 - http://rhn.redhat.com/errata/RHSA-2015-0751.html - http://www.ubuntu.com/usn/USN-2563-1 - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00001.html - https://github.com/torvalds/linux/commit/600ddd6825543962fb807884169e57b580dba208 - http://www.securitytracker.com/id/1032172 - http://rhn.redhat.com/errata/RHSA-2015-0864.html - http://www.openwall.com/lists/oss-security/2015/01/29/15 - http://rhn.redhat.com/errata/RHSA-2015-0782.html - http://ww
http://www.openwall.com/lists/oss-security/2015/01/29/15 - http://rhn.redhat.com/errata/RHSA-2015-0782.html - http://www.ubuntu.com/usn/USN-2545-1 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=600ddd6825543962fb807884169e57b580dba208 - https://bugzilla.redhat.com/show_bug.cgi?id=1196581 - http://rhn.redhat.com/errata/RHSA-2015-0726.html - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.8 - http://www.securityfocus.com/bid/72356
CVE ID: CVE-2015-1422 State: PUBLISHED Published: 2015-01-29T15:00:00 Last Updated: 2024-08-06T04:40:18.695Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp,
_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php - http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html - http://www.exploit-db.com/exploits/35767 - http://osvdb.org/show/osvdb/116970 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99977 - http://osvdb.org/show/
http://osvdb.org/show/osvdb/116970 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99977 - http://osvdb.org/show/osvdb/116969 - http://osvdb.org/show/osvdb/116967
CVE ID: CVE-2015-1423 State: PUBLISHED Published: 2015-01-29T15:00:00 Last Updated: 2024-08-06T04:40:18.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php - http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html - http://www.exploit-db.com/exploits/35767 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99976 - http://osv
tml - http://www.exploit-db.com/exploits/35767 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99976 - http://osvdb.org/show/osvdb/116968
CVE ID: CVE-2015-1424 State: PUBLISHED Published: 2015-01-29T15:00:00 Last Updated: 2024-08-06T04:40:18.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php - http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html - http://www.exploit-db.com/exploits/35767 - http://osvdb.org/show/osvdb/116966 -
S-2.2-2.3-CSRF-XSS-SQL-Injection.html - http://www.exploit-db.com/exploits/35767 - http://osvdb.org/show/osvdb/116966 - https://exchange.xforce.ibmcloud.com/vulnerabilities/99974