Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-2187 State: PUBLISHED Published: 2015-03-08T02:00:00 Last Updated: 2024-08-06T05:10:16.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html - http://www.wireshark.org/security/wnpa-sec-2015-06.html - https://bug
nsuse.org/opensuse-updates/2015-03/msg00038.html - http://www.wireshark.org/security/wnpa-sec-2015-06.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9952 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=1a3dd349233a4ee3e69295c8e79f9a216027037e - http://www.securitytracker.com/id/1031858 - https://security.gentoo.org/glsa/201510-03 - http://www.securityfocus.com/bid/72940
CVE ID: CVE-2015-2188 State: PUBLISHED Published: 2015-03-08T02:00:00 Last Updated: 2024-08-06T05:10:15.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html - http://advisories.mageia.org/MGASA-2015-0117.html - http://www.security
use.org/opensuse-updates/2015-03/msg00038.html - http://advisories.mageia.org/MGASA-2015-0117.html - http://www.securitytracker.com/id/1031858 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:183 - http://www.debian.org/security/2015/dsa-3210 - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - https://security.gentoo.org/glsa/201510-03 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10844 - http://www.wireshark.org/security/wnpa-sec-2015-07.html - http://www.securityfocus.com/bid/72942 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh
.html - http://www.securityfocus.com/bid/72942 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=b204ff4846fe84b7789893c6b1d9afbdecac5b5d
CVE ID: CVE-2015-2189 State: PUBLISHED Published: 2015-03-08T02:00:00 Last Updated: 2024-08-06T05:10:15.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html - http://www.wireshark.org/security/wnpa-sec-2015-08.html - https://code.
use.org/opensuse-updates/2015-03/msg00038.html - http://www.wireshark.org/security/wnpa-sec-2015-08.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a835c85e3d662343d7283f1dcdacb8a11d1d0727 - http://www.securityfocus.com/bid/72944 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10895 - http://advisories.mageia.org/MGASA-2015-0117.html - http://www.securitytracker.com/id/1031858 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:183 - http://www.debian.org/security/2015/dsa-3210 - http://rhn.redhat.com/errata/RHSA-2015-1460.html - http://www.oracle.com/technetwo
w.debian.org/security/2015/dsa-3210 - http://rhn.redhat.com/errata/RHSA-2015-1460.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - https://security.gentoo.org/glsa/201510-03
CVE ID: CVE-2015-2190 State: PUBLISHED Published: 2015-03-08T02:00:00 Last Updated: 2024-08-06T05:10:15.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet that is improperly handled by the LLDP dissector. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html - http://www.securitytracker.com/id/1031858 - http://www.securityfocus.com/bid/72938 - http://www.oracle.com/t
0038.html - http://www.securitytracker.com/id/1031858 - http://www.securityfocus.com/bid/72938 - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - https://security.gentoo.org/glsa/201510-03 - http://www.wireshark.org/security/wnpa-sec-2015-09.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10983 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d1865e000ebedf49fc0d9f221a11d6af74360837
CVE ID: CVE-2015-2191 State: PUBLISHED Published: 2015-03-08T02:00:00 Last Updated: 2024-08-06T05:10:14.471Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html - http://www.securityfocus.com/bid/72941 - http://www.wireshark.org/security/wnpa-sec-2015-10.html - https://code.wireshark.org/revi
.securityfocus.com/bid/72941 - http://www.wireshark.org/security/wnpa-sec-2015-10.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=608cf324b3962877e9699f3e81e8f82ac9f1ea14 - http://advisories.mageia.org/MGASA-2015-0117.html - http://www.securitytracker.com/id/1031858 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11023 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:183 - http://www.debian.org/security/2015/dsa-3210 - http://rhn.redhat.com/errata/RHSA-2015-1460.html - https://security.gentoo.org/glsa/201510-03
CVE ID: CVE-2015-2192 State: PUBLISHED Published: 2015-03-08T02:00:00 Last Updated: 2024-08-06T05:10:15.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html - http://www.wireshark.org/security/wnpa-sec-2015-11.html - http://www.securitytracker.com/id/1031858 - https://code.wireshark.org/re
wireshark.org/security/wnpa-sec-2015-11.html - http://www.securitytracker.com/id/1031858 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c35ca6c051adb28c321db54cc138f18637977c9a - https://security.gentoo.org/glsa/201510-03 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11024 - http://www.securityfocus.com/bid/72937
CVE ID: CVE-2015-2194 State: PUBLISHED Published: 2015-03-03T19:00:00 Last Updated: 2024-08-06T05:10:15.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion_save action, then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130397/WordPress-Fusion-3.1-Arbitrary-File-Upload.html - https://wpvulndb.com/vulnerabilities/7795 - http://www.securityfocus.co
ordPress-Fusion-3.1-Arbitrary-File-Upload.html - https://wpvulndb.com/vulnerabilities/7795 - http://www.securityfocus.com/bid/75341
CVE ID: CVE-2015-2195 State: PUBLISHED Published: 2015-03-03T19:00:00 Last Updated: 2024-08-06T05:10:15.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534773/100/0/threaded
CVE ID: CVE-2015-2196 State: PUBLISHED Published: 2015-03-03T19:00:00Z Last Updated: 2024-09-17T00:15:42.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/36061
CVE ID: CVE-2015-2197 State: PUBLISHED Published: 2015-03-03T19:00:00Z Last Updated: 2024-09-16T18:04:22.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2437885 - https://www.drupal.org/node/2437905 - http://www.securityfocus.com/bid/72806
CVE ID: CVE-2015-2198 State: PUBLISHED Published: 2015-03-03T19:00:00Z Last Updated: 2024-09-17T02:17:12.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/36154 - http://sourceforge.net/p/beehiveforum/news/2015/02/beehive-forum-145-released/
CVE ID: CVE-2015-2199 State: PUBLISHED Published: 2015-03-03T19:00:00Z Last Updated: 2024-09-16T16:33:36.157Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. Additional Analyst Notes: - CVE Progr
_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html - http://osvdb.org/show/osvdb/118508 - http://www.exploit-db.com/exploits/36086 - http://osvdb.org/show/osvdb/118509 - http://www.wonderplugin.com/wordpress-audio-player/
CVE ID: CVE-2015-2201 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T17:42:40.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE ID: CVE-2015-2202 State: PUBLISHED Published: 2023-09-05T00:00:00 Last Updated: 2024-09-30T17:42:08.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-005.txt
CVE ID: CVE-2015-2203 State: PUBLISHED Published: 2018-02-01T17:00:00 Last Updated: 2024-08-06T05:10:15.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL. Additional Analyst Notes: - CVE Program Container: References: - http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 - http://www.openwall.com/lists/oss-security/2015/03/04/3 - http://www.securityfocus.com/bid/72885 - https://bugs.launchpad.net/evergreen/+bug/1206589 - http://git.evergreen-ils.org/?p=Evergreen.gi
tyfocus.com/bid/72885 - https://bugs.launchpad.net/evergreen/+bug/1206589 - http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063 - http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 - http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 - http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/
CVE ID: CVE-2015-2204 State: PUBLISHED Published: 2018-02-01T17:00:00 Last Updated: 2024-08-06T05:10:15.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided. Additional Analyst Notes: - CVE Program Container: References: - http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 - http://www.openwall.com/lists/oss-security/2015/03/04/3 - http://www.securityfocus.com/bid/72889 -
angeLog-2.7.3-2.7.4 - http://www.openwall.com/lists/oss-security/2015/03/04/3 - http://www.securityfocus.com/bid/72889 - http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=3a0f1cc7b2efa517ee4cd4c6a682237554fed307 - http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 - http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 - http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/ - https://bugs.launchpad.net/evergreen/+bug/1424755
CVE ID: CVE-2015-2206 State: PUBLISHED Published: 2015-03-09T17:00:00 Last Updated: 2024-08-06T05:10:15.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html - http://www.debian.org
rogram Container: References: - http://lists.opensuse.org/opensuse-updates/2015-07/msg00008.html - http://www.debian.org/security/2015/dsa-3382 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151331.html - http://www.securitytracker.com/id/1031871 - http://www.securityfocus.com/bid/72949 - https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151931.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:186 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151914.html - http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php
CVE ID: CVE-2015-2207 State: PUBLISHED Published: 2020-02-08T17:41:21 Last Updated: 2024-08-06T05:10:15.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132807/NetCracker-Resource-Management-System-8.0-Cross-Site-Scripting.html - http://www.securi
etstormsecurity.com/files/132807/NetCracker-Resource-Management-System-8.0-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/archive/1/536053/100/0/threaded
CVE ID: CVE-2015-2208 State: PUBLISHED Published: 2015-03-12T14:00:00 Last Updated: 2024-08-06T05:10:16.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Mar/19 - http://packetstormsecurity.com/files/130685/PHPMoAdmin-1.1.2-Remote-Code-Execution.html - http://www.exploit-db.com/exploits/36251 - http://www.openwall.com/lists/oss-security/2015/03/04/4 - http://www.openwall.com/lists/oss-security/2015/03/04/5
CVE ID: CVE-2015-2209 State: PUBLISHED Published: 2015-03-04T20:00:00 Last Updated: 2024-08-06T05:10:15.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://tetraph.com/security/full-path-disclosure-vulnerability/dlguard-full-path-disclosure-information-leakage-security-vulnerabilities/ - http://www.securityfocus.com/bid/72685 - http://seclists.org/fulldisclosure/2015/Feb/67
CVE ID: CVE-2015-2210 State: PUBLISHED Published: 2017-09-06T21:00:00 Last Updated: 2024-08-06T05:10:15.862Z Vendors: n/a Products: n/a Problem Types: n/a Description: The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.html - http://www.securityfocus.com/archive/1/535423/100/1000/threaded
CVE ID: CVE-2015-2212 State: REJECTED Published: 2015-08-03T14:00:00 Last Updated: 2015-08-03T12:57:02 Description: No description available.
CVE ID: CVE-2015-2213 State: PUBLISHED Published: 2015-11-09T11:00:00 Last Updated: 2024-08-06T05:10:15.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/ - http://www.securityfocus.com/bid/76160 - https://core.trac.wordpress.org/changeset/33556 - https://core.trac.wordpress.org/changeset/33555
yfocus.com/bid/76160 - https://core.trac.wordpress.org/changeset/33556 - https://core.trac.wordpress.org/changeset/33555 - http://openwall.com/lists/oss-security/2015/08/04/7 - https://wpvulndb.com/vulnerabilities/8126 - http://www.securitytracker.com/id/1033178 - http://www.debian.org/security/2015/dsa-3332 - https://codex.wordpress.org/Version_4.2.4 - http://www.debian.org/security/2015/dsa-3383
CVE ID: CVE-2015-2214 State: PUBLISHED Published: 2015-03-05T15:00:00 Last Updated: 2024-08-06T05:10:15.252Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130583/NetCat-CMS-5.01-3.12-Full-Path-Disclosure.html - http://tetraph.com/security/full-path-disclosure-vulnerability/netcat-cms-full-path-disclosure-information-disclosure-security-vulnerabilities/ - http://seclists.org/fulldisclosure/2015/Mar/8 - http://www.securityfocus.com/bid/72854
CVE ID: CVE-2015-2215 State: PUBLISHED Published: 2015-03-05T15:00:00Z Last Updated: 2024-09-16T21:08:14.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2437965 - http://www.securityfocus.com/bid/72803
CVE ID: CVE-2015-2216 State: PUBLISHED Published: 2015-03-05T15:00:00 Last Updated: 2024-08-06T05:10:16.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74854 - http://packetstormsecurity.com/files/130595/WordPress-Photocrati-Theme-4.x.x-SQL-Injection.html - https://wpvulndb.com/vulnerabilities/7818 - http://www.exploit-db.com/exploits/36242
CVE ID: CVE-2015-2217 State: PUBLISHED Published: 2015-03-10T14:00:00 Last Updated: 2024-08-06T05:10:15.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72991 - http://packetstormsecurity.com/files/130684/Ultimate-PHP-Board-UPB-2.2.7-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534796/100/0/threaded - https://github.com/Hala
2.2.7-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534796/100/0/threaded - https://github.com/Halamix2/MyUPB/blob/8b00a8f6ea999d22c22b081f4a144f51ec7225b0/changelog.txt - https://github.com/PHP-Outburst/myUPB/issues/17
CVE ID: CVE-2015-2218 State: PUBLISHED Published: 2015-03-05T16:00:00 Last Updated: 2024-08-06T05:10:15.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Co