alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-0871 (published 2015-02-07)
Cross-site scripting (XSS) vulnerability in Mrs. Shiromuku Perl CGI shiromuku(u1)GUESTBOOK 1.62 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: shiromuku
Affected products: guestbook
CVE-2015-0873 (published 2015-02-13)
Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: homepage_decorator
Affected products: perltreebbs
CVE-2015-0874 (published 2017-09-26)
Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-295
Affected vendors: apple, google, okb
Affected products: android, iphone_os, smart_passbook
CVE-2015-0875 (published 2015-02-15)
The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allows attackers to obtain sensitive information by reading a file.
Severity: LOW (CVSS 2.0 vector: AV:A/AC:H/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: okb.co.jp
Affected products: smartphone_passbook
CVE-2015-0876 (published 2015-04-07)
Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: saurus
Affected products: saurus_cms
CVE-2015-0877 (published 2015-04-06)
Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code by uploading a file with a \0 character in its name.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: c-board_moyuku_project
Affected products: c-board_moyuku
CVE-2015-0878 (published 2015-02-20)
Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Weakness: CWE-22
Affected vendors: almail
Affected products: al-mail32
CVE-2015-0879 (published 2015-02-20)
CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachment.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Weakness: CWE-20
Affected vendors: almail
Affected products: al-mail32
CVE-2015-0880 (published 2015-02-20)
Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: crear.ne.jp
Affected products: al-mail32
CVE-2015-0881 (published 2015-02-20)
CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: squid-cache
Affected products: squid
CVE-2015-0882 (published 2015-02-27)
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: zen-cart
Affected products: zen_cart
CVE-2015-0883 (published 2015-02-27)
SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows remote attackers to execute arbitrary code via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: synck_graphica
Affected products: mailform_pro_cgi
CVE-2015-0884 (published 2015-02-28)
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Affected vendors: microsoft, toshiba
Affected products: bluetooth_stack, service_station, windows
CVE-2015-0885 (published 2015-02-28)
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: checkpw_project, debian
Affected products: checkpw, debian_linux
CVE-2015-0886 (published 2015-02-28)
Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-190
Affected vendors: fedoraproject, mindrot
Affected products: fedora, jbcrypt
CVE-2015-0887 (published 2015-02-28)
npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30, SEIL/X1 routers 3.50 through 4.70, SEIL/X2 routers 3.50 through 4.70, and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C)
Weakness: CWE-399
Affected vendors: iij
Affected products: seil\/b1, seil\/b1_firmware, seil\/x1, seil\/x1_firmware, seil\/x2, seil\/x2_firmware, seil_x86_fuji, seil_x86_fuji_firmware
CVE-2015-0888 (published 2015-02-28)
KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:P)
Affected vendors: kent-web
Affected products: clip_board
CVE-2015-0889 (published 2015-02-28)
KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: kent-web
Affected products: joyful_note
CVE-2015-0890 (published 2015-03-03)
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Affected vendors: bestwebsoft
Affected products: google_captcha
CVE-2015-0891 (published 2015-03-05)
Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: maroyaka_simple_board_project
Affected products: maroyaka_simple_board
CVE-2015-0892 (published 2015-03-05)
Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: maroyaka_image_album_project
Affected products: maroyaka_image_album
CVE-2015-0893 (published 2015-03-05)
Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: maroyaka_relay_novel_project
Affected products: maroyaka_relay_novel
CVE-2015-0894 (published 2015-03-07)
SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: tips_and_tricks_hq
Affected products: all_in_one_wordpress_security_and_firewall
CVE-2015-0895 (published 2015-03-07)
Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: tips_and_tricks_hq
Affected products: all_in_one_wordpress_security_and_firewall
CVE-2015-0896 (published 2015-03-18)
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: extplorer
Affected products: extplorer
CVE-2015-0897 (published 2023-10-31)
LINE for Android version 5.0.2 and earlier and LINE for iOS version 5.0.0 and earlier are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-924
Affected vendors: line
Affected products: line
CVE-2015-0898 (published 2015-03-21)
futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-94
Affected vendors: futomi
Affected products: mp_form_mail_cgi
CVE-2015-0899 (published 2016-07-04)
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: apache
Affected products: struts
CVE-2015-0900 (published 2015-03-31)
Cross-site scripting (XSS) vulnerability in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 through 2.21 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: nishishi
Affected products: fumy_teachers_schedule_board
CVE-2015-0901 (published 2015-03-31)
Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: flashy_project
Affected products: flashy
CVE-2015-0902 (published 2015-04-03)
The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: semperfiwebdesign
Affected products: all_in_one_seo_pack
CVE-2015-0903 (published 2015-04-03)
Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: hidemaru
Affected products: editor
CVE-2015-0904 (published 2017-07-25)
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-295
Affected vendors: shidax
Affected products: restaurant_karaoke
CVE-2015-0905 (published 2015-04-08)
Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: bblog_project
Affected products: bblog
CVE-2015-0906 (published 2015-04-15)
Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:P)
Weakness: CWE-22
Affected vendors: lhaplus
Affected products: lhaplus
CVE-2015-0907 (published 2015-04-15)
Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: lhaplus
Affected products: lhaplus
CVE-2015-0910 (published 2015-04-24)
Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web script or HTML via a crafted filename.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: dounokouno
Affected products: transmitmail
CVE-2015-0911 (published 2015-04-24)
Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-22
Affected vendors: dounokouno
Affected products: transmitmail
CVE-2015-0912 (published 2015-05-01)
EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Affected vendors: kozos
Affected products: easyctf
CVE-2015-0913 (published 2015-05-01)
Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: kozos
Affected products: easyctf
CVE-2015-0914 (published 2015-05-01)
EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-284
Affected vendors: kozos
Affected products: easyctf
CVE-2015-0915 (published 2015-05-22)
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: rakus
Affected products: maildealer
CVE-2015-0916 (published 2015-05-22)
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: cacti
Affected products: cacti
CVE-2015-0917 (published 2015-01-08)
Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: kajona
Affected products: kajona
CVE-2015-0918 (published 2015-01-08)
Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: sefrengo
Affected products: sefrengo
CVE-2015-0919 (published 2015-01-08)
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-89
Affected vendors: sefrengo
Affected products: sefrengo
CVE-2015-0920 (published 2015-01-08)
Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: banner_effect_header_project
Affected products: banner_effect_header
CVE-2015-0921 (published 2015-01-09)
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Affected vendors: mcafee
Affected products: epolicy_orchestrator
CVE-2015-0922 (published 2015-01-09)
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: mcafee
Affected products: epolicy_orchestrator
CVE-2015-0923 (published 2015-02-14)
The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Affected vendors: ektron
Affected products: ektron_content_management_system
CVE-2015-0924 (published 2015-01-17)
Ceragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier for remote attackers to obtain access via a (1) HTTP, (2) SSH, (3) TELNET, or (4) CLI session.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Weakness: CWE-255
Affected vendors: ceragon
Affected products: fiberair_ip-10c, fiberair_ip-10e, fiberair_ip-10g
CVE-2015-0925 (published 2015-01-22)
The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Weakness: CWE-94
Affected vendors: ipass
Affected products: ipass_open_mobile
CVE-2015-0926 (published 2015-02-01)
Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: labtech_software
Affected products: labtech
CVE-2015-0928 (published 2017-08-28)
libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: oisf
Affected products: libhtp
CVE-2015-0929 (published 2015-02-03)
time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-284
Affected vendors: servision
Affected products: hvg400, hvg_video_gateway_firmware
CVE-2015-0930 (published 2015-02-03)
The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-255
Affected vendors: servision
Affected products: hvg400, hvg_video_gateway_firmware
CVE-2015-0931 (published 2015-02-14)
Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-74
Affected vendors: ektron
Affected products: ektron_content_management_system
CVE-2015-0932 (published 2015-04-05)
The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authentication for rsync sessions, which allows remote attackers to read or write to arbitrary files via TCP traffic on port 873.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-264
Affected vendors: antlabs
Affected products: inngate_ig_3.00_e, inngate_ig_3.01_e, inngate_ig_3.02_e, inngate_ig_3.10_e, inngate_ig_3.10_g, inngate_ig_3100, inngate_ig_3101
CVE-2015-0933 (published 2015-03-04)
Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command.
Severity: LOW (CVSS 2.0 vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)
Weakness: CWE-22
Affected vendors: sharelatex
Affected products: sharelatex
CVE-2015-0934 (published 2015-03-04)
Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-77
Affected vendors: sharelatex
Affected products: sharelatex
CVE-2015-0935 (published 2015-05-25)
Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-94
Affected vendors: bomgar
Affected products: remote_support
CVE-2015-0936 (published 2017-06-01)
Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-320
Affected vendors: ceragon
Affected products: fibeair_ip-10_firmware, fibeair_ip-10c, fibeair_ip-10e, fibeair_ip-10g
CVE-2015-0937 (published 2015-04-17)
Cross-site scripting (XSS) vulnerability in search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: blue_coat
Affected products: malware_analysis_appliance
CVE-2015-0938 (published 2015-04-17)
search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to bypass intended access restrictions, and list or read arbitrary documents, by providing matching keywords in conjunction with a crafted parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: blue_coat
Affected products: malware_analysis_appliance
CVE-2015-0941 (published 2015-03-22)
The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-310
Affected vendors: inetc_project
Affected products: inetc
CVE-2015-0943 (published 2015-08-31)
Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
Weakness: CWE-200
Affected vendors: basware
Affected products: banking
CVE-2015-0949 (published 2020-01-30)
The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revision L71 Ver. 01.09, and possibly other BIOS implementations does not ensure that function calls operate on SMRAM memory locations, which allows local users to bypass the Secure Boot protection mechanism and gain privileges by leveraging write access to physical memory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: dell, hp
Affected products: elitebook_850_g1, elitebook_850_g1_firmware, latitude_e6430, latitude_e6430_firmware
CVE-2015-0950 (published 2015-04-05)
Cross-site scripting (XSS) vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: qualiteam
Affected products: x-cart
CVE-2015-0951 (published 2015-04-05)
X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: qualiteam
Affected products: x-cart
CVE-2015-0961 (published 2015-05-25)
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Affected vendors: barracuda
Affected products: web_filter
CVE-2015-0962 (published 2015-05-25)
Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Weakness: CWE-18
Affected vendors: barracuda
Affected products: web_filter
CVE-2015-0967 (published 2015-04-18)
Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: searchblox
Affected products: searchblox
CVE-2015-0968 (published 2015-04-18)
Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Affected vendors: searchblox
Affected products: searchblox
CVE-2015-0969 (published 2015-04-18)
SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: searchblox
Affected products: searchblox
CVE-2015-0970 (published 2015-04-18)
Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: searchblox
Affected products: searchblox
CVE-2015-0971 (published 2015-05-14)
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Weakness: CWE-399
Affected vendors: debian, openinfosecfoundation
Affected products: debian_linux, suricata
CVE-2015-0972 (published 2015-06-23)
Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-255
Affected vendors: pearson
Affected products: proctorcache
CVE-2015-0973 (published 2015-01-18)
Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: apple, libpng, oracle
Affected products: libpng, mac_os_x, solaris
CVE-2015-0974 (published 2017-08-28)
Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: mobilis
Affected products: mobiconnect
CVE-2015-0976 (published 2015-04-03)
Cross-site scripting (XSS) vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Weakness: CWE-79
Affected vendors: inductiveautomation
Affected products: ignition
CVE-2015-0977 (published 2015-02-27)
Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-78
Affected vendors: network_vision
Affected products: intravue
CVE-2015-0978 (published 2015-03-14)
Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Elipse E3 4.5.232 through 4.6.161 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory.  NOTE: this may overlap CVE-2015-2264.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Affected vendors: elipse
Affected products: e3
CVE-2015-0979 (published 2015-03-14)
Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:C)
Weakness: CWE-119
Affected vendors: scadaengine
Affected products: bacnet_opc_server
CVE-2015-0980 (published 2015-03-14)
Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:C)
Weakness: CWE-20
Affected vendors: scadaengine
Affected products: bacnet_opc_server
CVE-2015-0981 (published 2015-03-14)
The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-264
Affected vendors: scadaengine
Affected products: bacnet_opc_server
CVE-2015-0982 (published 2015-03-14)
Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-120
Affected vendors: schneider-electric
Affected products: pelco_ds-nv
CVE-2015-0984 (published 2015-03-31)
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Weakness: CWE-22
Affected vendors: honeywell
Affected products: excel_web_xl_1000c1000_600_i\/o, excel_web_xl_1000c1000_600_i\/o_uukl, excel_web_xl_1000c100_104_i\/o, excel_web_xl_1000c100u_104_i\/o_uukl, excel_web_xl_1000c500_300_i\/o, excel_web_xl_1000c500_300_i\/o_uukl, excel_web_xl_1000c50_52_i\/o, excel_web_xl_1000c50u_52_i\/o_uukl
CVE-2015-0985 (published 2015-03-31)
Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-352
Affected vendors: xzeres
Affected products: 442sr, 442sr_os
CVE-2015-0986 (published 2015-05-26)
Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.
Severity: HIGH (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: moxa
Affected products: vport_activex_sdk_plus
CVE-2015-0987 (published 2015-10-06)
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H)
Weakness: CWE-200
Affected vendors: omron
Affected products: cj2h_plc, cj2m_plc, cx-programmer
CVE-2015-0988 (published 2015-10-06)
Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: omron
Affected products: cx-programmer
CVE-2015-0989 (published 2015-06-28)
PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Weakness: CWE-19
Affected vendors: icsgmbh
Affected products: pactware
CVE-2015-0990 (published 2015-04-03)
Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Severity: MEDIUM (CVSS 2.0 vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
Affected vendors: ecava
Affected products: integraxor
CVE-2015-0991 (published 2015-04-03)
Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: inductiveautomation
Affected products: ignition
CVE-2015-0992 (published 2015-04-03)
Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: inductiveautomation
Affected products: ignition
CVE-2015-0993 (published 2015-04-03)
Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Weakness: CWE-254
Affected vendors: inductiveautomation
Affected products: ignition
CVE-2015-0994 (published 2015-04-03)
Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Weakness: CWE-254
Affected vendors: inductiveautomation
Affected products: ignition
CVE-2015-0995 (published 2015-04-03)
Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-255
Affected vendors: inductiveautomation
Affected products: ignition
CVE-2015-0996 (published 2015-03-29)
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: aveva, schneider-electric
Affected products: aveva_edge, wonderware_intouch_2014
CVE-2015-0997 (published 2015-03-29)
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: aveva, schneider-electric
Affected products: aveva_edge, wonderware_intouch_2014
CVE-2015-0998 (published 2015-03-29)
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
Severity: LOW (CVSS 2.0 vector: AV:A/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: aveva, schneider-electric
Affected products: aveva_edge, wonderware_intouch_2014
CVE-2015-0999 (published 2015-03-29)
Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file.
Severity: LOW (CVSS 2.0 vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Weakness: CWE-200
Affected vendors: aveva, schneider-electric
Affected products: aveva_edge, wonderware_intouch_2014
CVE-2015-1000 (published 2015-06-05)
Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter.
Severity: MEDIUM (CVSS 2.0 vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
Weakness: CWE-119
Affected vendors: moxa
Affected products: softcms
CVE-2015-1000000 (published 2016-10-06)
Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: mailcwp_project
Affected products: mailcwp
CVE-2015-1000001 (published 2016-10-06)
Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: fast-image-adder_project
Affected products: fast-image-adder
CVE-2015-1000002 (published 2016-10-06)
Open Proxy in filedownload v1.4 wordpress plugin
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N)
Weakness: CWE-20
Affected vendors: filedownload_project
Affected products: filedownload
CVE-2015-1000003 (published 2016-10-06)
Blind SQL Injection in filedownload v1.4 wordpress plugin
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: filedownload_project
Affected products: filedownload
CVE-2015-1000004 (published 2016-10-06)
XSS in filedownload v1.4 wordpress plugin
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: filedownload_project
Affected products: filedownload
CVE-2015-1000005 (published 2016-10-06)
Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: candidate-application-form_project
Affected products: candidate-application-form
CVE-2015-1000006 (published 2016-10-06)
Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: recent-backups_project
Affected products: recent-backups
CVE-2015-1000007 (published 2016-10-06)
Remote file download vulnerability in wptf-image-gallery v1.03
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: wptf-image-gallery_project
Affected products: wptf-image-gallery
CVE-2015-1000008 (published 2016-10-06)
Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: mp3-jplayer_project
Affected products: mp3-jplayer
CVE-2015-1000009 (published 2016-10-06)
Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-284
Affected vendors: google-adsense-and-hotel-booking_project
Affected products: google-adsense-and-hotel-booking
CVE-2015-1000010 (published 2016-10-06)
Remote file download in simple-image-manipulator v1.0 wordpress plugin
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: simple-image-manipulator_project
Affected products: simple-image-manipulator
CVE-2015-1000011 (published 2016-10-06)
Blind SQL Injection in wordpress plugin dukapress v2.5.9
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: dukapress_project
Affected products: dukapress
CVE-2015-1000012 (published 2016-10-06)
Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: mypixs_project
Affected products: mypixs
CVE-2015-1000013 (published 2016-10-06)
Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: csv2wpec-coupon_project
Affected products: csv2wpec-coupon
CVE-2015-10001 (published 2021-11-01)
The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of them when outputting them, allowing attacker to make logged in high privilege users change them and set Cross-Site Scripting payloads
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-352
Affected vendors: wp-stats_project
Affected products: wp-stats
CVE-2015-10002 (published 2022-03-28)
A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: kiddoware
Affected products: kids_place
CVE-2015-10003 (published 2022-07-17)
A vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT Handler. The manipulation leads to unintended intermediary. It is possible to initiate the attack remotely. Upgrading to version 0.9.51 is able to address this issue. It is recommended to upgrade the affected component.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-441
Affected vendors: filezilla-project
Affected products: filezilla_server
CVE-2015-10004 (published 2022-12-27)
Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of requests over a low latency connection, an attacker may use this to determine the expected HMAC.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-668
Affected vendors: json_web_token_project
Affected products: json_web_token
CVE-2015-10005 (published 2022-12-27)
A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-1333
Affected vendors: markdown-it_project
Affected products: markdown-it
CVE-2015-10006 (published 2023-01-01)
A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site scripting. The attack may be launched remotely. The name of the patch is 9d18a39944d79dfedacd754a742df38f99d3c0e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217172.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ingnovarq_project
Affected products: ingnovarq