alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2016-10825 (published 2019-08-01)
cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-358
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10826 (published 2019-08-01)
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10827 (published 2019-08-01)
cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10828 (published 2019-08-01)
cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10829 (published 2019-08-01)
cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-1083 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10830 (published 2019-08-01)
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10831 (published 2019-08-01)
cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10832 (published 2019-08-01)
cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10833 (published 2019-08-01)
cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10834 (published 2019-08-01)
cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-358
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10835 (published 2019-08-01)
cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-287
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10836 (published 2019-08-01)
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-287
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10837 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-426
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10838 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10839 (published 2019-08-01)
cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-89
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-1084 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10840 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-668
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10841 (published 2019-08-01)
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-199
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10842 (published 2019-08-01)
cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10843 (published 2019-08-01)
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-77
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10844 (published 2019-08-01)
The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10845 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-74
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10846 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-275
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10847 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-74
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10848 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-285
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10849 (published 2019-08-01)
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-77
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-1085 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10850 (published 2019-08-01)
cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10851 (published 2019-08-01)
cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10852 (published 2019-08-01)
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10853 (published 2019-08-01)
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10854 (published 2019-08-01)
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10855 (published 2019-08-01)
cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10856 (published 2019-08-01)
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10857 (published 2019-08-01)
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10858 (published 2019-08-01)
cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10859 (published 2019-08-01)
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-285
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-1086 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10860 (published 2019-08-01)
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2016-10861 (published 2019-08-07)
Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: neetcables
Affected products: airstream, airstream_nas_firmware
CVE-2016-10862 (published 2019-08-08)
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: neetcables
Affected products: airstream_nas, airstream_nas_firmware
CVE-2016-10863 (published 2019-08-08)
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: edimax
Affected products: 7237rpd, 7237rpd_firmware, ew-7438rpn_mini, ew-7438rpn_mini_firmware
CVE-2016-10864 (published 2019-08-08)
NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: netgear
Affected products: ex7000, ex7000_firmware
CVE-2016-10865 (published 2019-08-09)
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-352
Affected vendors: 23systems
Affected products: lightbox_plus_colorbox
CVE-2016-10866 (published 2019-08-13)
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2016-10867 (published 2019-08-13)
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2016-10868 (published 2019-08-13)
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2016-10869 (published 2019-08-13)
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: contact_form
CVE-2016-1087 (published 2016-05-11)
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1090 and CVE-2016-4106.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10870 (published 2019-08-13)
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gtranslate
Affected products: google_language_translator
CVE-2016-10871 (published 2019-08-13)
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ibericode
Affected products: mailchimp_for_wordpress
CVE-2016-10872 (published 2019-08-12)
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ultimatemember
Affected products: ultimate_member
CVE-2016-10873 (published 2019-08-12)
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpseeds
Affected products: wp_database_backup
CVE-2016-10874 (published 2019-08-12)
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpseeds
Affected products: wp_database_backup
CVE-2016-10875 (published 2019-08-12)
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpseeds
Affected products: wp_database_backup
CVE-2016-10876 (published 2019-08-12)
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpseeds
Affected products: wp_database_backup
CVE-2016-10877 (published 2019-08-12)
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp_editor_project
Affected products: wp_editor
CVE-2016-10878 (published 2019-08-12)
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: weplugins
Affected products: wp_maps
CVE-2016-10879 (published 2019-08-12)
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: 3cx
Affected products: live_chat
CVE-2016-1088 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10880 (published 2019-08-14)
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: google_doc_embedder_project
Affected products: google_doc_embedder
CVE-2016-10881 (published 2019-08-14)
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: google_doc_embedder_project
Affected products: google_doc_embedder
CVE-2016-10882 (published 2019-08-14)
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: google_doc_embedder_project
Affected products: google_doc_embedder
CVE-2016-10883 (published 2019-08-14)
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: mijnpress
Affected products: simple_add_pages_or_posts
CVE-2016-10884 (published 2019-08-14)
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: simple-membership-plugin
Affected products: simple_membership
CVE-2016-10885 (published 2019-08-14)
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: benjaminrojas
Affected products: wp_editor
CVE-2016-10886 (published 2019-08-14)
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: benjaminrojas
Affected products: wp_editor
CVE-2016-10887 (published 2019-08-14)
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2016-10888 (published 2019-08-14)
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2016-10889 (published 2019-08-14)
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: imagely
Affected products: nextgen_gallery
CVE-2016-1089 (published 2016-10-13)
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10890 (published 2019-08-21)
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pojo
Affected products: activity_log
CVE-2016-10891 (published 2019-08-21)
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pojo
Affected products: activity_log
CVE-2016-10892 (published 2019-08-20)
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kibokolabs
Affected products: chained_quiz
CVE-2016-10893 (published 2019-08-20)
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: crayon_syntax_highlighter_project
Affected products: crayon_syntax_highlighter
CVE-2016-10894 (published 2019-08-16)
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-254
Affected vendors: debian, xtrlock_project
Affected products: debian_linux, xtrlock
CVE-2016-10895 (published 2019-08-20)
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: optiontree_project
Affected products: optiontree
CVE-2016-10896 (published 2019-08-21)
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: clogica
Affected products: seo_redirection
CVE-2016-10897 (published 2019-08-21)
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: sermon_browser_project
Affected products: sermon_browser
CVE-2016-10898 (published 2019-08-21)
The total-security plugin before 3.4.1 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fabrix
Affected products: total_security
CVE-2016-10899 (published 2019-08-21)
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: fabrix
Affected products: total_security
CVE-2016-1090 (published 2016-05-11)
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1087 and CVE-2016-4106.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10900 (published 2019-08-21)
The uji-countdown plugin before 2.0.7 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpmanage
Affected products: uji_countdown
CVE-2016-10901 (published 2019-08-21)
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gowebsolutions
Affected products: wp_customer_reviews
CVE-2016-10902 (published 2019-08-21)
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: gowebsolutions
Affected products: wp_customer_reviews
CVE-2016-10903 (published 2019-08-21)
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: godaddy
Affected products: godaddy_email_marketing
CVE-2016-10904 (published 2019-08-16)
The olimometer plugin before 2.57 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: olimometer_project
Affected products: olimometer
CVE-2016-10905 (published 2019-08-19)
An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: linux
Affected products: linux_kernel
CVE-2016-10906 (published 2019-08-19)
An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: linux
Affected products: linux_kernel
CVE-2016-10907 (published 2019-08-19)
An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: linux
Affected products: linux_kernel
CVE-2016-10908 (published 2019-08-21)
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: codepeople
Affected products: booking_calendar_contact_form
CVE-2016-10909 (published 2019-08-21)
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: codepeople
Affected products: booking_calendar_contact_form
CVE-2016-1091 (published 2016-10-13)
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10910 (published 2019-08-21)
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: formbuilder_project
Affected products: formbuilder
CVE-2016-10911 (published 2019-08-21)
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cozmoslabs
Affected products: profile_builder
CVE-2016-10912 (published 2019-08-21)
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: matchboxdesigngroup
Affected products: universal_analytics
CVE-2016-10913 (published 2019-08-20)
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: joomunited
Affected products: wp_latest_posts
CVE-2016-10914 (published 2019-08-20)
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: add_from_server_project
Affected products: add_from_server
CVE-2016-10915 (published 2019-08-20)
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: supsystic
Affected products: popup
CVE-2016-10916 (published 2019-08-22)
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: codepeople
Affected products: appointment_booking_calendar
CVE-2016-10917 (published 2019-08-22)
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: search_everything_project
Affected products: search_everything
CVE-2016-10918 (published 2019-08-22)
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: supsystic
Affected products: photo_gallery
CVE-2016-10919 (published 2019-08-22)
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wassup_real_time_analytics_project
Affected products: wassup_real_time_analytics
CVE-2016-1092 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1079.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10920 (published 2019-08-22)
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: sir
Affected products: gnucommerce
CVE-2016-10921 (published 2019-08-22)
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: ays-pro
Affected products: photo_gallery
CVE-2016-10922 (published 2019-08-22)
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: visser
Affected products: store_toolkit_for_woocommerce
CVE-2016-10923 (published 2019-08-22)
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: visser
Affected products: store_toolkit_for_woocommerce
CVE-2016-10924 (published 2019-08-22)
The ebook-download plugin before 1.2 for WordPress has directory traversal.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: zedna_ebook_download_project
Affected products: zedna_ebook_download
CVE-2016-10925 (published 2019-08-22)
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: profilepress
Affected products: loginwp
CVE-2016-10926 (published 2019-08-22)
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
Weakness: CWE-918
Affected vendors: neliosoftware
Affected products: nelio_ab_testing
CVE-2016-10927 (published 2019-08-22)
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
Weakness: CWE-918
Affected vendors: neliosoftware
Affected products: nelio_ab_testing
CVE-2016-10928 (published 2019-08-22)
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: onelogin
Affected products: onelogin_saml_sso
CVE-2016-10929 (published 2019-08-22)
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-264
Affected vendors: advanced_ajax_page_loader_project
Affected products: advanced_ajax_page_loader
CVE-2016-1093 (published 2016-05-11)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: adobe, apple, microsoft
Affected products: acrobat, acrobat_dc, acrobat_reader_dc, mac_os_x, reader, windows
CVE-2016-10930 (published 2019-08-22)
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: wpsupportplus
Affected products: wp_support_plus_responsive_ticket_system
CVE-2016-10931 (published 2019-08-26)
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-295
Affected vendors: rust-openssl_project
Affected products: rust-openssl
CVE-2016-10932 (published 2019-08-26)
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-254
Affected vendors: hyper, microsoft
Affected products: hyper, windows
CVE-2016-10933 (published 2019-08-26)
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-254
Affected vendors: portaudio_project
Affected products: portaudio
CVE-2016-10934 (published 2019-08-27)
The check-email plugin before 0.5.2 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: check_email_project
Affected products: check_email
CVE-2016-10935 (published 2019-08-27)
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: visser
Affected products: store_exporter_for_woocommerce
CVE-2016-10936 (published 2019-08-27)
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp-polls_project
Affected products: wp-polls
CVE-2016-10937 (published 2019-09-08)
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-295
Affected vendors: debian, fedoraproject, imapfilter_project, opensuse
Affected products: backports_sle, debian_linux, fedora, imapfilter, leap
CVE-2016-10938 (published 2019-09-13)
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: copy-me_project
Affected products: copy-me
CVE-2016-10939 (published 2019-09-13)
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: xtremelocator
Affected products: xtremelocator
CVE-2016-1094 (published 2016-05-11)
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: adobe, apple, microsoft
Affected products: acrobat_dc, acrobat_reader_dc, acrobat_xi, mac_os_x, reader_xi, windows
CVE-2016-10940 (published 2019-09-13)
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zm-gallery_project
Affected products: zm-gallery
CVE-2016-10941 (published 2019-09-13)
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: podlove
Affected products: podlove_podcast_publisher
CVE-2016-10942 (published 2019-09-13)
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: podlove
Affected products: podlove_podcast_publisher
CVE-2016-10943 (published 2019-09-13)
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zx-csv-upload_project
Affected products: zx-csv-upload
CVE-2016-10944 (published 2019-09-13)
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wpmaz
Affected products: multisite_post_duplicator
CVE-2016-10945 (published 2019-09-13)
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: pagelines
Affected products: pagelines
CVE-2016-10946 (published 2019-09-13)
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: wp-d3_project
Affected products: wp-d3