alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2015-9247 (published 2018-01-12)
An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: skyboxsecurity
Affected products: skybox_platform
CVE-2015-9248 (published 2018-01-12)
An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the title, Comments, or Description field to /skyboxview/webskybox/tickets in Change Manager.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: skyboxsecurity
Affected products: skybox_platform
CVE-2015-9249 (published 2018-01-12)
An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/VersionWebService via a soapenv:Body element.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: skyboxsecurity
Affected products: skybox_platform
CVE-2015-9250 (published 2018-01-12)
An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skyboxview/webskybox/filedownload via the tempFileName parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: skyboxsecurity
Affected products: skybox_platform
CVE-2015-9251 (published 2018-01-18)
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jquery, oracle
Affected products: agile_product_lifecycle_management_for_process, banking_platform, business_process_management_suite, communications_converged_application_server, communications_interactive_session_recorder, communications_services_gatekeeper, communications_webrtc_session_controller, endeca_information_discovery_studio, enterprise_manager_ops_center, enterprise_operations_monitor, financial_services_analytical_applications_infrastructure, financial_services_asset_liability_management, financial_services_data_integration_hub, financial_services_funds_transfer_pricing, financial_services_hedge_management_and_ifrs_valuations, financial_services_liquidity_risk_management, financial_services_loan_loss_forecasting_and_provisioning, financial_services_market_risk_measurement_and_management, financial_services_profitability_management, financial_services_reconciliation_framework, fusion_middleware_mapviewer, healthcare_foundation, healthcare_translational_research, hospitality_cruise_fleet_management, hospitality_guest_access
CVE-2015-9252 (published 2018-02-13)
An issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-399
Affected vendors: qpdf_project
Affected products: qpdf
CVE-2015-9253 (published 2018-02-19)
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: php
Affected products: php
CVE-2015-9254 (published 2018-02-20)
Datto ALTO and SIRIS devices have a default VNC password.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: datto
Affected products: alto_2, alto_2_firmware, alto_3, alto_3_firmware, alto_imaged, alto_imaged_firmware, alto_xl, alto_xl_firmware, siris_2, siris_2_firmware, siris_3, siris_3_firmware, siris_3_x_all-flash, siris_3_x_all-flash_firmware, siris_virtual, siris_virtual_firmware
CVE-2015-9255 (published 2018-02-20)
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: datto
Affected products: alto_2, alto_2_firmware, alto_3, alto_3_firmware, alto_imaged, alto_imaged_firmware, alto_xl, alto_xl_firmware, siris_2, siris_2_firmware, siris_3, siris_3_firmware, siris_3_x_all-flash, siris_3_x_all-flash_firmware, siris_virtual, siris_virtual_firmware
CVE-2015-9256 (published 2018-02-20)
Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: datto
Affected products: alto_2, alto_2_firmware, alto_3, alto_3_firmware, alto_imaged, alto_imaged_firmware, alto_xl, alto_xl_firmware, siris_2, siris_2_firmware, siris_3, siris_3_firmware, siris_3_x_all-flash, siris_3_x_all-flash_firmware, siris_virtual, siris_virtual_firmware
CVE-2015-9257 (published 2018-03-24)
BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bmc
Affected products: remedy_action_request_system
CVE-2015-9258 (published 2018-03-31)
In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-310
Affected vendors: docker
Affected products: notary
CVE-2015-9259 (published 2018-03-31)
In Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: docker
Affected products: notary
CVE-2015-9260 (published 2018-07-05)
An issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bedita
Affected products: bedita
CVE-2015-9261 (published 2018-07-26)
huft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: busybox, canonical, debian
Affected products: busybox, debian_linux, ubuntu_linux
CVE-2015-9262 (published 2018-08-01)
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: canonical, debian, redhat, x
Affected products: ansible_tower, debian_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_workstation, libxcursor, ubuntu_linux
CVE-2015-9263 (published 2018-08-27)
An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: idera
Affected products: uptime_infrastructure_monitor
CVE-2015-9264 (published 2018-08-27)
Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: lansweeper
Affected products: lansweeper
CVE-2015-9266 (published 2018-09-05)
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: ubnt, ui
Affected products: af5, af5_firmware, af5x, af5x_firmware, airfiber_af24, airfiber_af24_firmware, airfiber_af24hd, airfiber_af24hd_firmware, airgateway, airgateway_firmware, airmax_ac, airmax_ac_firmware, airmax_m, airmax_m_ti, airmax_m_ti_firmware, airmax_m_xm, airmax_m_xm_firmware, airmax_m_xw, airmax_m_xw_firmware, airos_4_xs2, airos_4_xs5, edgeswitch_xp, edgeswitch_xp_firmware
CVE-2015-9267 (published 2018-10-01)
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-269
Affected vendors: debian, nullsoft
Affected products: debian_linux, nullsoft_scriptable_install_system
CVE-2015-9268 (published 2018-10-01)
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: debian, nullsoft
Affected products: debian_linux, nullsoft_scriptable_install_system
CVE-2015-9269 (published 2018-10-01)
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: wpmobilepack
Affected products: wordpress_mobile_pack
CVE-2015-9270 (published 2018-10-01)
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: theholidaycalendar
Affected products: holiday_calendar
CVE-2015-9271 (published 2018-10-04)
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: videowhisper
Affected products: video_conference
CVE-2015-9272 (published 2018-10-05)
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: videowhisper
Affected products: video_presentation
CVE-2015-9273 (published 2018-10-07)
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp-slimstat
Affected products: slimstat_analytics
CVE-2015-9274 (published 2018-11-15)
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: harfbuzz_project
Affected products: harfbuzz
CVE-2015-9275 (published 2019-01-07)
ARC 5.21q allows directory traversal via a full pathname in an archive file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: arc_project
Affected products: arc
CVE-2015-9276 (published 2019-01-16)
SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: smartertools
Affected products: smartermail
CVE-2015-9277 (published 2019-01-16)
MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-22
Affected vendors: mailenable
Affected products: mailenable
CVE-2015-9278 (published 2019-01-16)
MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-255
Affected vendors: mailenable
Affected products: mailenable
CVE-2015-9279 (published 2019-01-16)
MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mailenable
Affected products: mailenable
CVE-2015-9280 (published 2019-01-16)
MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-611
Affected vendors: mailenable
Affected products: mailenable
CVE-2015-9281 (published 2019-01-17)
Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hpe, ibm, linux, microsoft, oracle, sas
Affected products: aix, hp-ux_ipfilter, linux_kernel, solaris, web_infrastructure_platform, windows
CVE-2015-9282 (published 2019-02-06)
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: grafana
Affected products: piechart-panel
CVE-2015-9284 (published 2019-04-26)
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: omniauth
Affected products: omniauth
CVE-2015-9285 (published 2019-04-29)
esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: esotalk
Affected products: esotalk
CVE-2015-9286 (published 2019-04-30)
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: nodebb
Affected products: nodebb
CVE-2015-9287 (published 2019-05-13)
Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to provide any string value. An attacker could use this to their advantage to force the application agent to load the RSA public key required for message integrity checking from an unintended location.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: cam
Affected products: the_university_of_cambridge_web_authentication_system_apache_authentication_agent
CVE-2015-9288 (published 2019-07-29)
The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: unity
Affected products: web_player
CVE-2015-9289 (published 2019-07-27)
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: linux
Affected products: linux_kernel
CVE-2015-9290 (published 2019-07-30)
In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: freetype
Affected products: freetype
CVE-2015-9291 (published 2019-08-01)
cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: cpanel
Affected products: cpanel
CVE-2015-9292 (published 2019-08-08)
6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: 6kbbs
Affected products: 6kbbs
CVE-2015-9293 (published 2019-08-13)
The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2015-9294 (published 2019-08-13)
The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2015-9295 (published 2019-08-13)
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: contact_form
CVE-2015-9296 (published 2019-08-13)
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: never5
Affected products: download_monitor
CVE-2015-9297 (published 2019-08-13)
The events-manager plugin before 5.6 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pixelite
Affected products: events_manager
CVE-2015-9298 (published 2019-08-13)
The events-manager plugin before 5.6 for WordPress has code injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: pixelite
Affected products: events_manager
CVE-2015-9299 (published 2019-08-13)
The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pixelite
Affected products: events_manager
CVE-2015-9300 (published 2019-08-13)
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: pixelite
Affected products: events_manager
CVE-2015-9301 (published 2019-08-13)
The liveforms plugin before 3.2.0 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: w3eden
Affected products: live_forms
CVE-2015-9302 (published 2019-08-13)
The simple-fields plugin before 1.4.11 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: simple_fields_project
Affected products: simple_fields
CVE-2015-9303 (published 2019-08-12)
The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: simplesharebuttons
Affected products: simple_share_buttons_adder
CVE-2015-9304 (published 2019-08-12)
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ultimatemember
Affected products: ultimate_member
CVE-2015-9305 (published 2019-08-12)
The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: weplugins
Affected products: wp_maps
CVE-2015-9306 (published 2019-08-12)
The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: smackcoders
Affected products: import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv
CVE-2015-9307 (published 2019-08-14)
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: weplugins
Affected products: wp_maps
CVE-2015-9308 (published 2019-08-14)
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: weplugins
Affected products: wp_maps
CVE-2015-9309 (published 2019-08-14)
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: weplugins
Affected products: wp_maps
CVE-2015-9310 (published 2019-08-14)
The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2015-9311 (published 2019-08-14)
The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-9312 (published 2019-08-14)
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-9313 (published 2019-08-14)
The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-9314 (published 2019-08-14)
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-9315 (published 2019-08-14)
The newstatpress plugin before 1.0.1 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: newstatpress_project
Affected products: newstatpress
CVE-2015-9316 (published 2019-08-14)
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wpfastestcache
Affected products: wp_fastest_cache
CVE-2015-9317 (published 2019-08-20)
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: getawesomesupport
Affected products: awesome_support
CVE-2015-9318 (published 2019-08-20)
The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-254
Affected vendors: getawesomesupport
Affected products: awesome_support
CVE-2015-9319 (published 2019-08-20)
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: greg\'s_high_performance_seo_project
Affected products: greg\'s_high_performance_seo
CVE-2015-9320 (published 2019-08-20)
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: optiontree_project
Affected products: optiontree
CVE-2015-9321 (published 2019-08-21)
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpmadeeasy
Affected products: shortcode_factory
CVE-2015-9322 (published 2019-08-16)
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: erident_custom_login_and_dashboard_project
Affected products: erident_custom_login_and_dashboard
CVE-2015-9323 (published 2019-08-16)
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: duckdev
Affected products: 404_to_301
CVE-2015-9324 (published 2019-08-16)
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: awesomemotive
Affected products: easy_digital_downloads
CVE-2015-9325 (published 2019-08-16)
The visitors-online plugin before 0.4 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: bestwebsoft
Affected products: visitors_online
CVE-2015-9326 (published 2019-08-16)
The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wpbusinessintelligence
Affected products: wp_business_intelligence
CVE-2015-9327 (published 2019-08-21)
The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: flickr_justified_gallery_project
Affected products: flickr_justified_gallery
CVE-2015-9328 (published 2019-08-21)
The profile-builder plugin before 2.2.5 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cozmoslabs
Affected products: profile_builder
CVE-2015-9329 (published 2019-08-20)
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: soflyy
Affected products: wp_all_import
CVE-2015-9330 (published 2019-08-20)
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: soflyy
Affected products: wp_all_import
CVE-2015-9331 (published 2019-08-20)
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-254
Affected vendors: soflyy
Affected products: wp_all_import
CVE-2015-9332 (published 2019-08-20)
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: wordpress_uninstall_project
Affected products: wordpress_uninstall
CVE-2015-9333 (published 2019-08-22)
The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: cformsii_project
Affected products: cformsii
CVE-2015-9334 (published 2019-08-22)
The email-newsletter plugin through 20.15 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: email-newsletter_project
Affected products: email-newsletter
CVE-2015-9335 (published 2019-08-22)
The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: bestwebsoft
Affected products: limit_attempts
CVE-2015-9336 (published 2019-08-22)
The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: codection
Affected products: clean_login
CVE-2015-9337 (published 2019-08-22)
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: cozmoslabs
Affected products: profile_builder
CVE-2015-9338 (published 2019-08-22)
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-434
Affected vendors: iptanus
Affected products: wordpress_file_upload
CVE-2015-9339 (published 2019-08-22)
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-434
Affected vendors: iptanus
Affected products: wordpress_file_upload
CVE-2015-9340 (published 2019-08-22)
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-434
Affected vendors: iptanus
Affected products: wordpress_file_upload
CVE-2015-9341 (published 2019-08-22)
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-434
Affected vendors: iptanus
Affected products: wordpress_file_upload
CVE-2015-9342 (published 2019-08-27)
The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: impress
Affected products: wp_rollback
CVE-2015-9343 (published 2019-08-27)
The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: impress
Affected products: wp_rollback
CVE-2015-9344 (published 2019-08-27)
The link-log plugin before 2.1 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: perafox
Affected products: link_log
CVE-2015-9345 (published 2019-08-27)
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: petersplugins
Affected products: link_log
CVE-2015-9346 (published 2019-08-27)
The cp-polls plugin before 1.0.5 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: codepeople
Affected products: polls_cp
CVE-2015-9347 (published 2019-08-27)
The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: plot
Affected products: plotly
CVE-2015-9348 (published 2019-08-27)
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: codepeople
Affected products: sell_downloads
CVE-2015-9349 (published 2019-08-27)
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cksource
Affected products: ckeditor
CVE-2015-9350 (published 2019-08-27)
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: slickremix
Affected products: feed_them_social
CVE-2015-9351 (published 2019-08-27)
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: slickremix
Affected products: feed_them_social
CVE-2015-9352 (published 2019-08-27)
The wp-polls plugin before 2.72 for WordPress has SQL injection.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wp-polls_project
Affected products: wp-polls
CVE-2015-9353 (published 2019-08-28)
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: tri
Affected products: gigpress
CVE-2015-9354 (published 2019-08-28)
The gigpress plugin before 2.3.11 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tri
Affected products: gigpress
CVE-2015-9355 (published 2019-08-28)
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: simbahosting
Affected products: two-factor-authentication
CVE-2015-9356 (published 2019-08-28)
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp-vipergb_project
Affected products: wp-vipergb
CVE-2015-9357 (published 2019-08-28)
The akismet plugin before 3.1.5 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: automattic
Affected products: akismet
CVE-2015-9358 (published 2019-08-28)
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: feedwordpress_project
Affected products: feedwordpress
CVE-2015-9359 (published 2019-08-28)
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: automattic
Affected products: jetpack
CVE-2015-9360 (published 2019-08-28)
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: updraftplus
Affected products: updraftplus
CVE-2015-9361 (published 2019-08-28)
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: never5
Affected products: related_posts
CVE-2015-9362 (published 2019-08-28)
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: never5
Affected products: post_connector
CVE-2015-9363 (published 2019-08-28)
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: exchange
CVE-2015-9364 (published 2019-08-28)
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: 2checkout
Affected products: ithemes_2checkout
CVE-2015-9365 (published 2019-08-28)
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: authorize.net
CVE-2015-9366 (published 2019-08-28)
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: custom_url_tracking
CVE-2015-9367 (published 2019-08-28)
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: easy_canadian_sales_taxes
CVE-2015-9368 (published 2019-08-28)
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: easy_eu_value_added_\(vat\)_taxes
CVE-2015-9369 (published 2019-08-28)
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: easy_us_sales_taxes
CVE-2015-9370 (published 2019-08-28)
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: invoices
CVE-2015-9371 (published 2019-08-28)
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: manual_purchases
CVE-2015-9372 (published 2019-08-28)
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: membership
CVE-2015-9373 (published 2019-08-28)
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: webdevstudios
Affected products: ithemes_paypal_pro
CVE-2015-9374 (published 2019-08-28)
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: stripe
CVE-2015-9375 (published 2019-08-28)
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: table_rate_shipping
CVE-2015-9376 (published 2019-08-28)
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: mobile
CVE-2015-9377 (published 2019-08-28)
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: builder_theme_depot
CVE-2015-9378 (published 2019-08-28)
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: builder_theme_market
CVE-2015-9379 (published 2019-08-28)
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ithemes
Affected products: builder_style_manager
CVE-2015-9380 (published 2019-08-30)
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: 10web
Affected products: photo_gallery
CVE-2015-9381 (published 2019-09-03)
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: debian, freetype
Affected products: debian_linux, freetype
CVE-2015-9382 (published 2019-09-03)
FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: debian, freetype
Affected products: debian_linux, freetype
CVE-2015-9383 (published 2019-09-03)
FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: canonical, debian, freetype
Affected products: debian_linux, freetype, ubuntu_linux
CVE-2015-9384 (published 2019-09-20)
The relevant plugin before 1.0.8 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: relevant
CVE-2015-9385 (published 2019-09-20)
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: quotes_and_tips
CVE-2015-9386 (published 2019-09-20)
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mtouch_quiz_project
Affected products: mtouch_quiz