deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0195
Published: 2019-09-16
Description: Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2021/04/15/1; https://lists.apache.org/thread.html/5173c4eed06e2fca6fd5576ed723ff6bb1711738ec515cb51a04ab24%40%3Cusers.tapestry.apache.org%3E; https://lists.apache.org/thread.html/6c40c1e03d2131119f9b77882431a0050f02bf9cae9ee48b84d012df%40%3Cusers.tapestry.apache.org%3E
CVE: CVE-2019-11166
Published: 2019-09-16
Description: Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00285.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00285.html
CVE: CVE-2019-11184
Published: 2019-09-16
Description: A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-362
References: https://arxiv.org/abs/1909.04841; https://ieeexplore.ieee.org/document/9152768; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-15950
Published: 2019-09-16
Description: The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/zerohax/RedmineUP-XSS/blob/master/vcard-upload-xss; https://www.redmineup.com/pages/plugins/crm/updates; https://github.com/zerohax/RedmineUP-XSS/blob/master/vcard-upload-xss
CVE: CVE-2016-10972
Published: 2019-09-16
Description: The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://wpvulndb.com/vulnerabilities/8852; https://www.exploit-db.com/exploits/39894; https://wpvulndb.com/vulnerabilities/8852
CVE: CVE-2016-10973
Published: 2019-09-16
Description: The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8614; https://www.openwall.com/lists/oss-security/2016/05/20/5; https://wpvulndb.com/vulnerabilities/8614
CVE: CVE-2019-0207
Published: 2019-09-16
Description: Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://lists.apache.org/thread.html/765be3606d865de513f6df9288842c3cf58b09a987c617a535f2b99d%40%3Cusers.tapestry.apache.org%3E; https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E; https://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3E
CVE: CVE-2019-13140
Published: 2019-09-16
Description: Inteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that allows the "user" account to extract the 3DES key via JSON commands to ubus. The 3DES key is used to decrypt the provisioning file provided by Adamo Telecom on a public URL via cleartext HTTP.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-552
References: http://packetstormsecurity.com/files/154494/Inteno-IOPSYS-Gateway-3DES-Key-Extraction-Improper-Access.html; https://twitter.com/GerardFuguet/status/[PII_REDACTED]82896642; https://www.exploit-db.com/docs/47397
CVE: CVE-2019-15721
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.8 through 12.2.1. An internal endpoint unintentionally allowed group maintainers to view and edit group runner settings.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/61981; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15722
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.2.1. Particular mathematical expressions in GitLab Markdown can exhaust client resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/61410; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15723
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests created by email could be used to bypass push rules in certain situations.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/11302; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15724
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.10 through 12.2.1. Label descriptions are vulnerable to HTML injection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/60888; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15725
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. An IDOR in the epic notes API that could result in disclosure of private milestones, labels, and other information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/11431; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15726
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in markdown could be pointed to an arbitrary server, which would reveal the IP address of clients requesting the file from that server.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55115; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15727
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks were being applied when displaying CI results, potentially exposing some CI metrics data to unauthorized users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/11426; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15728
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.1 through 12.2.1. Protections against SSRF attacks on the Kubernetes integration are insufficient, which could have allowed an attacker to request any local network resource accessible from the GitLab server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/61314; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15730
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.14 through 12.2.1. The Jira integration contains a SSRF vulnerability as a result of a bypass of the current protection mechanisms against this type of attack, which would allow sending requests to any resources accessible in the local network by the GitLab server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/61349; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15731
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/60465; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15732
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be used to bypass project visibility restrictions.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/57015; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15733
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 7.12 through 12.2.1. The specified default branch name could be exposed to unauthorized users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/61210; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-16366
Published: 2019-09-16
Description: In XS 9.0.0 in Moddable SDK OS180329, there is a heap-based buffer overflow in fxBeginHost in xsAPI.c when called from fxRunDefine in xsRun.c, as demonstrated by crafted JavaScript code to xst.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/Moddable-OpenSource/moddable/issues/235; https://github.com/Moddable-OpenSource/moddable/issues/235
CVE: CVE-2019-8371
Published: 2019-09-16
Description: OpenEMR v5.0.1-6 allows code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://know.bishopfox.com/advisories/openemr-5-0-16-remote-code-execution-cross-site-scripting; https://know.bishopfox.com/advisories/openemr-5-0-16-remote-code-execution-cross-site-scripting
CVE: CVE-2019-10071
Published: 2019-09-16
Description: The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-203
References: https://lists.apache.org/thread.html/6e8f42c88da7be3c60aafe3f6a85eb00b4f8b444de26b38d36233a43%40%3Cusers.tapestry.apache.org%3E; https://lists.apache.org/thread.html/7a437dad5af7309aba4d01bfc2463b3ac34e6aafaa565381d3a36460%40%3Cusers.tapestry.apache.org%3E; https://lists.apache.org/thread.html/bac8d6f9e1b4059b319d9cba6f33219a99b81623476ec896138f851c%40%3Cusers.tapestry.apache.org%3E
CVE: CVE-2019-15734
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.6 through 12.2.1. Under very specific conditions, commit titles and team member comments could become viewable to users who did not have permission to access these.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/64711; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15736
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Under certain circumstances, CI pipelines could potentially be used in a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51401; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15737
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Certain account actions needed improved authentication and session management.
CVSS Score: 6.5 (MEDIUM)
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/42733; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15738
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge request IDs were being disclosed via email.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/63124; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15739
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/64033; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15740
Published: 2019-09-16
Description: An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not being removed from certain image uploads.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/61390; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-15741
Published: 2019-09-16
Description: An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/154734/GitLab-Omnibus-12.2.1-Logrotate-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2019/Oct/7; https://about.gitlab.com/2019/08/29/security-release-gitlab-12-dot-2-dot-3-released/
CVE: CVE-2019-16370
Published: 2019-09-16
Description: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b14d2f; https://github.com/gradle/gradle/pull/10543; https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b14d2f
CVE: CVE-2019-16371
Published: 2019-09-16
Description: LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because do_popupregister can be bypassed via clickjacking.
CVSS Score: 8.2 (HIGH)
CWE: CWE-1021
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1930; https://bugs.chromium.org/p/project-zero/issues/detail?id=1930
CVE: CVE-2019-4147
Published: 2019-09-16
Description: IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/158413; https://www.ibm.com/support/pages/security-bulletin-sql-injection-vulnerability-affects-ibm-sterling-file-gateway-cve-2019-4147; https://exchange.xforce.ibmcloud.com/vulnerabilities/158413
CVE: CVE-2019-5481
Published: 2019-09-16
Description: Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-415
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html; https://curl.haxx.se/docs/CVE-2019-5481.html
CVE: CVE-2019-5482
Published: 2019-09-16
Description: Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-122, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html; https://curl.haxx.se/docs/CVE-2019-5482.html
CVE: CVE-2019-15131
Published: 2019-09-17
Description: In Code42 Enterprise 6.7.5 and earlier, 6.8.4 through 6.8.8, and 7.0.0 a vulnerability has been identified that may allow arbitrary files to be uploaded to Code42 servers and executed. This vulnerability could allow an attacker to create directories and save files on Code42 servers, which could potentially lead to code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://code42.com/r/support/CVE-2019-15131; https://support.code42.com/Terms_and_conditions/Code42_customer_support_resources/Code42_security_advisories; https://code42.com/r/support/CVE-2019-15131
CVE: CVE-2019-16239
Published: 2019-09-17
Description: process_http_response in OpenConnect before 8.05 has a Buffer Overflow when a malicious server uses HTTP chunked encoding with crafted chunk sizes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://lists.infradead.org/pipermail/openconnect-devel/2019-September/005412.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00061.html
CVE: CVE-2019-16378
Published: 2019-09-17
Description: OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: addresses, which might affect applications that consider a domain name to be relevant to the origin of an e-mail message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: http://www.openwall.com/lists/oss-security/2019/09/17/2; https://bugs.debian.org/940081; https://github.com/trusteddomainproject/OpenDMARC/pull/48
CVE: CVE-2019-9008
Published: 2019-09-17
Description: An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12939&token=5b93f0d95a68ff7461d2c249d8da00f16b8f9987&download=; https://www.codesys.com/; https://www.us-cert.gov/ics/advisories/icsa-19-255-03
CVE: CVE-2016-10974
Published: 2019-09-17
Description: The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://klikki.fi/adv/fluid_responsive_slideshow.html; https://wordpress.org/plugins/fluid-responsive-slideshow/#developers; https://klikki.fi/adv/fluid_responsive_slideshow.html
CVE: CVE-2016-10975
Published: 2019-09-17
Description: The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://klikki.fi/adv/fluid_responsive_slideshow.html; https://wordpress.org/plugins/fluid-responsive-slideshow/#developers; https://klikki.fi/adv/fluid_responsive_slideshow.html
CVE: CVE-2016-10976
Published: 2019-09-17
Description: The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/safe-editor/#developers; https://wpvulndb.com/vulnerabilities/8497; https://wordpress.org/plugins/safe-editor/#developers
CVE: CVE-2016-10977
Published: 2019-09-17
Description: The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://wordpress.org/plugins/nelio-ab-testing/#developers; https://wpvulndb.com/vulnerabilities/8491; https://www.openwall.com/lists/oss-security/2016/05/10/1
CVE: CVE-2016-10978
Published: 2019-09-17
Description: The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/fossura-tag-miner/#developers; https://wpvulndb.com/vulnerabilities/8486; https://wordpress.org/plugins/fossura-tag-miner/#developers
CVE: CVE-2016-10979
Published: 2019-09-17
Description: The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/fossura-tag-miner/#developers; https://wordpress.org/plugins/fossura-tag-miner/#developers
CVE: CVE-2016-10980
Published: 2019-09-17
Description: The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/kento-post-view-counter/#developers; https://www.openwall.com/lists/oss-security/2016/04/16/2; https://wordpress.org/plugins/kento-post-view-counter/#developers
CVE: CVE-2016-10981
Published: 2019-09-17
Description: The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/kento-post-view-counter/#developers; https://www.openwall.com/lists/oss-security/2016/04/16/3; https://wordpress.org/plugins/kento-post-view-counter/#developers
CVE: CVE-2016-10982
Published: 2019-09-17
Description: The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/kento-post-view-counter/#developers; https://www.openwall.com/lists/oss-security/2016/04/16/3; https://wordpress.org/plugins/kento-post-view-counter/#developers
CVE: CVE-2016-10983
Published: 2019-09-17
Description: The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://packetstormsecurity.com/files/136887/; https://wordpress.org/plugins/ghost/#developers; https://packetstormsecurity.com/files/136887/
CVE: CVE-2016-10984
Published: 2019-09-17
Description: The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://0x62626262.wordpress.com/2016/04/21/echosign-plugin-for-wordpress-xss-vulnerability/; https://wordpress.org/plugins/echosign/#developers; https://wpvulndb.com/vulnerabilities/8465