deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-6381
Published: 2016-10-05
Description: Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allow remote attackers to cause a denial of service (memory consumption or device reload) via fragmented IKEv1 packets, aka Bug ID CSCuy47382.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-ios-ikev1; http://www.securityfocus.com/bid/93195; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6382
Published: 2016-10-05
Description: Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a malformed IPv6 Protocol Independent Multicast (PIM) register packet, aka Bug ID CSCuy16399.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-msdp; http://www.securityfocus.com/bid/93211; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6384
Published: 2016-10-05
Description: Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-h323; http://www.securityfocus.com/bid/93209; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6386
Published: 2016-10-05
Description: Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service (data-structure corruption and device reload) via fragmented IPv4 packets, aka Bug ID CSCux66005.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-frag; http://www.securityfocus.com/bid/93202; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6392
Published: 2016-10-05
Description: Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a crafted IPv4 Multicast Source Discovery Protocol (MSDP) Source-Active (SA) message, aka Bug ID CSCud36767.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-msdp; http://www.securityfocus.com/bid/93211; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6416
Published: 2016-10-05
Description: The FTP service in Cisco AsyncOS on Email Security Appliance (ESA) devices 9.6.0-000 through 9.9.6-026, Web Security Appliance (WSA) devices 9.0.0-162 through 9.5.0-444, and Content Security Management Appliance (SMA) devices allows remote attackers to cause a denial of service via a flood of FTP traffic, aka Bug IDs CSCuz82907, CSCuz84330, and CSCuz86065.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-aos; http://www.securityfocus.com/bid/93198; http://www.securitytracker.com/id/1036915
CVE: CVE-2016-6417
Published: 2016-10-05
Description: Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-fmc; http://www.securityfocus.com/bid/93199; http://www.securitytracker.com/id/1036918
CVE: CVE-2016-6418
Published: 2016-10-05
Description: Cross-site scripting (XSS) vulnerability in Cisco Videoscape Distribution Suite Service Manager (VDS-SM) 3.0 through 3.4.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCva14552.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-vds; http://www.securityfocus.com/bid/93207; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-vds
CVE: CVE-2016-1455
Published: 2016-10-05
Description: Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote attackers to obtain sensitive information via TCP or UDP traffic, aka Bug ID CSCuz05365.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-n9kinfo; http://www.securityfocus.com/bid/93415; http://www.securitytracker.com/id/1036957
CVE: CVE-2016-6378
Published: 2016-10-05
Description: Cisco IOS XE 3.1 through 3.17 and 16.1 through 16.2 allows remote attackers to cause a denial of service (device reload) via crafted ICMP packets that require NAT, aka Bug ID CSCuw85853.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-esp-nat; http://www.securityfocus.com/bid/93200; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6379
Published: 2016-10-05
Description: Cisco IOS 12.2 and IOS XE 3.14 through 3.16 and 16.1 allow remote attackers to cause a denial of service (device reload) via crafted IP Detail Record (IPDR) packets, aka Bug ID CSCuu35089.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-ipdr; http://www.securityfocus.com/bid/93205; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6380
Published: 2016-10-05
Description: The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response, aka Bug ID CSCup90532.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-dns; http://www.securityfocus.com/bid/93201; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6385
Published: 2016-10-05
Description: Memory leak in the Smart Install client implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.2 through 3.8 allows remote attackers to cause a denial of service (memory consumption) via crafted image-list parameters, aka Bug ID CSCuy82367.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-smi; http://www.securityfocus.com/bid/93203; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6391
Published: 2016-10-05
Description: Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series of Common Industrial Protocol (CIP) requests, aka Bug ID CSCur69036.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-cip; http://www.securityfocus.com/bid/93197; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6393
Published: 2016-10-05
Description: The AAA service in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.1 through 3.18 and 16.2 allows remote attackers to cause a denial of service (device reload) via a failed SSH connection attempt that is mishandled during generation of an error-log message, aka Bug ID CSCuy87667.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-aaados; http://www.securityfocus.com/bid/93196; http://www.securitytracker.com/id/1036914
CVE: CVE-2016-6421
Published: 2016-10-05
Description: Cisco IOS XR 5.2.2 allows remote attackers to cause a denial of service (process restart) via a crafted OSPF Link State Advertisement (LSA) update, aka Bug ID CSCvb05643.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-ospf; http://www.securityfocus.com/bid/93212; http://www.securitytracker.com/id/1036909
CVE: CVE-2016-6423
Published: 2016-10-05
Description: The IKEv2 client and initiator implementations in Cisco IOS 15.5(3)M and IOS XE allow remote IKEv2 servers to cause a denial of service (device reload) via crafted IKEv2 packets, aka Bug ID CSCux97540.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ios-ikev; http://www.securityfocus.com/bid/93411; http://www.securitytracker.com/id/1036955
CVE: CVE-2016-6426
Published: 2016-10-05
Description: The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis2; http://www.securityfocus.com/bid/93420; http://www.securitytracker.com/id/1036952
CVE: CVE-2016-7020
Published: 2016-10-05
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/94192; https://access.redhat.com/errata/RHSA-2016:1423; https://helpx.adobe.com/security/products/flash-player/apsb16-25.html
CVE: CVE-2015-6392
Published: 2016-10-06
Description: Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via crafted IPv4 DHCP packets to the (1) DHCPv4 relay agent or (2) smart relay agent, aka Bug IDs CSCuq24603, CSCur93159, CSCus21693, and CSCut76171.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp1; http://www.securityfocus.com/bid/93406; http://www.securitytracker.com/id/1036948
CVE: CVE-2015-0721
Published: 2016-10-06
Description: Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation, aka Bug IDs CSCum35502, CSCuw78669, CSCuw79754, and CSCux88492.
CVSS Score: 8.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa; http://www.securityfocus.com/bid/93410; http://www.securitytracker.com/id/1036947
CVE: CVE-2015-6393
Published: 2016-10-06
Description: Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via malformed IPv4 DHCP packets to the DHCPv4 relay agent, aka Bug IDs CSCuq39250, CSCus21733, CSCus21739, CSCut76171, and CSCux67182.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2; http://www.securityfocus.com/bid/93419; http://www.securitytracker.com/id/1036949
CVE: CVE-2016-1453
Published: 2016-10-06
Description: Buffer overflow in the Overlay Transport Virtualization (OTV) GRE feature in Cisco NX-OS 5.0 through 7.3 on Nexus 7000 and 7700 devices allows remote attackers to execute arbitrary code via long parameters in a packet header, aka Bug ID CSCuy95701.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-otv; http://www.securityfocus.com/bid/93409; http://www.securitytracker.com/id/1036946
CVE: CVE-2016-1454
Published: 2016-10-06
Description: Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v, 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device reload) by leveraging a peer relationship to send a crafted BGP UPDATE message, aka Bug IDs CSCuq77105 and CSCux11417.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-bgp; http://www.securityfocus.com/bid/93417; http://www.securitytracker.com/id/1036950
CVE: CVE-2016-6023
Published: 2016-10-06
Description: Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991278; http://www.securityfocus.com/bid/93347; http://www-01.ibm.com/support/docview.wss?uid=swg21991278
CVE: CVE-2016-6025
Published: 2016-10-06
Description: The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to obtain access by leveraging an unattended workstation to conduct a post-logoff session-reuse attack involving a modified URL.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991278; http://www.securityfocus.com/bid/93345; http://www-01.ibm.com/support/docview.wss?uid=swg21991278
CVE: CVE-2016-6026
Published: 2016-10-06
Description: The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991278; http://www.securityfocus.com/bid/93342; http://www-01.ibm.com/support/docview.wss?uid=swg21991278
CVE: CVE-2016-6027
Published: 2016-10-06
Description: The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21991278; http://www.securityfocus.com/bid/93340; http://www-01.ibm.com/support/docview.wss?uid=swg21991278
CVE: CVE-2016-6422
Published: 2016-10-06
Description: Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, which allows remote attackers to bypass intended access restrictions by sending packets that should have been recognized by a filter, aka Bug ID CSCuy64806.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-catalyst; http://www.securityfocus.com/bid/93404; http://www.securitytracker.com/id/1036954
CVE: CVE-2016-6424
Published: 2016-10-06
Description: The DHCP Relay implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4.7.29 and 9.1.7.4 allows remote attackers to cause a denial of service (interface wedge) via a crafted rate of DHCP packet transmission, aka Bug ID CSCuy66942.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-asa-dhcp; http://www.securityfocus.com/bid/93408; http://www.securitytracker.com/id/1036961
CVE: CVE-2016-6425
Published: 2016-10-06
Description: Cross-site scripting (XSS) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCuy75020 and CSCuy81652.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis1; http://www.securityfocus.com/bid/93422; http://www.securitytracker.com/id/1036951
CVE: CVE-2016-6427
Published: 2016-10-06
Description: Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuy75036 and CSCuy81654.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ucis3; http://www.securityfocus.com/bid/93418; http://www.securitytracker.com/id/1036953
CVE: CVE-2016-6428
Published: 2016-10-06
Description: Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-iosxr; http://www.securityfocus.com/bid/93416; http://www.securitytracker.com/id/1036956
CVE: CVE-2016-6433
Published: 2016-10-06
Description: The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/140467/Cisco-Firepower-Management-Console-6.0-Post-Authentication-UserAdd.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc; http://www.securityfocus.com/bid/93414
CVE: CVE-2016-6434
Published: 2016-10-06
Description: Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leveraging CLI access, aka Bug ID CSCva30370.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc1; http://www.securityfocus.com/bid/93412; https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking
CVE: CVE-2016-6435
Published: 2016-10-06
Description: The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-ftmc2; http://www.securityfocus.com/bid/93421; https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking
CVE: CVE-2016-6436
Published: 2016-10-06
Description: Cross-site scripting (XSS) vulnerability in HostScan Engine 3.0.08062 through 3.1.14018 in the Cisco Host Scan package, as used in ASA Web VPN, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuz14682.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-chs; http://www.securityfocus.com/bid/93407; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-chs
CVE: CVE-2016-6653
Published: 2016-10-06
Description: The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93480; https://pivotal.io/security/cve-2016-6653; http://www.securityfocus.com/bid/93480
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.vapidlabs.com/advisory.php?v=138; http://www.vapidlabs.com/advisory.php?v=138
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/96554; http://www.vapidlabs.com/advisory.php?v=139; http://www.securityfocus.com/bid/96554
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Open Proxy in filedownload v1.4 wordpress plugin
CVSS Score: 8.2 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97100; http://www.vapidlabs.com/advisory.php?v=140; http://www.securityfocus.com/bid/97100
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Blind SQL Injection in filedownload v1.4 wordpress plugin
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/97106; http://www.vapidlabs.com/advisory.php?v=140; http://www.securityfocus.com/bid/97106
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: XSS in filedownload v1.4 wordpress plugin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/97107; http://www.vapidlabs.com/advisory.php?v=140; http://www.securityfocus.com/bid/97107
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/97108; http://www.vapidlabs.com/advisory.php?v=142; http://www.securityfocus.com/bid/97108
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file download vulnerability in recent-backups v0.7 wordpress plugin
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/97125; http://www.vapidlabs.com/advisory.php?v=144; http://www.securityfocus.com/bid/97125
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file download vulnerability in wptf-image-gallery v1.03
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-285
References: http://www.vapidlabs.com/advisory.php?v=148; http://www.vapidlabs.com/advisory.php?v=148
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.vapidlabs.com/advisory.php?v=149; http://www.vapidlabs.com/advisory.php?v=149
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: http://www.vapidlabs.com/advisory.php?v=151; http://www.vapidlabs.com/advisory.php?v=151
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file download in simple-image-manipulator v1.0 wordpress plugin
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94563; http://www.vapidlabs.com/advisory.php?v=147; http://www.securityfocus.com/bid/94563
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Blind SQL Injection in wordpress plugin dukapress v2.5.9
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/94567; http://www.vapidlabs.com/advisory.php?v=152; http://www.securityfocus.com/bid/94567
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94495; http://www.vapidlabs.com/advisory.php?v=154; http://www.securityfocus.com/bid/94495
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-06
Description: Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://www.securityfocus.com/bid/94497; http://www.vapidlabs.com/advisory.php?v=153; http://www.securityfocus.com/bid/94497