deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-2190
Published: 2015-03-08
Description: epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet that is improperly handled by the LLDP dissector.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html; http://www.oracle.com/technetwork/topics/security/bulletinapr2[PII_REDACTED].html; http://www.securityfocus.com/bid/72938
CVE: CVE-2015-2191
Published: 2015-03-08
Description: Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://advisories.mageia.org/MGASA-2015-0117.html; http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html; http://rhn.redhat.com/errata/RHSA-2015-1460.html
CVE: CVE-2015-2192
Published: 2015-03-08
Description: Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-updates/2015-03/msg00038.html; http://www.securityfocus.com/bid/72937; http://www.securitytracker.com/id/1031858
CVE: CVE-2011-5319
Published: 2015-03-09
Description: content/renderer/device_sensors/device_motion_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate accelerometer data, which makes it easier for remote attackers to capture keystrokes via a crafted web site that listens for ondevicemotion events, a different vulnerability than CVE-2015-1231.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://dl.acm.org/citation.cfm?id=2046771; http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://www.cc.gatech.edu/~traynor/papers/traynor-ccs11.pdf
CVE: CVE-2014-9689
Published: 2015-03-09
Description: content/renderer/device_sensors/device_orientation_event_pump.cc in Google Chrome before 41.0.2272.76 does not properly restrict access to high-rate gyroscope data, which makes it easier for remote attackers to obtain speech signals from a device's physical environment via a crafted web site that listens for ondeviceorientation events, a different vulnerability than CVE-2015-1231.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=421691; https://code.google.com/p/chromium/issues/detail?id=463349
CVE: CVE-2015-1213
Published: 2015-03-09
Description: The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1214
Published: 2015-03-09
Description: Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1215
Published: 2015-03-09
Description: The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1216
Published: 2015-03-09
Description: Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1217
Published: 2015-03-09
Description: The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1218
Published: 2015-03-09
Description: Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1219
Published: 2015-03-09
Description: Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1220
Published: 2015-03-09
Description: Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size in a GIF image.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1221
Published: 2015-03-09
Description: Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1222
Published: 2015-03-09
Description: Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in content/browser/service_worker/service_worker_script_cache_map.cc in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a ServiceWorkerContextWrapper::DeleteAndStartOver call, related to the NotifyStartedCaching and NotifyFinishedCaching functions.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1223
Published: 2015-03-09
Description: Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events, as demonstrated by events for invalid input or input to read-only fields, related to the initializeTypeInParsing and updateType functions.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1224
Published: 2015-03-09
Description: The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-17
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1225
Published: 2015-03-09
Description: PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1226
Published: 2015-03-09
Description: The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1227
Published: 2015-03-09
Description: The DragImage::create function in platform/DragImage.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not initialize memory for image drawing, which allows remote attackers to have an unspecified impact by triggering a failed image decoding, as demonstrated by an image for which the default orientation cannot be used.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1228
Published: 2015-03-09
Description: The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not force a relayout operation and consequently does not initialize memory for a data structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1229
Published: 2015-03-09
Description: net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-19
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1230
Published: 2015-03-09
Description: The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers "type confusion."
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.securityfocus.com/bid/72901
CVE: CVE-2015-1231
Published: 2015-03-09
Description: Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2015-0627.html; http://www.ubuntu.com/usn/USN-2521-1
CVE: CVE-2015-1232
Published: 2015-03-09
Description: Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; https://code.google.com/p/chromium/issues/detail?id=456516; https://codereview.chromium.org/907793002
CVE: CVE-2015-2238
Published: 2015-03-09
Description: Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://www.ubuntu.com/usn/USN-2521-1; http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html
CVE: CVE-2015-2239
Published: 2015-03-09
Description: Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-19
References: http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html; http://www.securityfocus.com/bid/74855; https://code.google.com/p/chromium/issues/detail?id=256724
CVE: CVE-2014-3691
Published: 2015-03-09
Description: Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://projects.theforeman.org/issues/7822; http://rhn.redhat.com/errata/RHSA-2015-0287.html; http://rhn.redhat.com/errata/RHSA-2015-0288.html
CVE: CVE-2014-9472
Published: 2015-03-09
Description: The email gateway in RT (aka Request Tracker) 3.0.0 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to cause a denial of service (CPU and disk consumption) via a crafted email.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html
CVE: CVE-2015-0254
Published: 2015-03-09
Description: Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-updates/2015-10/msg00033.html; http://mail-archives.apache.org/mod_mbox/tomcat-taglibs-user/201502.mbox/%3C82207A16-6348-4DEE-877E-F7B87292576A%40apache.org%3E; http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html
CVE: CVE-2015-1165
Published: 2015-03-09
Description: RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html
CVE: CVE-2015-1464
Published: 2015-03-09
Description: RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-284
References: http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154213.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154047.html
CVE: CVE-2015-2061
Published: 2015-03-09
Description: Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/72836; http://www.zerodayinitiative.com/advisories/ZDI-15-051/; https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS172389
CVE: CVE-2015-2063
Published: 2015-03-09
Description: Integer overflow in unace 1.2b allows remote attackers to cause a denial of service (crash) via a small file header in an ace archive, which triggers a buffer overflow.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://www.debian.org/security/2015/dsa-3178; http://www.openwall.com/lists/oss-security/2015/02/24/1; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775003
CVE: CVE-2015-2092
Published: 2015-03-09
Description: The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/72840; http://www.zerodayinitiative.com/advisories/ZDI-15-053/; http://www.securityfocus.com/bid/72840
CVE: CVE-2015-2093
Published: 2015-03-09
Description: Stack-based buffer overflow in the Connect function in the WebGate WebEyeAudio ActiveX control allows remote attackers to execute arbitrary code via a crafted value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/72839; http://www.zerodayinitiative.com/advisories/ZDI-15-054/; http://www.securityfocus.com/bid/72839
CVE: CVE-2015-2094
Published: 2015-03-09
Description: Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to execute arbitrary code via unspecified vectors to the (1) PrintSiteImage, (2) PlaySiteAllChannel, (3) StopSiteAllChannel, or (4) SaveSiteImage function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/131069/WebGate-WinRDS-2.0.8-StopSiteAllChannel-Stack-Overflow.html; http://www.osvdb.org/118905; http://www.osvdb.org/118906
CVE: CVE-2015-2095
Published: 2015-03-09
Description: Heap-based buffer overflow in the SetConnectInfo function in the WESPPTZ.WESPPTZCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via crafted arguments.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/73222; http://www.zerodayinitiative.com/advisories/ZDI-15-070/; http://www.securityfocus.com/bid/73222
CVE: CVE-2015-2096
Published: 2015-03-09
Description: Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/72849; http://www.zerodayinitiative.com/advisories/ZDI-15-069/; http://www.securityfocus.com/bid/72849
CVE: CVE-2015-2097
Published: 2015-03-09
Description: Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1) LoadImage or (2) LoadImageEx function in the WESPMonitor.WESPMonitorCtrl.1 control, (3) ChangePassword function in the WESPCONFIGLib.UserItem control, Connect function in the (4) WESPSerialPort.WESPSerialPortCtrl.1 or (5) WESPPLAYBACKLib.WESPPlaybackCtrl control, or (6) AddID function in the WESPCONFIGLib.IDList control or a (7) long string to the second argument to the ConnectEx3 function in the WESPPLAYBACKLib.WESPPlaybackCtrl control.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/131072/WebGate-eDVR-Manager-Stack-Buffer-Overflow.html; http://seclists.org/fulldisclosure/2015/Feb/90; http://www.osvdb.org/118893
CVE: CVE-2015-1874
Published: 2015-03-09
Description: Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/130654/WordPress-Contact-Form-DB-2.8.29-Cross-Site-Request-Forgery.html; http://seclists.org/fulldisclosure/2015/Mar/21; http://www.securityfocus.com/bid/72964
CVE: CVE-2014-7888
Published: 2015-03-09
Description: The OLE Point of Sale (OPOS) drivers before 1.13.003 on HP Point of Sale Windows PCs allow remote attackers to execute arbitrary code via vectors involving OPOSMICR.ocx for PUSB Thermal Receipt printers, SerialUSB Thermal Receipt printers, Hybrid POS printers with MICR, Value PUSB Receipt printers, and Value Serial/USB Receipt printers, aka ZDI-CAN-2512.
CVSS Score: 10.0 (HIGH)
References: http://www.securitytracker.com/id/1031840; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04583185; http://www.securitytracker.com/id/1031840