deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2714
Published: 2020-01-09
Description: The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://drupal.org/node/1597414; http://www.openwall.com/lists/oss-security/2012/06/14/3; http://www.securityfocus.com/bid/53673
CVE: CVE-2012-2724
Published: 2020-01-09
Description: The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://drupal.org/node/1619812; http://drupal.org/node/1619818; http://drupal.org/node/1619820
CVE: CVE-2016-5311
Published: 2020-01-09
Description: A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton Internet Security, Norton 360, Endpoint Protection Small Business Edition Cloud, and Endpoint Protection Cloud Client due to a DLL-preloading without path restrictions, which could let a local malicious user obtain system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/94295; http://www.securitytracker.com/id/1037323; http://www.securitytracker.com/id/1037324
CVE: CVE-2019-6319
Published: 2020-01-09
Description: HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmware version SWP1FN1912BR or higher) have a Cross-Site Request Forgery (CSRF) vulnerability that could lead to a denial of service (DOS) or device misconfiguration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://support.hp.com/us-en/document/c06308143; https://support.hp.com/us-en/document/c06308143
CVE: CVE-2020-6166
Published: 2020-01-09
Description: A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-276
References: https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers; https://wpvulndb.com/vulnerabilities/10009; https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/
CVE: CVE-2020-6168
Published: 2020-01-09
Description: A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting).
CVSS Score: 7.6 (HIGH)
CWE: CWE-862
References: https://wordpress.org/plugins/minimal-coming-soon-maintenance-mode/#developers; https://wpvulndb.com/vulnerabilities/10008; https://www.wordfence.com/blog/2020/01/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin/
CVE: CVE-2020-6750
Published: 2020-01-09
Description: GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.
CVSS Score: 5.9 (MEDIUM)
References: https://bugzilla.suse.com/show_bug.cgi?id=1160668; https://gitlab.gnome.org/GNOME/glib/issues/1989; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5RIFEDSRJ4P3WFCMDUOFQ2LEILZLMDW7/
CVE: CVE-2010-3282
Published: 2020-01-09
Description: 389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.
CVSS Score: 3.3 (LOW)
CWE: CWE-312
References: http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6914; https://bugzilla.redhat.com/show_bug.cgi?id=625950; https://git.fedorahosted.org/cgit/389/ds.git/commit/?id=d38ae06
CVE: CVE-2012-1915
Published: 2020-01-09
Description: EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/54620; http://www.securityfocus.com/bid/54620
CVE: CVE-2012-2142
Published: 2020-01-09
Description: The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.
CVSS Score: 7.8 (HIGH)
References: http://cgit.freedesktop.org/poppler/poppler/commit/?id=71bad47ed6a36d825b0d08992c8db56845c71e40; http://cgit.freedesktop.org/poppler/poppler/commit/NEWS?id=2bc48d5369f1dbecfc4db2878f33bdeb80d8d90f; http://lists.opensuse.org/opensuse-updates/2013-08/msg00049.html
CVE: CVE-2012-2226
Published: 2020-01-09
Description: Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.securityfocus.com/bid/52998; https://exchange.xforce.ibmcloud.com/vulnerabilities/74855; http://www.securityfocus.com/bid/52998
CVE: CVE-2012-2931
Published: 2020-01-09
Description: PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-74
References: https://www.htbridge.com/advisory/HTB23093; https://www.htbridge.com/advisory/HTB23093
CVE: CVE-2012-3490
Published: 2020-01-09
Description: The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.
CVSS Score: 8.8 (HIGH)
References: http://condor-git.cs.wisc.edu/?p=condor.git%3Ba=commitdiff%3Bh=94e84ce4; http://research.cs.wisc.edu/condor/manual/v7.6/8_3Stable_Release.html; http://research.cs.wisc.edu/condor/manual/v7.8/9_3Stable_Release.html
CVE: CVE-2012-4434
Published: 2020-01-09
Description: fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276
References: http://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html; http://www.openwall.com/lists/oss-security/2012/09/19/2; http://www.openwall.com/lists/oss-security/2012/09/20/4
CVE: CVE-2012-5558
Published: 2020-01-09
Description: Cross-site scripting (XSS) vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a smiley acronym.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/1840892; http://drupal.org/node/1840954; http://drupal.org/node/1840956
CVE: CVE-2019-18859
Published: 2020-01-09
Description: Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155926/Digi-AnywhereUSB-14-Cross-Site-Scripting.html; https://gist.github.com/RNPG/e0d25ad51aa5c288b9005900f88a4f03; http://packetstormsecurity.com/files/155926/Digi-AnywhereUSB-14-Cross-Site-Scripting.html
CVE: CVE-2019-20180
Published: 2020-01-09
Description: The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users. Note: The vendor disputes this issue and argues that this responsibility lies with the application that opens the CSV file and not TablePress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1236
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8; https://wordpress.org/support/topic/security-issue-cve-2019-20180-for-tablepress/#post-16282996; https://wpvulndb.com/vulnerabilities/10016
CVE: CVE-2019-20372
Published: 2020-01-09
Description: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00013.html; http://nginx.org/en/CHANGES; http://seclists.org/fulldisclosure/2021/Sep/36
CVE: CVE-2012-2950
Published: 2020-01-09
Description: Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote attackers to execute local PHP code and obtain sensitive information.
CVSS Score: 8.1 (HIGH)
CWE: CWE-434
References: http://www.securityfocus.com/bid/53737; https://exchange.xforce.ibmcloud.com/vulnerabilities/75983; http://www.securityfocus.com/bid/53737
CVE: CVE-2012-3806
Published: 2020-01-09
Description: Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://packetstormsecurity.com/files/cve/CVE-2012-3806; https://www.securityfocus.com/bid/55936; https://www.tenable.com/plugins/nessus/65612
CVE: CVE-2012-3807
Published: 2020-01-09
Description: Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
CVSS Score: 9.8 (CRITICAL)
References: https://packetstormsecurity.com/files/cve/CVE-2012-3806; https://www.securityfocus.com/bid/55936; https://www.tenable.com/plugins/nessus/65612
CVE: CVE-2012-3808
Published: 2020-01-09
Description: Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
CVSS Score: 7.5 (HIGH)
References: https://packetstormsecurity.com/files/cve/CVE-2012-3808; https://www.securityfocus.com/bid/55936; https://www.tenable.com/plugins/nessus/65612
CVE: CVE-2012-3809
Published: 2020-01-09
Description: Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
CVSS Score: 7.5 (HIGH)
References: https://packetstormsecurity.com/files/cve/CVE-2012-3809; https://www.securityfocus.com/bid/55936; https://www.tenable.com/plugins/nessus/65612
CVE: CVE-2012-3810
Published: 2020-01-09
Description: Samsung Kies before 2.5.0.12094_27_11 has registry modification.
CVSS Score: 7.5 (HIGH)
References: https://packetstormsecurity.com/files/cve/CVE-2012-3809; https://www.securityfocus.com/bid/55936; https://www.tenable.com/plugins/nessus/65612
CVE: CVE-2019-18961
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18962
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18963
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18964
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18965
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18966
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18967
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18968
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18969
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-18970
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-20178
Published: 2020-01-09
Description: Advisto PEEL Shopping 9.2.1 has CSRF via administrer/utilisateurs.php to delete a user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20178-peel-shopping-ecommerce-shopping-cart-9-2-1-cross-site-request-forgery-17fc49ab5a65; https://medium.com/%40Pablo0xSantiago/cve-2019-20178-peel-shopping-ecommerce-shopping-cart-9-2-1-cross-site-request-forgery-17fc49ab5a65
CVE: CVE-2019-20179
Published: 2020-01-09
Description: SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20179-so-planning-1-45-sql-injection-5f0050ad81d1; https://medium.com/%40Pablo0xSantiago/cve-2019-20179-so-planning-1-45-sql-injection-5f0050ad81d1
CVE: CVE-2019-20181
Published: 2020-01-09
Description: The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20181-awesome-support-wordpress-helpdesk-support-plugin-5-8-0-84a0c022cf53; https://medium.com/%40Pablo0xSantiago/cve-2019-20181-awesome-support-wordpress-helpdesk-support-plugin-5-8-0-84a0c022cf53
CVE: CVE-2019-20182
Published: 2020-01-09
Description: The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20182-foogallery-image-gallery-wordpress-plugin-1-8-12-stored-cross-site-scripting-d5864f1259f; https://medium.com/%40Pablo0xSantiago/cve-2019-20182-foogallery-image-gallery-wordpress-plugin-1-8-12-stored-cross-site-scripting-d5864f1259f
CVE: CVE-2019-20183
Published: 2020-01-09
Description: uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension validation is only on the client side. The attacker can modify global.js to allow the .php extension.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34; https://medium.com/%40Pablo0xSantiago/cve-2019-20183-employee-records-system-bypass-file-upload-to-rce-ea2653660b34
CVE: CVE-2019-20184
Published: 2020-01-09
Description: KeePass 2.4.1 allows CSV injection in the title field of a CSV export.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20184-keepass-2-4-1-csv-injection-33f08de3c11a; https://medium.com/%40Pablo0xSantiago/cve-2019-20184-keepass-2-4-1-csv-injection-33f08de3c11a
CVE: CVE-2019-5205
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5206
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5207
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5208
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2019-5209
Published: 2020-01-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2019. Notes: none
CVE: CVE-2020-5504
Published: 2020-01-09
Description: In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00024.html; https://cybersecurityworks.com/zerodays/cve-2020-5504-phpmyadmin.html; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-5504.md
CVE: CVE-2019-20373
Published: 2020-01-09
Description: LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the user's shell lacks support for Bourne shell syntax. This is related to a run-x-session script.
CVSS Score: 7.8 (HIGH)
References: https://git.launchpad.net/~ltsp-upstream/ltsp/+git/ldm/commit/?id=c351ac69ef63ed6c84221cef73e409059661b8ba; https://lists.debian.org/debian-lts-announce/2020/01/msg00007.html; https://www.debian.org/security/2020/dsa-4601
CVE: CVE-2019-20374
Published: 2020-01-09
Description: A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e; https://github.com/typora/typora-issues/issues/3124; https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e
CVE: CVE-2020-6756
Published: 2020-01-09
Description: languageOptions.php in Rasilient PixelStor 5000 K:4.0.[PII_REDACTED]9 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155898/PixelStor-5000-K-4.0.[PII_REDACTED]9-Remote-Code-Execution.html; https://pwnedchile.com/2020/01/08/pixelstor-5000-rce-exploit/; http://packetstormsecurity.com/files/155898/PixelStor-5000-K-4.0.[PII_REDACTED]9-Remote-Code-Execution.html
CVE: CVE-2020-6757
Published: 2020-01-09
Description: contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.[PII_REDACTED]9 (KDI Version) allows authenticated attackers to remotely execute code via the name parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://pwnedchile.com/2020/01/08/pixelstor-5000-rce-exploit/; https://pwnedchile.com/2020/01/08/pixelstor-5000-rce-exploit/
CVE: CVE-2020-6758
Published: 2020-01-09
Description: A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.[PII_REDACTED]9 (KDI Version) allows remote attackers to inject arbitrary web script or HTML via the ContentFrame parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pwnedchile.com/2020/01/08/pixelstor-5000-rce-exploit/; https://pwnedchile.com/2020/01/08/pixelstor-5000-rce-exploit/
CVE: CVE-2019-20375
Published: 2020-01-10
Description: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via the value parameter in a localization (loc) command to elogd.c.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bitbucket.org/ritt/elog/commits/eefdabb714f26192f585083ef96c8413e459a1d1; https://bitbucket.org/ritt/elog/commits/eefdabb714f26192f585083ef96c8413e459a1d1
CVE: CVE-2019-20376
Published: 2020-01-10
Description: A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG document to elogd.c.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://bitbucket.org/ritt/elog/commits/993bed4923c88593cc6b1186e0d1b9564994a25a; https://bitbucket.org/ritt/elog/commits/993bed4923c88593cc6b1186e0d1b9564994a25a
CVE: CVE-2014-5011
Published: 2020-01-10
Description: DOMPDF before 0.6.2 allows Information Disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2; https://github.com/dompdf/dompdf/releases/tag/v0.6.2; https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2
CVE: CVE-2014-5012
Published: 2020-01-10
Description: DOMPDF before 0.6.2 allows denial of service.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2; https://github.com/dompdf/dompdf/releases/tag/v0.6.2; https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2
CVE: CVE-2014-5013
Published: 2020-01-10
Description: DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
CVSS Score: 8.8 (HIGH)
References: https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2; https://github.com/dompdf/dompdf/releases/tag/v0.6.2; https://github.com/dompdf/dompdf/compare/v0.6.1...v0.6.2
CVE: CVE-2014-4530
Published: 2020-01-10
Description: flog plugin 0.1 for WordPress has XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-flog-a3-cross-site-scripting-xss/; http://codevigilant.com/disclosure/wp-plugin-flog-a3-cross-site-scripting-xss/
CVE: CVE-2014-4982
Published: 2020-01-10
Description: LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://packetstormsecurity.com/files/127593/LPAR2RRD-3.5-4.53-Command-Injection.html; http://www.openwall.com/lists/oss-security/2014/07/23/6; http://www.securityfocus.com/bid/68850
CVE: CVE-2014-4984
Published: 2020-01-10
Description: Déjà Vu Crescendo Sales CRM has remote SQL Injection
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127769/Crescendo-Sales-CRM-SQL-Injection.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95176; https://www.securityfocus.com/bid/69085/info