deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-6783
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. GitLab Pages contains a directory traversal vulnerability that could lead to remote command execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55827; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6784
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54416; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6785
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Denial of Service. Inputting an overly long string into a Markdown field could cause a denial of service.
CVSS Score: 6.5 (MEDIUM)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/52212; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6786
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 1 of 3). The contents of an LFS object can be accessed by an unauthorized user, if the file size and OID are known.
CVSS Score: 6.5 (MEDIUM)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-workhorse/issues/197; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6788
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 3 of 6). For installations using GitHub or Bitbucket OAuth integrations, it is possible to use a covert redirect to obtain the user OAuth token for those services.
CVSS Score: 7.5 (HIGH)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56663; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6789
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 4 of 6). In some cases, users without project permissions will receive emails after a project move. For private projects, this will disclose the new project namespace to an unauthorized user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/44558; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6792
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Path Disclosure. When an error is encountered on project import, the error message will display instance internal information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54867; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6793
Published: 2019-09-09
Description: An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The Jira integration feature is vulnerable to an unauthenticated blind SSRF issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-918
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/50748; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6794
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows Information Disclosure (issue 5 of 6). A project guest user can view the last commit status of the default branch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54353; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6795
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Insufficient Visual Distinction of Homoglyphs Presented to a User. IDN homographs and RTLO characters are rendered to unicode, which could be used for social engineering.
CVSS Score: 5.4 (MEDIUM)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/29365; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6960
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Access to the internal wiki is permitted when an external wiki service is enabled.
CVSS Score: 9.8 (CRITICAL)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54357; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6995
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/55537; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6996
Published: 2019-09-09
Description: An issue was discovered in GitLab Enterprise Edition 10.x (starting in 10.6) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. The merge request approvers section has an access control issue that permits project maintainers to view membership of private groups.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ee/issues/8187; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-6997
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting in 10.7) and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. System notes contain an access control issue that permits a guest user to view merge request titles.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-269
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/53858; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-10253
Published: 2019-09-09
Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in TeamMate+ 21.0.0.0 that allows a remote attacker to modify application data (upload malicious/forged files on a TeamMate server, or replace existing uploaded files with malicious/forged files). The specific flaw exists within the handling of Upload/DomainObjectDocumentUpload.ashx requests because of failure to validate a CSRF token before handling a POST request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html; http://www.teammatesolutions.com/; http://packetstormsecurity.com/files/154294/Wolters-Kluwer-TeamMate-3.1-Cross-Site-Request-Forgery.html
CVE: CVE-2019-15297
Published: 2019-09-09
Description: res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: http://downloads.asterisk.org/pub/security/AST-2019-004.html; http://packetstormsecurity.com/files/154371/Asterisk-Project-Security-Advisory-AST-2019-004.html; http://packetstormsecurity.com/files/161671/Asterisk-Project-Security-Advisory-AST-2021-006.html
CVE: CVE-2019-16145
Published: 2019-09-09
Description: The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/padrino/padrino-contrib/pull/35; https://github.com/padrino/padrino-contrib/pull/35
CVE: CVE-2019-16147
Published: 2019-09-09
Description: Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f; https://github.com/liferay/liferay-portal/commit/7e063aed70f947a92bb43a4471e0c4e650fe8f7f
CVE: CVE-2019-16174
Published: 2019-09-09
Description: An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially crafted XML files and execute code or compromise data integrity.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R40
CVE: CVE-2019-16175
Published: 2019-09-09
Description: A clickjacking vulnerability was found in Limesurvey before 3.17.14.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R41; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R41
CVE: CVE-2019-16176
Published: 2019-09-09
Description: A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the path to the application in the filesystem.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R43; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R43
CVE: CVE-2019-16177
Published: 2019-09-09
Description: In Limesurvey before 3.17.14, the entire database is exposed through browser caching.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R53; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R53
CVE: CVE-2019-16178
Published: 2019-09-09
Description: A stored cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R39; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R39
CVE: CVE-2019-16179
Published: 2019-09-09
Description: Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R42; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R42
CVE: CVE-2019-16180
Published: 2019-09-09
Description: Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP authentication method is used.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R44; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R44
CVE: CVE-2019-16181
Published: 2019-09-09
Description: In Limesurvey before 3.17.14, admin users can mark other users' notifications as read.
CVSS Score: 2.7 (LOW)
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R52; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R52
CVE: CVE-2019-16182
Published: 2019-09-09
Description: A reflected cross-site scripting (XSS) vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R57; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R57
CVE: CVE-2019-16183
Published: 2019-09-09
Description: In Limesurvey before 3.17.14, admin users can run an integrity check without proper permissions.
CVSS Score: 2.7 (LOW)
CWE: CWE-276
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R50; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R50
CVE: CVE-2019-16184
Published: 2019-09-09
Description: A CSV injection vulnerability was found in Limesurvey before 3.17.14 that allows survey participants to inject commands via their survey responses that will be included in the export CSV file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R46
CVE: CVE-2019-16185
Published: 2019-09-09
Description: In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-276
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R51; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R51
CVE: CVE-2019-16186
Published: 2019-09-09
Description: In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-276
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R49; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R49
CVE: CVE-2019-16187
Published: 2019-09-09
Description: Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie value via a client-side script.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R48; https://www.limesurvey.org/limesurvey-updates/2188-limesurvey-3-17-14-build-190902-released; https://github.com/LimeSurvey/LimeSurvey/commit/5870fd1037058bc4e43cccf893b576c72293371e#diff-d539f3f8185667ee48db78e1bf65a3b4R48
CVE: CVE-2019-16192
Published: 2019-09-09
Description: upload_model() in /admini/controllers/system/managemodel.php in DocCms 2016.5.17 allow remote attackers to execute arbitrary PHP code through module management files, as demonstrated by a .php file in a ZIP archive.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://github.com/SuperSalsa20/Doccms-Execute-Code/blob/master/README.md; https://github.com/SuperSalsa20/Doccms-Execute-Code/blob/master/README.md
CVE: CVE-2019-6791
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control (issue 3 of 3). When a project with visibility more permissive than the target group is imported, it will retain its prior visibility.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2019-7176
Published: 2019-09-09
Description: An issue was discovered in GitLab Community and Enterprise Edition 8.x (starting in 8.9), 9.x, 10.x, and 11.x before 11.5.9, 11.6.x before 11.6.7, and 11.7.x before 11.7.2. It has Incorrect Access Control. Guest users are able to add reaction emojis on comments to which they have no visibility.
CVSS Score: 3.7 (LOW)
References: https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/; https://gitlab.com/gitlab-org/gitlab-ce/issues/51332; https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/
CVE: CVE-2017-18596
Published: 2019-09-10
Description: The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://wordpress.org/plugins/elementor/#developers; https://wpvulndb.com/vulnerabilities/8965; https://wordpress.org/plugins/elementor/#developers
CVE: CVE-2017-18597
Published: 2019-09-10
Description: The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://lenonleite.com.br/en/2017/09/11/jtrt-responsive-tables-wordpress-plugin-sql-injection/; https://wordpress.org/plugins/jtrt-responsive-tables/#developers; https://wpvulndb.com/vulnerabilities/8953
CVE: CVE-2017-18598
Published: 2019-09-10
Description: The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8934; https://wpvulndb.com/vulnerabilities/8934
CVE: CVE-2017-18599
Published: 2019-09-10
Description: The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8900; https://wpvulndb.com/vulnerabilities/8900
CVE: CVE-2017-18600
Published: 2019-09-10
Description: The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8877; https://wpvulndb.com/vulnerabilities/8877
CVE: CVE-2017-18601
Published: 2019-09-10
Description: The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/42351; https://www.exploit-db.com/exploits/42351
CVE: CVE-2017-18602
Published: 2019-09-10
Description: The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/42351; https://www.exploit-db.com/exploits/42351
CVE: CVE-2017-18603
Published: 2019-09-10
Description: The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/postman-smtp/#developers; https://www.pluginvulnerabilities.com/2017/06/29/reflected-cross-site-scripting-xss-vulnerability-in-postman-smtp/; https://wordpress.org/plugins/postman-smtp/#developers
CVE: CVE-2017-18604
Published: 2019-09-10
Description: The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-502
References: https://wordpress.org/plugins/sitebuilder-dynamic-components/#developers; https://wpvulndb.com/vulnerabilities/8829; https://wordpress.org/plugins/sitebuilder-dynamic-components/#developers
CVE: CVE-2017-18605
Published: 2019-09-10
Description: The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-502
References: https://wordpress.org/plugins/gravitate-qa-tracker/#developers; https://wpvulndb.com/vulnerabilities/8824; https://wordpress.org/plugins/gravitate-qa-tracker/#developers
CVE: CVE-2017-18606
Published: 2019-09-10
Description: The avada theme before 5.1.5 for WordPress has stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/8801; https://wpvulndb.com/vulnerabilities/8801