deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1935
Published: 2019-08-21
Description: A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html; http://packetstormsecurity.com/files/154305/Cisco-UCS-Director-Default-scpuser-Password.html; http://seclists.org/fulldisclosure/2019/Aug/36
CVE: CVE-2019-1936
Published: 2019-08-21
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root user. Exploitation of this vulnerability requires privileged access to an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrator privileges and then sending a malicious request to a certain part of the interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html; http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2019/Aug/36
CVE: CVE-2019-1937
Published: 2019-08-21
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html; http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html; http://packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.html
CVE: CVE-2019-1938
Published: 2019-08-21
Description: A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-ucsd-authbypass; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-ucsd-authbypass
CVE: CVE-2019-1948
Published: 2019-08-21
Description: A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer (SSL) certificate. The vulnerability is due to insufficient SSL certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted SSL certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-webex-ssl-cert; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-webex-ssl-cert
CVE: CVE-2019-1974
Published: 2019-08-21
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass user authentication and gain access as an administrative user. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to gain full administrative access to the affected device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbypass; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authbypass
CVE: CVE-2019-1984
Published: 2019-08-21
Description: A vulnerability in Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker with administrator privileges to overwrite files on the underlying operating system (OS) of an affected device. The vulnerability is due to improper input validation in an NFVIS file-system command. An attacker could exploit this vulnerability by using crafted variables during the execution of an affected command. A successful exploit could allow the attacker to overwrite arbitrary files on the underlying OS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-filewrite; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-filewrite
CVE: CVE-2018-17791
Published: 2019-08-21
Description: Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business confusion. In the worst case, all available resources are consumed while processing the data, resulting in unavailability of the service to legitimate users. This occurs because non-editable parameters can be modified by manually editing a disabled form field within the developer options.
CVSS Score: 7.5 (HIGH)
CWE: CWE-669
References: http://packetstormsecurity.com/files/154061/OmniDoc-7.0-Input-Validation.html; https://packetstormsecurity.com/files/cve/CVE-2018-17791; http://packetstormsecurity.com/files/154061/OmniDoc-7.0-Input-Validation.html
CVE: CVE-2019-10687
Published: 2019-08-21
Description: KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id[]= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/154184/KBPublisher-6.0.2.1-SQL-Injection.html; https://github.com/pandujar/advisories/blob/master/KBPublisher_6.0.2.1_en.txt; http://packetstormsecurity.com/files/154184/KBPublisher-6.0.2.1-SQL-Injection.html
CVE: CVE-2019-11601
Published: 2019-08-21
Description: A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html; https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html
CVE: CVE-2019-11602
Published: 2019-08-21
Description: Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html; https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html
CVE: CVE-2019-11603
Published: 2019-08-21
Description: A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html; https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html
CVE: CVE-2019-13476
Published: 2019-08-21
Description: In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/154216/CentOS-7.6.1810-Control-Web-Panel-0.9.8.837-Cross-Site-Scripting.html; https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13476.md; http://packetstormsecurity.com/files/154216/CentOS-7.6.1810-Control-Web-Panel-0.9.8.837-Cross-Site-Scripting.html
CVE: CVE-2019-14685
Published: 2019-08-21
Description: A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: http://packetstormsecurity.com/files/154200/Trend-Maximum-Security-2019-Unquoted-Search-Path.html; http://seclists.org/fulldisclosure/2019/Aug/26; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123420.aspx
CVE: CVE-2019-14686
Published: 2019-08-21
Description: A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micro Ransom Buster (1.0) tool in which, if exploited, would allow an attacker to load a malicious DLL, leading to elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123421.aspx; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123421.aspx
CVE: CVE-2019-15315
Published: 2019-08-21
Description: Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://xiaoyinl.github.io/steam_EoP_bypass.html; https://xiaoyinl.github.io/steam_EoP_bypass.html
CVE: CVE-2019-15316
Published: 2019-08-21
Description: Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreateMountPoint.exe and SetOpLock.exe to leverage a TOCTOU race condition.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-732
References: https://amonitoring.ru/article/onemore_steam_eop_0day/; https://habr.com/ru/company/pm/blog/464367/; https://www.youtube.com/watch?v=I93aH86BUaE
CVE: CVE-2019-5638
Published: 2019-08-21
Description: Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.
CVSS Score: 8.7 (HIGH)
CWE: CWE-613, CWE-613
References: https://docs.rapid7.com/insightvm/enable-insightvm-platform-login; https://help.rapid7.com/nexpose/en-us/release-notes/archive/2019/02/; https://docs.rapid7.com/insightvm/enable-insightvm-platform-login
CVE: CVE-2019-6177
Published: 2019-08-21
Description: A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Lenovo Vantage or Lenovo Diagnostics in April 2018.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://support.lenovo.com/solutions/LEN-27811; https://support.lenovo.com/solutions/LEN-27811
CVE: CVE-2009-5158
Published: 2019-08-22
Description: The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://wordpress.org/plugins/google-analyticator/#developers; https://wordpress.org/plugins/google-analyticator/#developers
CVE: CVE-2012-6716
Published: 2019-08-22
Description: The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/events-manager/#developers; https://wordpress.org/plugins/events-manager/#developers
CVE: CVE-2013-7477
Published: 2019-08-22
Description: The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/events-manager/#developers; https://wordpress.org/plugins/events-manager/#developers
CVE: CVE-2013-7478
Published: 2019-08-22
Description: The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/events-manager/#developers; https://wordpress.org/plugins/events-manager/#developers
CVE: CVE-2013-7479
Published: 2019-08-22
Description: The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/events-manager/#developers; https://wordpress.org/plugins/events-manager/#developers
CVE: CVE-2013-7480
Published: 2019-08-22
Description: The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/events-manager/#developers; https://wordpress.org/plugins/events-manager/#developers
CVE: CVE-2013-7481
Published: 2019-08-22
Description: The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/contact-form-plugin/#developers; https://wordpress.org/plugins/contact-form-plugin/#developers
CVE: CVE-2015-9333
Published: 2019-08-22
Description: The cforms2 plugin before 14.6.10 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/cforms2/#developers; https://wpvulndb.com/vulnerabilities/9773; https://wordpress.org/plugins/cforms2/#developers
CVE: CVE-2015-9335
Published: 2019-08-22
Description: The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/limit-attempts/#developers; https://wordpress.org/plugins/limit-attempts/#developers
CVE: CVE-2015-9336
Published: 2019-08-22
Description: The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/clean-login/#developers; https://wordpress.org/plugins/clean-login/#developers
CVE: CVE-2016-10916
Published: 2019-08-22
Description: The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/appointment-booking-calendar/#developers; https://wordpress.org/plugins/appointment-booking-calendar/#developers
CVE: CVE-2016-10917
Published: 2019-08-22
Description: The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/search-everything/#developers; https://wordpress.org/plugins/search-everything/#developers
CVE: CVE-2016-10918
Published: 2019-08-22
Description: The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/gallery-by-supsystic/#developers; https://wordpress.org/plugins/gallery-by-supsystic/#developers
CVE: CVE-2016-10919
Published: 2019-08-22
Description: The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wassup/#developers; https://wordpress.org/plugins/wassup/#developers
CVE: CVE-2016-10920
Published: 2019-08-22
Description: The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/gnucommerce/#developers; https://wordpress.org/plugins/gnucommerce/#developers
CVE: CVE-2016-10921
Published: 2019-08-22
Description: The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/gallery-photo-gallery/#developers; https://wordpress.org/plugins/gallery-photo-gallery/#developers
CVE: CVE-2017-18570
Published: 2019-08-22
Description: The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/cforms2/#developers; https://wordpress.org/plugins/cforms2/#developers
CVE: CVE-2017-18571
Published: 2019-08-22
Description: The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/search-everything/#developers; https://wordpress.org/plugins/search-everything/#developers
CVE: CVE-2017-18572
Published: 2019-08-22
Description: The gnucommerce plugin before 1.4.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/gnucommerce/#developers; https://wordpress.org/plugins/gnucommerce/#developers
CVE: CVE-2017-18573
Published: 2019-08-22
Description: The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/simple-login-log/#developers; https://wordpress.org/plugins/simple-login-log/#developers
CVE: CVE-2017-18574
Published: 2019-08-22
Description: The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: https://wordpress.org/plugins/ninja-forms/#developers; https://wordpress.org/plugins/ninja-forms/#developers
CVE: CVE-2017-18575
Published: 2019-08-22
Description: The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/newstatpress/#developers; https://wordpress.org/plugins/newstatpress/#developers
CVE: CVE-2018-20979
Published: 2019-08-22
Description: The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.
CVSS Score: 9.8 (CRITICAL)
References: https://wordpress.org/plugins/contact-form-7/#developers; https://wordpress.org/plugins/contact-form-7/#developers
CVE: CVE-2018-20980
Published: 2019-08-22
Description: The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://wordpress.org/plugins/ninja-forms/#developers; https://wordpress.org/plugins/ninja-forms/#developers
CVE: CVE-2018-20981
Published: 2019-08-22
Description: The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://wordpress.org/plugins/ninja-forms/#developers; https://wordpress.org/plugins/ninja-forms/#developers
CVE: CVE-2018-20982
Published: 2019-08-22
Description: The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/media-library-assistant/#developers; https://wordpress.org/plugins/media-library-assistant/#developers
CVE: CVE-2019-14511
Published: 2019-08-22
Description: Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: http://sphinxsearch.com/docs/sphinx3.html#getting-started-on-linux-and-macos; https://blog.wirhabenstil.de/2019/08/19/sphinxsearch-0-0-0-09306-cve-2019-14511/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FPPNZZMWTZOMFGFETMET6YKIH2DQDKS/
CVE: CVE-2019-15314
Published: 2019-08-22
Description: tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://pastebin.com/wEM7rnG7; https://pastebin.com/wEM7rnG7
CVE: CVE-2019-15317
Published: 2019-08-22
Description: The give plugin before 2.4.7 for WordPress has XSS via a donor name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.sucuri.net/2019/05/wordpress-plugin-give-stored-xss-for-donors.html; https://wordpress.org/plugins/give/#developers; https://wpvulndb.com/vulnerabilities/9584
CVE: CVE-2019-15318
Published: 2019-08-22
Description: The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://wordpress.org/plugins/yikes-inc-easy-mailchimp-extender/#developers; https://wpvulndb.com/vulnerabilities/9583; https://wordpress.org/plugins/yikes-inc-easy-mailchimp-extender/#developers
CVE: CVE-2008-7321
Published: 2019-08-22
Description: The tubepress plugin before 1.6.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/tubepress/#developers; https://wordpress.org/plugins/tubepress/#developers
CVE: CVE-2013-7482
Published: 2019-08-22
Description: The reflex-gallery plugin before 1.4.3 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/reflex-gallery/#developers; https://wordpress.org/plugins/reflex-gallery/#developers