deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10471
Published: 2019-10-23
Description: A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/10/23/2; https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1014%20%281%29; http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE: CVE-2019-10472
Published: 2019-10-23
Description: A missing permission check in Jenkins Libvirt Slaves Plugin allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/10/23/2; https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1014%20%281%29; http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE: CVE-2019-10473
Published: 2019-10-23
Description: A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/10/23/2; https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1014%20%282%29; http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE: CVE-2019-10474
Published: 2019-10-23
Description: A missing permission check in Jenkins Global Post Script Plugin in allowed users with Overall/Read access to list the scripts available to the plugin stored on the Jenkins master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/10/23/2; https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1073; http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE: CVE-2019-10475
Published: 2019-10-23
Description: A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.html; http://www.openwall.com/lists/oss-security/2019/10/23/2; https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1490
CVE: CVE-2019-10476
Published: 2019-10-23
Description: Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/10/23/2; https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1621; http://www.openwall.com/lists/oss-security/2019/10/23/2
CVE: CVE-2019-18219
Published: 2019-10-23
Description: Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability, as it fails to validate user input. The affected components (index.php, upgrade.php) allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt; https://vuldb.com/?id.144007; https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt
CVE: CVE-2019-18220
Published: 2019-10-23
Description: Sitemagic CMS 4.4.1 is affected by a Cross-Site-Request-Forgery (CSRF) issue as it doesn't implement any method to validate incoming requests, allowing the execution of critical functionalities via spoofed requests. This behavior could be abused by a remote unauthenticated attacker to trick Sitemagic users into performing unwarranted actions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt; https://vuldb.com/?id.144008; https://github.com/Jemt/SitemagicCMS/blob/master/changelog.txt
CVE: CVE-2019-18277
Published: 2019-10-23
Description: A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly rejected. The impact was limited but if combined with the "http-reuse always" setting, it could be used to help construct an HTTP request smuggling attack against a vulnerable component employing a lenient parser that would ignore the content-length header as soon as it saw a transfer-encoding one (even if not entirely valid according to the specification).
CVSS Score: 7.5 (HIGH)
CWE: CWE-444
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00019.html; https://git.haproxy.org/?p=haproxy-2.0.git%3Ba=commit%3Bh=196a7df44d8129d1adc795da020b722614d6a581
CVE: CVE-2019-18278
Published: 2019-10-23
Description: When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at libqt_plugin!vlc_entry_license__3_0_0f+0x[PII_REDACTED]3b9aba. NOTE: the VideoLAN security team indicates that they have not been contacted, and have no way of reproducing this issue.
CVSS Score: 7.8 (HIGH)
References: https://code610.blogspot.com/2019/10/random-bytes-in-vlc-308.html; https://code610.blogspot.com/2019/10/random-bytes-in-vlc-308.html
CVE: CVE-2019-18280
Published: 2019-10-23
Description: Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code via a crafted HTML page, as demonstrated by a Create User action at the admin/modules/user/controller.php?action=add URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.sevenlayers.com/index.php/261-online-grading-system-1-0-csrf; https://www.sevenlayers.com/index.php/261-online-grading-system-1-0-csrf
CVE: CVE-2019-16976
Published: 2019-10-23
Description: In FusionPBX up to 4.5.7, the file app\destinations\destination_imports.php uses an unsanitized "query_string" variable coming from the URL, which is reflected on 2 occasions in HTML, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fusionpbx/fusionpbx/commit/d6ea02d896b2c57dec491ee3b36ec102639270be; https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-9/; https://github.com/fusionpbx/fusionpbx/commit/d6ea02d896b2c57dec491ee3b36ec102639270be
CVE: CVE-2019-18281
Published: 2019-10-23
Description: An out-of-bounds memory access in the generateDirectionalRuns() function in qtextengine.cpp in Qt qtbase 5.11.x and 5.12.x before 5.12.5 allows attackers to cause a denial of service by crashing an application via a text file containing many directional characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: https://bugreports.qt.io/browse/QTBUG-77819; https://bugs.launchpad.net/ubuntu/+source/qtbase-opensource-src/+bug/1848784; https://codereview.qt-project.org/c/qt/qtbase/+/271889
CVE: CVE-2019-18344
Published: 2019-10-23
Description: Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the student, instructor, department, room, class, or user page (id or classid parameter).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.sevenlayers.com/index.php/262-online-grading-system-1-0-sqli; https://www.sevenlayers.com/index.php/262-online-grading-system-1-0-sqli
CVE: CVE-2015-9525
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9526
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9527
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9528
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9529
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9530
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Upload File extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9531
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Wish Lists extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9532
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Digital Store theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9533
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9534
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Quota theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9535
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Shoppette theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9536
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Twenty-Twelve theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2019-11282
Published: 2019-10-23
Description: Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-74
References: https://www.cloudfoundry.org/blog/cve-2019-11282; https://www.cloudfoundry.org/blog/cve-2019-11282
CVE: CVE-2019-11283
Published: 2019-10-23
Description: Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume.
CVSS Score: 8.8 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.cloudfoundry.org/blog/cve-2019-11283; https://www.cloudfoundry.org/blog/cve-2019-11283
CVE: CVE-2019-11933
Published: 2019-10-23
Description: A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remote attackers to execute arbitrary code or cause a denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-787
References: https://www.facebook.com/security/advisories/cve-2019-11933; https://www.facebook.com/security/advisories/cve-2019-11933
CVE: CVE-2019-16975
Published: 2019-10-23
Description: In FusionPBX up to 4.5.7, the file app\contacts\contact_notes.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/fusionpbx/fusionpbx/commit/80f2ce087ab1343f1ff3bf8a058eed9b5027eb8c; https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-xss-8/; https://github.com/fusionpbx/fusionpbx/commit/80f2ce087ab1343f1ff3bf8a058eed9b5027eb8c
CVE: CVE-2013-7333
Published: 2019-10-23
Description: A vulnerability in version 0.90 of the Open Floodlight SDN controller software could allow an attacker with access to the OpenFlow control network to selectively disconnect individual switches from the SDN controller, causing degradation and eventually denial of network access to all devices connected to the targeted switch.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://dovernetworks.com/wp-content/uploads/2013/12/OpenFloodlight-12302013.pdf; http://dovernetworks.com/wp-content/uploads/2013/12/OpenFloodlight-12302013.pdf
CVE: CVE-2015-9502
Published: 2019-10-23
Description: The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/7987; https://wpvulndb.com/vulnerabilities/7987
CVE: CVE-2015-9503
Published: 2019-10-23
Description: The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/7986; https://wpvulndb.com/vulnerabilities/7986
CVE: CVE-2015-9504
Published: 2019-10-23
Description: The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/7957; https://wpvulndb.com/vulnerabilities/7957
CVE: CVE-2015-9505
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9506
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9507
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9508
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9509
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9510
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9511
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9512
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9513
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Favorites extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9514
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) Free Downloads extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/
CVE: CVE-2015-9515
Published: 2019-10-23
Description: The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/; https://web.archive.org/web/[PII_REDACTED]3517/https://easydigitaldownloads.com/blog/security-fix-released/