deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-4634
Published: 2014-12-30
Description: Unquoted Windows search path vulnerability in EMC Replication Manager through 5.5.2 and AppSync before 2.1.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2014-12/0170.html; http://archives.neohapsis.com/archives/bugtraq/2014-12/0170.html
CVE: CVE-2014-9425
Published: 2014-12-31
Description: Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.x through 5.6.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://advisories.mageia.org/MGASA-2015-0040.html; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=24125f0f26f3787c006e4a51611ba33ee3b841cb; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=2bcf69d073190e4f032d883f3416dea1b027a39e
CVE: CVE-2014-9426
Published: 2014-12-31
Description: The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors.  NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable
CVSS Score: 7.3 (HIGH)
CWE: CWE-17
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=a72cd07f2983dc43a6bb35209dc4687852e53c09; http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=ef89ab2f99fbd9b7b714556d4f1f50644eb54191; http://lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
CVE: CVE-2014-8752
Published: 2014-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in view.php in JCE-Tech PHP Video Script (aka Video Niche Script) 4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) video or (2) title parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2014/Dec/84; http://tetraph.com/security/cves/cve-2014-8752-jce-tech-video-niche-script-xss-cross-site-scripting-security-vulnerability/; http://www.securityfocus.com/bid/71738
CVE: CVE-2014-9254
Published: 2014-12-31
Description: bb_func_unsub.php in MiniBB 3.1 before 20141127 uses an incorrect regular expression, which allows remote attackers to conduct SQl injection attacks via the code parameter in an unsubscribe action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/61794; http://security.szurek.pl/minibb-31-blind-sql-injection.html; http://www.minibb.com/forums/news-9/blind-sql-injection-fix-6430.html
CVE: CVE-2014-9325
Published: 2014-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERYSTRING variable in lib/TWiki.pm or (2) QUERYPARAMSTRING variable in lib/TWiki/UI/View.pm, as demonstrated by the QUERY_STRING to do/view/Main/TWikiPreferences.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129654/TWiki-6.0.1-QUERYSTRING-QUERYPARAMSTRING-XSS.html; http://seclists.org/fulldisclosure/2014/Dec/81; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-9325
CVE: CVE-2014-9367
Published: 2014-12-31
Description: Incomplete blacklist vulnerability in the urlEncode function in lib/TWiki.pm in TWiki 6.0.0 and 6.0.1 allows remote attackers to conduct cross-site scripting (XSS) attacks via a "'" (single quote) in the scope parameter to do/view/TWiki/WebSearch.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129655/TWiki-6.0.0-6.0.1-WebSearch-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/82; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-9367
CVE: CVE-2014-9391
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the gSlideShow plugin 0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) rss, (2) display_time or (3) transistion_time parameter in the gslideshow.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129637/WordPress-gSlideShow-0.1-CSRF-XSS.html; http://packetstormsecurity.com/files/129637/WordPress-gSlideShow-0.1-CSRF-XSS.html
CVE: CVE-2014-9392
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the PictoBrowser (pictobrowser-gallery) plugin 0.3.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the pictoBrowserFlickrUser parameter in the options-page.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129638/WordPress-PictoBrowser-0.3.1-CSRF-XSS.html; http://packetstormsecurity.com/files/129638/WordPress-PictoBrowser-0.3.1-CSRF-XSS.html
CVE: CVE-2014-9393
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Post to Twitter plugin 0.7 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) idptt_twitter_username or (2) idptt_tweet_prefix parameter to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129639/WordPress-Twitter-0.7-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99482; http://packetstormsecurity.com/files/129639/WordPress-Twitter-0.7-CSRF-XSS.html
CVE: CVE-2014-9394
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the PWGRandom plugin 1.11 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) pwgrandom_title or (2) pwgrandom_category parameter in the pwgrandom page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129640/WordPress-PWG-Random-1.11-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99437; http://packetstormsecurity.com/files/129640/WordPress-PWG-Random-1.11-CSRF-XSS.html
CVE: CVE-2014-9395
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Simplelife plugin 1.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) simplehoverback, (2) simplehovertext, (3) flickrback, or (4) simple_flimit parameter in the simplelife.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129641/WordPress-Simplelife-1.2-CSRF-XSS.html; http://packetstormsecurity.com/files/129641/WordPress-Simplelife-1.2-CSRF-XSS.html
CVE: CVE-2014-9396
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleFlickr plugin 3.0.3 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) simpleflickr_width, (2) simpleflickr_bgcolor, or (3) simpleflickr_xmldatapath parameter in the simpleFlickr.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129642/WordPress-SimpleFlickr-3.0.3-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99395; http://packetstormsecurity.com/files/129642/WordPress-SimpleFlickr-3.0.3-CSRF-XSS.html
CVE: CVE-2014-9397
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the twimp-wp plugin for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the message_format parameter in the twimp-wp.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129643/WordPress-twimp-wp-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99380; http://packetstormsecurity.com/files/129643/WordPress-twimp-wp-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2014-9398
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the Twitter LiveBlog plugin 1.1.2 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the mashtlb_twitter_username parameter in the twitter-liveblog.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129644/WordPress-Twitter-LiveBlog-1.1.2-CSRF-XSS.html; http://packetstormsecurity.com/files/129644/WordPress-Twitter-LiveBlog-1.1.2-CSRF-XSS.html
CVE: CVE-2014-9399
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the TweetScribe plugin 1.1 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the tweetscribe_username parameter in a save action in the tweetscribe.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129645/WordPress-TweetScribe-1.1-CSRF-XSS.html; http://packetstormsecurity.com/files/129645/WordPress-TweetScribe-1.1-CSRF-XSS.html
CVE: CVE-2014-9400
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Wp Unique Article Header Image plugin 1.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) gt_default_header or (2) gt_homepage_header parameter in the wp-unique-header.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129646/WordPress-WP-Unique-Article-Header-Image-1.0-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99355; http://packetstormsecurity.com/files/129646/WordPress-WP-Unique-Article-Header-Image-1.0-CSRF-XSS.html
CVE: CVE-2014-9401
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the lpa_post_letters parameter in the wp-limit-posts-automatically.php page to wp-admin/options-general.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129647/WordPress-WP-Limit-Posts-Automatically-0.7-CSRF-XSS.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99427; http://packetstormsecurity.com/files/129647/WordPress-WP-Limit-Posts-Automatically-0.7-CSRF-XSS.html
CVE: CVE-2011-5283
Published: 2014-12-31
Description: Cross-site scripting (XSS) vulnerability in the web management interface in httpd/cgi-bin/ipinfo.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to inject arbitrary web script or HTML via the IP parameter in a Run action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/70496; http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/16006
CVE: CVE-2011-5284
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in the web management interface in httpd/cgi-bin/shutdown.cgi in Smoothwall Express 3.1 and 3.0 SP3 and earlier allows remote attackers to hijack the authentication of administrators for requests that perform a reboot via a request to cgi-bin/shutdown.cgi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/70497; http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; http://www.exploit-db.com/exploits/16006
CVE: CVE-2014-8144
Published: 2014-12-31
Description: Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://seclists.org/oss-sec/2014/q4/1076; https://exchange.xforce.ibmcloud.com/vulnerabilities/99342; https://github.com/doorkeeper-gem/doorkeeper/blob/master/CHANGELOG.md
CVE: CVE-2014-8145
Published: 2014-12-31
Description: Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0561.html; http://packetstormsecurity.com/files/129699/SoX-14.4.1-Heap-Buffer-Overflow.html; http://www.debian.org/security/2014/dsa-3112
CVE: CVE-2014-9119
Published: 2014-12-31
Description: Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://seclists.org/oss-sec/2014/q4/1059; https://exchange.xforce.ibmcloud.com/vulnerabilities/99368; https://wpvulndb.com/vulnerabilities/7726
CVE: CVE-2014-9429
Published: 2014-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the (1) PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or (2) COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99404; http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2014-9430
Published: 2014-12-31
Description: Cross-site scripting (XSS) vulnerability in httpd/cgi-bin/vpn.cgi/vpnconfig.dat in Smoothwall Express 3.0 SP3 allows remote attackers to inject arbitrary web script or HTML via the COMMENT parameter in an Add action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99404; http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2014-9431
Published: 2014-12-31
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to hijack the authentication of administrators for requests that change the (1) admin or (2) dial password via a request to httpd/cgi-bin/changepw.cgi.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/99403; http://packetstormsecurity.com/files/129698/SmoothWall-3.1-Cross-Site-Request-Forgery-Cross-Site-Scripting.html
CVE: CVE-2014-9432
Published: 2014-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.s9y.org/archives/259-Serendipity-2.0-rc2-released.html; http://packetstormsecurity.com/files/129709/CMS-Serendipity-2.0-rc1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/108
CVE: CVE-2014-9433
Published: 2014-12-31
Description: Multiple cross-site scripting (XSS) vulnerabilities in cms/front_content.php in Contenido before 4.9.6, when advanced mod rewrite (AMR) is disabled, allow remote attackers to inject arbitrary web script or HTML via the (1) idart, (2) lang, or (3) idcat parameter.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/129713/CMS-Contenido-4.9.5-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Dec/111; http://secunia.com/advisories/61396
CVE: CVE-2011-5285
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in BugFree 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the ActionType parameter to Bug.php, the ReportMode parameter to (2) Report.php or (3) ReportLeft.php, or the PATH_INFO to (4) AdminProjectList.php, (5) AdminGroupList.php, or (6) AdminUserLogList.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB23048; https://www.htbridge.com/advisory/HTB23048
CVE: CVE-2011-5286
Published: 2015-01-01
Description: SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the rA array parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.htbridge.com/advisory/HTB23033; https://www.htbridge.com/advisory/HTB23033
CVE: CVE-2011-5287
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in HESK before 2.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) hesk_settings[tmp_title] or (2) hesklang[ENCODING] parameter to inc/header.inc.php; the hesklang[attempt] parameter to (3) inc/assignment_search.inc.php, (4) inc/attachments.inc.php, (5) inc/common.inc.php, (6) inc/database.inc.php, (7) inc/prepare_ticket_search.inc.php, (8) inc/print_tickets.inc.php, (9) inc/show_admin_nav.inc.php, (10) inc/show_search_form.inc.php, or (11) inc/ticket_list.inc.php; or (12) the PATH_INFO to language/en/text.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB23030; https://www.htbridge.com/advisory/HTB23030
CVE: CVE-2011-5288
Published: 2015-01-01
Description: Multiple buffer overflows in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allow remote attackers to execute arbitrary code via a long argument to the (1) cmdExport, (2) cmdImport, (3) cmdOpen, or (4) cmdSave method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://www.htbridge.com/advisory/HTB23020; https://www.htbridge.com/advisory/HTB23020
CVE: CVE-2011-5289
Published: 2015-01-01
Description: The SaveDecrypted method in the ChilkatCrypt2.ChilkatOmaDrm.1 ActiveX control in ChilkatCrypt2.dll in aTube Catcher 2.3.570 allows remote attackers to write to arbitrary files via a pathname in the argument.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://www.htbridge.com/advisory/HTB23013; https://www.htbridge.com/advisory/HTB23013
CVE: CVE-2011-5290
Published: 2015-01-01
Description: The SaveToFile method in the UniBasicPack.UniTextBox ActiveX control in UniBasic100_EDA1811C.ocx in IDrive Online Backup 3.4.0 allows remote attackers to write to arbitrary files via a pathname in the first argument.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://www.htbridge.com/advisory/HTB23025; https://www.htbridge.com/advisory/HTB23025
CVE: CVE-2011-5291
Published: 2015-01-01
Description: The SaveData method in the Cygnicon.ViewControl.1 ActiveX control in CyViewer.ocx in Ashampoo 3D CAD Professional 3.x before 3.0.2 allows remote attackers to write to arbitrary files via a pathname in the first argument.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://www.htbridge.com/advisory/HTB23019; https://www.htbridge.com/advisory/HTB23019
CVE: CVE-2011-5292
Published: 2015-01-01
Description: The EaseWeFtp.FtpLibrary ActiveX control in EaseWeFtp.ocx in Easewe FTP OCX 4.5.0.9 does not restrict access to certain methods, which allows remote attackers to execute arbitrary files via a pathname in the first argument to the (1) Execute or (2) Run method, (3) write to arbitrary files via a pathname in the argument to the CreateLocalFile method, (4) create arbitrary directories via a pathname in the argument to the CreateLocalFolder method, or (5) delete arbitrary files via a pathname in the argument to the DeleteLocalFile method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: https://www.htbridge.com/advisory/HTB23015; https://www.htbridge.com/advisory/HTB23015
CVE: CVE-2011-5293
Published: 2015-01-01
Description: The cmdSave method in the ThreeDify.ThreeDifyDesigner.1 ActiveX control in ActiveSolid.dll in ThreeDify Designer 5.0.2 allows remote attackers to write to arbitrary files via a pathname in the argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://www.htbridge.com/advisory/HTB23020; https://www.htbridge.com/advisory/HTB23020
CVE: CVE-2011-5294
Published: 2015-01-01
Description: The SaveMessage method in the LEADeMail.LEADSmtp.20 ActiveX control in LTCML14n.dll 14.0.0.34 in Kofax e-Transactions Sender Sendbox 2.5.0.933 allows remote attackers to write to arbitrary files via a pathname in the first argument.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: https://www.htbridge.com/advisory/HTB23016; https://www.htbridge.com/advisory/HTB23016
CVE: CVE-2011-5295
Published: 2015-01-01
Description: Buffer overflow in the Download method in a certain ActiveX control in MDIEEx.dll in Gogago YouTube Video Converter 1.1.6 allows remote attackers to execute arbitrary code via a long argument.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: https://www.htbridge.com/advisory/HTB23012; https://www.htbridge.com/advisory/HTB23012
CVE: CVE-2011-5296
Published: 2015-01-01
Description: Cross-site scripting (XSS) vulnerability in profilo.php in Happy Chat 1.0 allows remote attackers to inject arbitrary web script or HTML via the nick parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB23001; https://www.htbridge.com/advisory/HTB23001
CVE: CVE-2011-5297
Published: 2015-01-01
Description: Multiple cross-site scripting (XSS) vulnerabilities in TTChat 1.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the msg parameter to default.php or (2) the username parameter to chat_form.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://www.htbridge.com/advisory/HTB22996; https://www.htbridge.com/advisory/HTB22996
CVE: CVE-2011-5298
Published: 2015-01-01
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Argyle Social 2011-04-26 allow remote attackers to hijack the authentication of administrators for requests that (1) modify credentials via the role parameter to users/create/, (2) modify rules via the terms field in stream_filter_rule JSON data to settings-ajax/stream_filter_rules/create, or (3) modify efforts via the title field in effort JSON data to publish-ajax/efforts/create.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.htbridge.com/advisory/HTB22978; https://www.htbridge.com/advisory/HTB22978