deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5035
Published: 2019-08-20
Description: An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker can send specially crafted packets to trigger this vulnerability.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-307, CWE-327
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0798; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0798
CVE: CVE-2019-5036
Published: 2019-08-20
Description: An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially crafted packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284, CWE-346
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0799; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0799
CVE: CVE-2019-15292
Published: 2019-08-21
Description: An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit, related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.9
CVE: CVE-2019-15293
Published: 2019-08-21
Description: An issue was discovered in ACDSee Photo Studio Standard 22.1 Build 1159. There is a User Mode Write AV starting at IDE_ACDStd!IEP_ShowPlugInDialog+0x[PII_REDACTED]23d060.
CVSS Score: 7.8 (HIGH)
References: https://github.com/apriorit/pentesting/blob/master/bugs/acdsee_std2019/IDE_ACDStd%21IEP_ShowPlugInDialog%2B0x[PII_REDACTED]23d060.md; https://github.com/apriorit/pentesting/blob/master/bugs/acdsee_std2019/IDE_ACDStd%21IEP_ShowPlugInDialog%2B0x[PII_REDACTED]23d060.md
CVE: CVE-2019-15296
Published: 2019-08-21
Description: An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa[PII_REDACTED]174; https://lists.debian.org/debian-lts-announce/2019/08/msg00033.html; https://seclists.org/bugtraq/2019/Sep/28
CVE: CVE-2015-9321
Published: 2019-08-21
Description: The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/shortcode-factory/#developers; https://wordpress.org/plugins/shortcode-factory/#developers
CVE: CVE-2016-10896
Published: 2019-08-21
Description: The seo-redirection plugin before 4.3 for WordPress has stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/seo-redirection/#developers; https://wordpress.org/plugins/seo-redirection/#developers
CVE: CVE-2016-10897
Published: 2019-08-21
Description: The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/sermon-browser/#developers; https://wordpress.org/plugins/sermon-browser/#developers
CVE: CVE-2016-10898
Published: 2019-08-21
Description: The total-security plugin before 3.4.1 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/total-security/#developers; https://wordpress.org/plugins/total-security/#developers
CVE: CVE-2016-10899
Published: 2019-08-21
Description: The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://wordpress.org/plugins/total-security/#developers; https://wordpress.org/plugins/total-security/#developers
CVE: CVE-2017-18534
Published: 2019-08-21
Description: The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/share-on-diaspora/#developers; https://wordpress.org/plugins/share-on-diaspora/#developers
CVE: CVE-2017-18536
Published: 2019-08-21
Description: The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/stop-user-enumeration/#developers; https://wordpress.org/plugins/stop-user-enumeration/#developers
CVE: CVE-2017-18537
Published: 2019-08-21
Description: The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/visitors-online/#developers; https://wordpress.org/plugins/visitors-online/#developers
CVE: CVE-2017-18538
Published: 2019-08-21
Description: The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/weblibrarian/#developers; https://wpvulndb.com/vulnerabilities/9723; https://wordpress.org/plugins/weblibrarian/#developers
CVE: CVE-2017-18539
Published: 2019-08-21
Description: The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/weblibrarian/#developers; https://wpvulndb.com/vulnerabilities/9724; https://wordpress.org/plugins/weblibrarian/#developers
CVE: CVE-2017-18540
Published: 2019-08-21
Description: The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/weblibrarian/#developers; https://wpvulndb.com/vulnerabilities/9725; https://wordpress.org/plugins/weblibrarian/#developers
CVE: CVE-2019-15109
Published: 2019-08-21
Description: The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/the-events-calendar/#developers; https://wpvulndb.com/vulnerabilities/9554; https://wordpress.org/plugins/the-events-calendar/#developers
CVE: CVE-2016-10900
Published: 2019-08-21
Description: The uji-countdown plugin before 2.0.7 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/uji-countdown/#developers; https://wordpress.org/plugins/uji-countdown/#developers
CVE: CVE-2016-10901
Published: 2019-08-21
Description: The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-customer-reviews/#developers; https://wordpress.org/plugins/wp-customer-reviews/#developers
CVE: CVE-2016-10902
Published: 2019-08-21
Description: The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-customer-reviews/#developers; https://wordpress.org/plugins/wp-customer-reviews/#developers
CVE: CVE-2016-10903
Published: 2019-08-21
Description: The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/godaddy-email-marketing-sign-up-forms/#developers; https://wordpress.org/plugins/godaddy-email-marketing-sign-up-forms/#developers
CVE: CVE-2016-10908
Published: 2019-08-21
Description: The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/booking-calendar-contact-form/#developers; https://wordpress.org/plugins/booking-calendar-contact-form/#developers
CVE: CVE-2016-10909
Published: 2019-08-21
Description: The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/booking-calendar-contact-form/#developers; https://wordpress.org/plugins/booking-calendar-contact-form/#developers
CVE: CVE-2017-18553
Published: 2019-08-21
Description: The ad-buttons plugin before 2.3.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ad-buttons/#developers; https://wordpress.org/plugins/ad-buttons/#developers
CVE: CVE-2017-18554
Published: 2019-08-21
Description: The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/analytics-tracker/#developers; https://wordpress.org/plugins/analytics-tracker/#developers
CVE: CVE-2017-18555
Published: 2019-08-21
Description: The booking-sms plugin before 1.1.0 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/booking-sms/#developers; https://wordpress.org/plugins/booking-sms/#developers
CVE: CVE-2017-18556
Published: 2019-08-21
Description: The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/bws-google-analytics/#developers; https://wordpress.org/plugins/bws-google-analytics/#developers
CVE: CVE-2017-18557
Published: 2019-08-21
Description: The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/bws-google-maps/#developers; https://wordpress.org/plugins/bws-google-maps/#developers
CVE: CVE-2017-18558
Published: 2019-08-21
Description: The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/bws-testimonials/#developers; https://wordpress.org/plugins/bws-testimonials/#developers
CVE: CVE-2017-18560
Published: 2019-08-21
Description: The content-audit plugin before 1.9.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/content-audit/#developers; https://wordpress.org/plugins/content-audit/#developers
CVE: CVE-2017-18565
Published: 2019-08-21
Description: The updater plugin before 1.35 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/updater/#developers; https://wordpress.org/plugins/updater/#developers
CVE: CVE-2019-15110
Published: 2019-08-21
Description: The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-front-end-profile/#developers; https://wordpress.org/plugins/wp-front-end-profile/#developers
CVE: CVE-2019-15111
Published: 2019-08-21
Description: The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.
CVSS Score: 9.8 (CRITICAL)
References: https://wordpress.org/plugins/wp-front-end-profile/#developers; https://wordpress.org/plugins/wp-front-end-profile/#developers
CVE: CVE-2019-15112
Published: 2019-08-21
Description: The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-slimstat/#developers; https://wpvulndb.com/vulnerabilities/9285; https://wordpress.org/plugins/wp-slimstat/#developers
CVE: CVE-2019-12746
Published: 2019-08-21
Description: An issue was discovered in Open Ticket Request System (OTRS) Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. A user logged into OTRS as an agent might unknowingly disclose their session ID by sharing the link of an embedded ticket article with third parties. This identifier can be then be potentially abused in order to impersonate the agent user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2019-13458
Published: 2019-08-21
Description: An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8, and Community Edition 5.0.x through 5.0.36 and 6.0.x through 6.0.19. An attacker who is logged into OTRS as an agent user with appropriate permissions can leverage OTRS notification tags in templates in order to disclose hashed user passwords.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2019-3633
Published: 2019-08-21
Description: Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10295; https://kc.mcafee.com/corporate/index?page=content&id=SB10295
CVE: CVE-2019-3634
Published: 2019-08-21
Description: Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10295; https://kc.mcafee.com/corporate/index?page=content&id=SB10295
CVE: CVE-2012-6715
Published: 2019-08-21
Description: The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/formbuilder/#developers; https://wordpress.org/plugins/formbuilder/#developers
CVE: CVE-2014-10380
Published: 2019-08-21
Description: The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/profile-builder/#developers; https://wordpress.org/plugins/profile-builder/#developers
CVE: CVE-2015-9327
Published: 2019-08-21
Description: The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/flickr-justified-gallery/#developers; https://wordpress.org/plugins/flickr-justified-gallery/#developers
CVE: CVE-2015-9328
Published: 2019-08-21
Description: The profile-builder plugin before 2.2.5 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/profile-builder/#developers; https://wordpress.org/plugins/profile-builder/#developers
CVE: CVE-2016-10910
Published: 2019-08-21
Description: The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/formbuilder/#developers; https://wordpress.org/plugins/formbuilder/#developers
CVE: CVE-2016-10911
Published: 2019-08-21
Description: The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/profile-builder/#developers; https://wordpress.org/plugins/profile-builder/#developers
CVE: CVE-2016-10912
Published: 2019-08-21
Description: The universal-analytics plugin before 1.3.1 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/universal-analytics/#developers; https://wordpress.org/plugins/universal-analytics/#developers
CVE: CVE-2017-18563
Published: 2019-08-21
Description: The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/rsvp/#developers; https://wordpress.org/plugins/rsvp/#developers
CVE: CVE-2017-18564
Published: 2019-08-21
Description: The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/sender/#developers; https://wordpress.org/plugins/sender/#developers
CVE: CVE-2019-11551
Published: 2019-08-21
Description: In Code42 Enterprise and Crashplan for Small Business through Client version 6.9.1, an attacker can craft a restore request to restore a file through the Code42 app to a location they do not have privileges to write.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://code42.com/r/support/CVE-2019-11551; https://code42.com/r/support/CVE-2019-11551
CVE: CVE-2019-11897
Published: 2019-08-21
Description: A Server-Side Request Forgery (SSRF) vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to read sensitive zip files from the local server.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918, CWE-918
References: https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html; https://psirt.bosch.com/Advisory/BOSCH-SA-562575.html
CVE: CVE-2019-12621
Published: 2019-08-21
Description: A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
CVSS Score: 7.4 (HIGH)
CWE: CWE-320, CWE-327
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-hyperflex-sslkey; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-hyperflex-sslkey
CVE: CVE-2019-12622
Published: 2019-08-21
Description: A vulnerability in Cisco RoomOS Software could allow an authenticated, local attacker to write files to the underlying filesystem with root privileges. The vulnerability is due to insufficient permission restrictions on a specific process. An attacker could exploit this vulnerability by logging in to an affected device with remote support credentials and initiating the specific process on the device and sending crafted data to that process. A successful exploit could allow the attacker to write files to the underlying file system with root privileges.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-275
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-roomos-privesc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-roomos-privesc
CVE: CVE-2019-12623
Published: 2019-08-21
Description: A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulnerability is due to the web server responding with different error codes for existing and non-existing files. An attacker could exploit this vulnerability by sending GET requests for different file names. A successful exploit could allow the attacker to enumerate files residing on the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-538, CWE-538
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-enumeration; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-nfv-enumeration
CVE: CVE-2019-15295
Published: 2019-08-21
Description: An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the search path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://safebreach.com/Post/BitDefender-Antivirus-Free-2020-Privilege-Escalation-to-SYSTEM; https://www.bitdefender.com/support/security-advisories/untrusted-search-path-vulnerability-serviceinstance-dll-bitdefender-antivirus-free-2020/; https://safebreach.com/Post/BitDefender-Antivirus-Free-2020-Privilege-Escalation-to-SYSTEM
CVE: CVE-2019-5032
Published: 2019-08-21
Description: An exploitable out-of-bounds read vulnerability exists in the LabelSst record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0794; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0794
CVE: CVE-2019-5033
Published: 2019-08-21
Description: An exploitable out-of-bounds read vulnerability exists in the Number record parser of Aspose Aspose.Cells 19.1.0 library. A specially crafted XLS file can cause an out-of-bounds read, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0795; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0795
CVE: CVE-2019-5041
Published: 2019-08-21
Description: An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library, version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow, resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0805; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0805
CVE: CVE-2012-6714
Published: 2019-08-21
Description: The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/count-per-day/#developers; https://wordpress.org/plugins/count-per-day/#developers
CVE: CVE-2014-10377
Published: 2019-08-21
Description: The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/cforms2/#developers; https://wpvulndb.com/vulnerabilities/9812; https://wordpress.org/plugins/cforms2/#developers
CVE: CVE-2014-10378
Published: 2019-08-21
Description: The duplicate-post plugin before 2.6 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/duplicate-post/#developers; https://wordpress.org/plugins/duplicate-post/#developers
CVE: CVE-2014-10379
Published: 2019-08-21
Description: The duplicate-post plugin before 2.6 for WordPress has SQL injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wordpress.org/plugins/duplicate-post/#developers; https://wordpress.org/plugins/duplicate-post/#developers
CVE: CVE-2016-10890
Published: 2019-08-21
Description: The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/aryo-activity-log/#developers; https://wordpress.org/plugins/aryo-activity-log/#developers