deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3477
Published: 2014-07-01
Description: The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
CVSS Score: 4.0 (MEDIUM)
References: http://advisories.mageia.org/MGASA-2014-0266.html; http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=24c590703ca47eb71ddef453de43126b90954567; http://lists.opensuse.org/opensuse-updates/2014-06/msg00042.html
CVE: CVE-2013-3004
Published: 2014-07-01
Description: Directory traversal vulnerability in BIRT-Report Viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.x and 7.2.x before 7.2.1.5 allows remote authenticated users to read arbitrary files via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: http://www-01.ibm.com/support/docview.wss?uid=swg21672395; http://www.securityfocus.com/bid/68452; https://exchange.xforce.ibmcloud.com/vulnerabilities/84145
CVE: CVE-2014-3088
Published: 2014-07-01
Description: stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as demonstrated by replacing a text/plain .txt upload with an application/octet-stream .exe upload.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://linux.oracle.com/errata/ELSA-2014-0747.html; http://packetstormsecurity.com/files/127294; http://packetstormsecurity.com/files/127829/IBM-Sametime-Meet-Server-8.5-Arbitrary-File-Upload.html
CVE: CVE-2014-3100
Published: 2014-07-02
Description: Stack-based buffer overflow in the encode_key function in /system/bin/keystore in the KeyStore service in Android 4.3 allows attackers to execute arbitrary code, and consequently obtain sensitive key information or bypass intended restrictions on cryptographic operations, via a long key name.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/127185/Android-KeyStore-Stack-Buffer-Overflow.html; http://securityintelligence.com/android-keystore-stack-buffer-overflow-to-keep-things-simple-buffers-are-always-larger-than-needed/; http://www.securityfocus.com/archive/1/532527/100/0/threaded
CVE: CVE-2014-4668
Published: 2014-07-02
Description: The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://advisories.mageia.org/MGASA-2015-0181.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155776.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156162.html
CVE: CVE-2014-3066
Published: 2014-07-02
Description: IBM Tivoli Endpoint Manager 9.1 before 9.1.1088.0 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://secunia.com/advisories/58672; http://secunia.com/advisories/58906; http://www-01.ibm.com/support/docview.wss?uid=swg21673961
CVE: CVE-2014-3074
Published: 2014-07-02
Description: The runtime linker in IBM AIX 6.1 and 7.1 and VIOS 2.2.x allows local users to create a mode-666 root-owned file, and consequently gain privileges, by setting crafted MALLOCOPTIONS and MALLOCBUCKETS environment-variable values and then executing a setuid program.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://aix.software.ibm.com/aix/efixes/security/malloc_advisory.asc; http://packetstormsecurity.com/files/127390/IBM-AIX-Runtime-Linker-Privilege-Escalation.html; http://seclists.org/fulldisclosure/2014/Jul/31
CVE: CVE-2014-3297
Published: 2014-07-02
Description: Cisco Intelligent Automation for Cloud in Cisco Cloud Portal does not properly restrict the content of MyServices action URLs, which allows remote authenticated users to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history, aka Bug IDs CSCui36937, CSCui37004, and CSCui36927.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/58985; http://secunia.com/advisories/59401; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3297
CVE: CVE-2014-3298
Published: 2014-07-02
Description: Form Data Viewer in Cisco Intelligent Automation for Cloud in Cisco Cloud Portal places passwords in form data, which allows remote authenticated users to obtain sensitive information by reading HTML source code, aka Bug ID CSCui36976.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://secunia.com/advisories/58985; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3298; http://tools.cisco.com/security/center/viewAlert.x?alertId=34833
CVE: CVE-2014-3307
Published: 2014-07-02
Description: The DHCP client implementation in Universal Small Cell firmware on Cisco Small Cell products allows remote attackers to execute arbitrary commands via crafted DHCP messages, aka Bug ID CSCup47513.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/59024; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3307; http://www.securityfocus.com/bid/68307
CVE: CVE-2014-4687
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php, (2) the rssfeed parameter to rss.widget.php, (3) the servicestatusfilter parameter to services_status.widget.php, (4) the txtRecallBuffer parameter to exec.php, or (5) the HTTP Referer header to log.widget.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://pfsense.org/security/advisories/pfSense-SA-14_09.webgui.asc; https://pfsense.org/security/advisories/pfSense-SA-14_09.webgui.asc
CVE: CVE-2014-4688
Published: 2014-07-02
Description: pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to diag_smart.php, or (3) the database value to status_rrd_graph_img.php.
CVSS Score: 6.5 (MEDIUM)
References: https://pfsense.org/security/advisories/pfSense-SA-14_10.webgui.asc; https://www.exploit-db.com/exploits/43560/; https://pfsense.org/security/advisories/pfSense-SA-14_10.webgui.asc
CVE: CVE-2014-4689
Published: 2014-07-02
Description: Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc; https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc
CVE: CVE-2014-4690
Published: 2014-07-02
Description: Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow (2) remote authenticated users to read arbitrary files via the downloadbackup parameter to system_firmware_restorefullbackup.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc; https://pfsense.org/security/advisories/pfSense-SA-14_11.webgui.asc
CVE: CVE-2014-4691
Published: 2014-07-02
Description: Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie.
CVSS Score: 6.8 (MEDIUM)
References: https://pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc; https://pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc
CVE: CVE-2014-4692
Published: 2014-07-02
Description: pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc; https://pfsense.org/security/advisories/pfSense-SA-14_12.webgui.asc
CVE: CVE-2014-4693
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng parameter to snort_import_aliases.php or (2) unspecified variables to snort_select_alias.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc; https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc
CVE: CVE-2014-4694
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via unspecified variables.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc; https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc
CVE: CVE-2014-4695
Published: 2014-07-02
Description: Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to snort_rules_flowbits.php or (2) the returl parameter to snort_select_alias.php.
CVSS Score: 5.8 (MEDIUM)
References: https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc; https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc
CVE: CVE-2014-4696
Published: 2014-07-02
Description: Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via (1) the referer parameter to suricata_rules_flowbits.php or (2) the returl parameter to suricata_select_alias.php.
CVSS Score: 5.8 (MEDIUM)
References: https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc; https://pfsense.org/security/advisories/pfSense-SA-14_13.packages.asc
CVE: CVE-2014-3889
Published: 2014-07-02
Description: silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via crafted data in the Options field of a TCP header, a different vulnerability than CVE-2014-3890.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN85571806/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000065; http://jvn.jp/en/jp/JVN85571806/index.html
CVE: CVE-2014-3890
Published: 2014-07-02
Description: silex SX-2000WG devices with firmware before 1.5.4 allow remote attackers to cause a denial of service (connectivity outage) via a crafted IP packet, a different vulnerability than CVE-2014-3889.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN35998716/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000066; http://jvn.jp/en/jp/JVN35998716/index.html
CVE: CVE-2014-4522
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-dssearchagent-wordpress-edition-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-dssearchagent-wordpress-edition-a3-cross-site-scripting-xss
CVE: CVE-2014-4524
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-easy-post-types-a3-cross-site-scripting-xss; http://wordpress.org/plugins/easy-post-types/changelog; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=842687%40easy-post-types&old=806912%40easy-post-types&sfp_email=&sfph_mail=
CVE: CVE-2014-4526
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) zoneid, (3) pubKey, or (4) privKey parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-efence-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-efence-a3-cross-site-scripting-xss
CVE: CVE-2014-4527
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) FormID or (2) AdministratorID parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-envialosimple-email-marketing-y-newsletters-gratis-a3-cross-site-scripting-xss; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=843064%40envialosimple-email-marketing-y-newsletters-gratis&old=839677%40envialosimple-email-marketing-y-newsletters-gratis&sfp_email=&sfph_mail=; http://codevigilant.com/disclosure/wp-plugin-envialosimple-email-marketing-y-newsletters-gratis-a3-cross-site-scripting-xss
CVE: CVE-2014-4529
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-flash-photo-gallery-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-flash-photo-gallery-a3-cross-site-scripting-xss
CVE: CVE-2014-4531
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in main_page.php in the Game tabs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the n parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-game-tabs-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-game-tabs-a3-cross-site-scripting-xss
CVE: CVE-2014-4532
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-garagesale-a3-cross-site-scripting-xss; http://wordpress.org/plugins/garagesale/changelog; http://codevigilant.com/disclosure/wp-plugin-garagesale-a3-cross-site-scripting-xss
CVE: CVE-2014-4537
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) sort, (2) search, or (3) dir parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-keyword-strategy-internal-links-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-keyword-strategy-internal-links-a3-cross-site-scripting-xss
CVE: CVE-2014-4540
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-oleggo-livestream-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-oleggo-livestream-a3-cross-site-scripting-xss
CVE: CVE-2014-4541
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-omfg-mobile-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-omfg-mobile-a3-cross-site-scripting-xss
CVE: CVE-2014-4542
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in redirect.php in the Ooorl plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-ooorl-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-ooorl-a3-cross-site-scripting-xss
CVE: CVE-2014-4543
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fcolor, (2) links, (3) stitle, (4) height, (5) width, (6) host, (7) bcolor, (8) msg, (9) id, or (10) size parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-pay-per-media-player-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/68447; http://codevigilant.com/disclosure/wp-plugin-pay-per-media-player-a3-cross-site-scripting-xss
CVE: CVE-2014-4547
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in templates/default/index_ajax.php in the Rezgo Online Booking plugin before 1.8.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) tags or (2) search_for parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-rezgo-online-booking-a3-cross-site-scripting-xss; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=848542%40rezgo-online-booking&old=748531%40rezgo-online-booking&sfp_email=&sfph_mail=#file500; http://codevigilant.com/disclosure/wp-plugin-rezgo-online-booking-a3-cross-site-scripting-xss
CVE: CVE-2014-4551
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the testing parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-social-connect-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-social-connect-a3-cross-site-scripting-xss
CVE: CVE-2014-4552
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plugin 4.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the paymentType parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-spotlightyour-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-spotlightyour-a3-cross-site-scripting-xss
CVE: CVE-2014-4557
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for Jigoshop (swipe-hq-checkout-for-jigoshop) plugin 3.1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-swipe-hq-checkout-for-jigoshop-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-swipe-hq-checkout-for-jigoshop-a3-cross-site-scripting-xss
CVE: CVE-2014-4560
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in includes/getTipo.php in the ToolPage plugin 1.6.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the t parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-toolpage-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-toolpage-a3-cross-site-scripting-xss
CVE: CVE-2014-4566
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in res/fake_twitter/frame.php in the "verwei.se - WordPress - Twitter" (verweise-wordpress-twitter) plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the base parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-verweise-wordpress-twitter-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-verweise-wordpress-twitter-a3-cross-site-scripting-xss
CVE: CVE-2014-4568
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in posts/videowhisper/r_logout.php in the Video Posts Webcam Recorder plugin 1.55.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the message parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-video-posts-webcam-recorder-a3-cross-site-scripting-xss; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=839990%40video-posts-webcam-recorder&old=686450%40video-posts-webcam-recorder&sfp_email=&sfph_mail=; http://codevigilant.com/disclosure/wp-plugin-video-posts-webcam-recorder-a3-cross-site-scripting-xss
CVE: CVE-2014-4570
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Video Presentation plugin before 3.31 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) room_name parameter to c_login.php or (2) room parameter to index.php in vp/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-videowhisper-video-presentation-a3-cross-site-scripting-xss; http://www.securityfocus.com/bid/69511; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=839980%40videowhisper-video-presentation&old=600781%40videowhisper-video-presentation&sfp_email=&sfph_mail=#file4
CVE: CVE-2014-4572
Published: 2014-07-02
Description: Cross-site scripting (XSS) vulnerability in bvc.php in the Votecount for Balatarin plugin 0.1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) url or (2) bvcurl parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-votecount-for-balatarin-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-votecount-for-balatarin-a3-cross-site-scripting-xss
CVE: CVE-2014-4573
Published: 2014-07-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in frame-maker.php in the Walk Score plugin 0.5.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) o parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codevigilant.com/disclosure/wp-plugin-walk-score-a3-cross-site-scripting-xss; http://codevigilant.com/disclosure/wp-plugin-walk-score-a3-cross-site-scripting-xss