deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11210
Published: 2019-09-18
Description: The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an unauthenticated user to bypass access controls and remotely execute code using the operating system account hosting the affected component. This issue affects: TIBCO Enterprise Runtime for R - Server Edition versions 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace versions 10.4.0 and 10.5.0.
CVSS Score: 10.0 (CRITICAL)
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/09/tibco-security-advisory-september-17-2019-tibco-enterprise-runtime-for-r-server-2019-11210; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-11211
Published: 2019-09-18
Description: The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below, and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.
CVSS Score: 9.9 (CRITICAL)
References: http://www.tibco.com/services/support/advisories; https://www.tibco.com/support/advisories/2019/09/tibco-security-advisory-september-17-2019-tibco-enterprise-runtime-for-r-server-2019-11211; http://www.tibco.com/services/support/advisories
CVE: CVE-2019-11778
Published: 2019-09-18
Description: If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=551162; https://bugs.eclipse.org/bugs/show_bug.cgi?id=551162
CVE: CVE-2019-3738
Published: 2019-09-18
Description: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-325, CWE-347
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10318; https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities; https://www.oracle.com//security-alerts/cpujul2021.html
CVE: CVE-2019-3739
Published: 2019-09-18
Description: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310, CWE-203
References: https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities; https://www.oracle.com//security-alerts/cpujul2021.html; https://www.oracle.com/security-alerts/cpuApr2021.html
CVE: CVE-2019-3740
Published: 2019-09-18
Description: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-310, CWE-203
References: https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities; https://www.oracle.com//security-alerts/cpujul2021.html; https://www.oracle.com/security-alerts/cpuApr2021.html
CVE: CVE-2019-3756
Published: 2019-09-18
Description: RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209, CWE-200
References: https://community.rsa.com/docs/DOC-106759; https://community.rsa.com/docs/DOC-106759
CVE: CVE-2019-3758
Published: 2019-09-18
Description: RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-521
References: https://community.rsa.com/docs/DOC-106759; https://community.rsa.com/docs/DOC-106759
CVE: CVE-2019-16413
Published: 2019-09-19
Description: An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.4; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5e3cc1ee1405a7eb3487ed24f786dec01b4cbe1f; https://patchwork.kernel.org/patch/10753365/
CVE: CVE-2019-15943
Published: 2019-09-19
Description: vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map is mishandled during a memset call.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/154705/Counter-Strike-Global-Offensive-Code-Execution-Denial-Of-Service.html; https://blog.counter-strike.net/index.php/category/updates/; https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/README.md
CVE: CVE-2019-11779
Published: 2019-09-19
Description: In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754, CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00008.html; https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160
CVE: CVE-2019-3689
Published: 2019-09-19
Description: The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15 before and including version 2.1.1-6.10.2 the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-276, CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00071.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00006.html; https://bugzilla.suse.com/show_bug.cgi?id=1150733
CVE: CVE-2019-6010
Published: 2019-09-19
Description: Integer overflow vulnerability in LINE(Android) from 4.4.0 to the version before 9.15.1 allows remote attackers to cause a denial of service (DoS) condition or execute arbitrary code via a specially crafted image.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://jvn.jp/en/jp/JVN97845465/index.html; https://play.google.com/store/apps/details?id=jp.naver.line.android&hl=en; http://jvn.jp/en/jp/JVN97845465/index.html
CVE: CVE-2019-14994
Published: 2019-09-19
Description: The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before version 3.9.16, from version 3.10.0 before version 3.16.8, from version 4.0.0 before version 4.1.3, from version 4.2.0 before version 4.2.5, from version 4.3.0 before version 4.3.4, and version 4.4.0 allows remote attackers with portal access to view arbitrary issues in Jira Service Desk projects via a path traversal vulnerability. Note that when the 'Anyone can email the service desk or raise a request in the portal' setting is enabled, an attacker can grant themselves portal access, allowing them to exploit the vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/154574/Jira-Service-Desk-Server-And-Data-Center-Path-Traversal.html; https://jira.atlassian.com/browse/JSDSERVER-6517; https://samcurry.net/analysis-of-cve-2019-14994/
CVE: CVE-2019-15000
Published: 2019-09-19
Description: The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 (the fixed version for 5.16.x ), from 6.0.0 before 6.0.10 (the fixed version for 6.0.x), from 6.1.0 before 6.1.8 (the fixed version for 6.1.x), from 6.2.0 before 6.2.6 (the fixed version for 6.2.x), from 6.3.0 before 6.3.5 (the fixed version for 6.3.x), from 6.4.0 before 6.4.3 (the fixed version for 6.4.x), and from 6.5.0 before 6.5.2 (the fixed version for 6.5.x) allows remote attackers who have permission to access a repository, if public access is enabled for a project or repository then attackers are able to exploit this issue anonymously, to read the contents of arbitrary files on the system and execute commands via injecting additional arguments into git commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/154610/Bitbucket-Server-Data-Center-Argument-Injection.html; https://jira.atlassian.com/browse/BSERV-11947; https://seclists.org/bugtraq/2019/Sep/43
CVE: CVE-2019-15001
Published: 2019-09-19
Description: The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16, from 7.7.0 before 7.13.8, from 8.0.0 before 8.1.3, from 8.2.0 before 8.2.5, from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/154611/Jira-Server-Data-Center-Template-Injection.html; https://jira.atlassian.com/browse/JRASERVER-69933; https://seclists.org/bugtraq/2019/Sep/42
CVE: CVE-2019-16398
Published: 2019-09-19
Description: On Keeper K5 20.1.0.25 and 20.1.0.63 devices, remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes a reverse shell.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-345
References: https://gitlab.com/crypt0crc/cve-2019-16398; https://gitlab.com/crypt0crc/cve-2019-16398
CVE: CVE-2019-16412
Published: 2019-09-19
Description: In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zero value is only enforced within the GUI.)
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2019-16412.pdf; https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2019-16412.pdf
CVE: CVE-2019-16510
Published: 2019-09-19
Description: libIEC61850 through 1.3.3 has a use-after-free in MmsServer_waitReady in mms/iso_mms/server/mms_server.c, as demonstrated by server_example_goose.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/mz-automation/libiec61850/issues/164; https://github.com/mz-automation/libiec61850/issues/164
CVE: CVE-2019-16511
Published: 2019-09-19
Description: An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/GitHubAssessments/CVE_Assessments_09_2019; https://github.com/wixtoolset/issues/issues/6075; https://wixtoolset.org/development/wips/6075-dtf-zip-slip/
CVE: CVE-2019-15032
Published: 2019-09-19
Description: Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is used with the http://localhost:22 URL. The attacker can obtain sensitive information such as the name of the user who created that directory and other internal server information.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://heitorgouvea.me/2019/09/17/CVE-2019-15032; https://pydio.com; https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel/
CVE: CVE-2019-15033
Published: 2019-09-19
Description: Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: https://heitorgouvea.me/2019/09/17/CVE-2019-15033; https://pydio.com; https://sourceforge.net/projects/ajaxplorer/files/pydio/stable-channel/
CVE: CVE-2019-14821
Published: 2019-09-19
Description: An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00037.html; http://packetstormsecurity.com/files/154951/Kernel-Live-Patch-Security-Notice-LSN-0058-1.html
CVE: CVE-2019-16525
Published: 2019-09-19
Description: An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/154436/WordPress-Checklist-1.1.5-Cross-Site-Scripting.html; https://plugins.trac.wordpress.org/changeset/2155029/; https://wordpress.org/plugins/checklist/#developers
CVE: CVE-2019-9619
Published: 2019-09-19
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-9717
Published: 2019-09-19
Description: In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c has a complex format argument to sscanf.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/libav/libav/blob/df744e3cf66548c9167ea857104a29d2ea92819e/libavcodec/srtdec.c#L90; https://lgtm.com/security/; https://github.com/libav/libav/blob/df744e3cf66548c9167ea857104a29d2ea92819e/libavcodec/srtdec.c#L90
CVE: CVE-2019-9719
Published: 2019-09-19
Description: A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf. NOTE: Third parties dispute that this is a vulnerability because “no evidence of a vulnerability is provided” and only “a generic warning from a static code analysis” is provided
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/libav/libav/blob/df744e3cf66548c9167ea857104a29d2ea92819e/libavcodec/srtdec.c#L113; https://github.com/libav/libav/commits/master/libavcodec/srtdec.c; https://lgtm.com/projects/g/libav/libav/snapshot/f5f553ca3bdca0c97dd08bbf002f0d8cb193788b/files/libavcodec/srtdec.c?sort=name&dir=ASC&mode=heatmap#xeec693aa6d85853b:1
CVE: CVE-2019-9720
Published: 2019-09-19
Description: A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/libav/libav/blob/df744e3cf66548c9167ea857104a29d2ea92819e/libavcodec/srtdec.c#L161; https://lgtm.com/security/; https://github.com/libav/libav/blob/df744e3cf66548c9167ea857104a29d2ea92819e/libavcodec/srtdec.c#L161
CVE: CVE-2019-16531
Published: 2019-09-20
Description: LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/154549/LayerBB-1.1.3-Cross-Site-Request-Forgery.html; https://github.com/0xB9/LayerBB-1.1.3-CSRF/blob/master/README.md; https://github.com/AndyRixon/LayerBB/compare/1.1.3...1.1.4
CVE: CVE-2019-14911
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-14912
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-14913
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-14914
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via Directory Traversal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-14915
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-14916
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-15085
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-15086
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-15087
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-15088
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication.
CVSS Score: 9.8 (CRITICAL)
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2019-15089
Published: 2019-09-20
Description: An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.adas-sso.com/es/extra/download.php; https://security-garage.com/index.php/cves/from-open-redirect-to-rce-in-adas; http://www.adas-sso.com/es/extra/download.php
CVE: CVE-2015-9384
Published: 2019-09-20
Description: The relevant plugin before 1.0.8 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/relevant/#developers; https://wpvulndb.com/vulnerabilities/8361; https://wordpress.org/plugins/relevant/#developers
CVE: CVE-2015-9385
Published: 2019-09-20
Description: The quotes-and-tips plugin before 1.20 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/quotes-and-tips/#developers; https://wpvulndb.com/vulnerabilities/8359; https://wordpress.org/plugins/quotes-and-tips/#developers
CVE: CVE-2015-9386
Published: 2019-09-20
Description: The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/mtouch-quiz/#developers; https://www.davidsopas.com/multiple-vulns-on-mtouch-quiz-wordpress-plugin/; https://wordpress.org/plugins/mtouch-quiz/#developers
CVE: CVE-2015-9387
Published: 2019-09-20
Description: The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/mtouch-quiz/#developers; https://www.davidsopas.com/multiple-vulns-on-mtouch-quiz-wordpress-plugin/; https://wordpress.org/plugins/mtouch-quiz/#developers
CVE: CVE-2015-9388
Published: 2019-09-20
Description: The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://wordpress.org/plugins/mtouch-quiz/#developers; https://www.davidsopas.com/multiple-vulns-on-mtouch-quiz-wordpress-plugin/; https://wordpress.org/plugins/mtouch-quiz/#developers
CVE: CVE-2015-9389
Published: 2019-09-20
Description: The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/mtouch-quiz/#developers; https://www.davidsopas.com/multiple-vulns-on-mtouch-quiz-wordpress-plugin/; https://wordpress.org/plugins/mtouch-quiz/#developers