deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-12263
Published: 2019-08-09
Description: Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
CVE: CVE-2019-12265
Published: 2019-08-09
Description: Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
CVE: CVE-2019-14433
Published: 2019-08-09
Description: An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-209
References: http://www.openwall.com/lists/oss-security/2019/08/06/6; https://access.redhat.com/errata/RHSA-2019:2622; https://access.redhat.com/errata/RHSA-2019:2631
CVE: CVE-2019-3742
Published: 2019-08-09
Description: Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.
CVSS Score: 7.8 (HIGH)
References: https://www.dell.com/support/article/SLN318085; https://www.dell.com/support/article/SLN318085
CVE: CVE-2019-3744
Published: 2019-08-09
Description: Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-362
References: https://www.dell.com/support/article/SLN318085; https://www.dell.com/support/article/SLN318085
CVE: CVE-2018-20826
Published: 2019-08-09
Description: The inline-create rest resource in Jira before version 7.12.3 allows authenticated remote attackers to set the reporter in issues via a missing authorisation check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://jira.atlassian.com/browse/JRASERVER-69239; https://jira.atlassian.com/browse/JRASERVER-69239
CVE: CVE-2018-20827
Published: 2019-08-09
Description: The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-69237; https://jira.atlassian.com/browse/JRASERVER-69237
CVE: CVE-2019-11041
Published: 2019-08-09
Description: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html; http://seclists.org/fulldisclosure/2019/Oct/15; http://seclists.org/fulldisclosure/2019/Oct/55
CVE: CVE-2019-11042
Published: 2019-08-09
Description: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00019.html; http://seclists.org/fulldisclosure/2019/Oct/15; http://seclists.org/fulldisclosure/2019/Oct/55
CVE: CVE-2019-11274
Published: 2019-08-09
Description: Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.cloudfoundry.org/blog/cve-2019-11274; https://www.cloudfoundry.org/blog/cve-2019-11274
CVE: CVE-2019-11581
Published: 2019-08-09
Description: There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: https://jira.atlassian.com/browse/JRASERVER-69532; https://jira.atlassian.com/browse/JRASERVER-69532; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11581
CVE: CVE-2019-12255
Published: 2019-08-09
Description: Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://packetstormsecurity.com/files/154022/VxWorks-6.8-Integer-Underflow.html; https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf
CVE: CVE-2019-12258
Published: 2019-08-09
Description: Wind River VxWorks 6.6 through vx7 has Session Fixation in the TCP component. This is a IPNET security vulnerability: DoS of TCP connection via malformed TCP options.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
CVE: CVE-2019-12260
Published: 2019-08-09
Description: Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
CVE: CVE-2019-12261
Published: 2019-08-09
Description: Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
CVE: CVE-2019-14807
Published: 2019-08-09
Description: In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gerrit.wikimedia.org/g/mediawiki/extensions/MobileFrontend/+/08dfc59771d0ed9b739a59bb521baf7f59d169f9; https://phabricator.wikimedia.org/T229541; https://gerrit.wikimedia.org/g/mediawiki/extensions/MobileFrontend/+/08dfc59771d0ed9b739a59bb521baf7f59d169f9
CVE: CVE-2019-14354
Published: 2019-08-10
Description: On Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data.
CVSS Score: 2.4 (LOW)
CWE: CWE-203
References: https://ledger-donjon.github.io/oled-vuln/; https://ledger-donjon.github.io/oled-vuln/
CVE: CVE-2019-14355
Published: 2019-08-10
Description: On ShapeShift KeepKey devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover secret data shown on the display. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that there is "insignificant risk.
CVSS Score: 2.4 (LOW)
CWE: CWE-203
References: https://medium.com/shapeshift-stories/shapeshift-security-update-5b0dd45c93db; https://medium.com/shapeshift-stories/shapeshift-security-update-5b0dd45c93db
CVE: CVE-2019-14357
Published: 2019-08-10
Description: On Mooltipass Mini devices, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. NOTE: the vendor's position is that an attack is not "realistically implementable.
CVSS Score: 2.4 (LOW)
CWE: CWE-203
References: https://github.com/limpkin/mooltipass/blob/master/CVE-2019-14357_statement.md; https://github.com/limpkin/mooltipass/blob/master/CVE-2019-14357_statement.md
CVE: CVE-2019-14924
Published: 2019-08-10
Description: An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802; https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3; https://github.com/swisspol/GCDWebServer/issues/433
CVE: CVE-2019-14933
Published: 2019-08-11
Description: Bagisto 0.1.5 allows CSRF under /admin URIs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://forums.bagisto.com/category/1/announcements; https://github.com/bagisto/bagisto/issues/750; https://forums.bagisto.com/category/1/announcements
CVE: CVE-2019-14934
Published: 2019-08-11
Description: An issue was discovered in PDFResurrect before 0.18. pdf_load_pages_kids in pdf.c doesn't validate a certain size value, which leads to a malloc failure and out-of-bounds write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/enferex/pdfresurrect/commit/0c4120fffa3dffe97b95c486a120eded82afe8a6; https://github.com/enferex/pdfresurrect/compare/v0.17...v0.18; https://lists.debian.org/debian-lts-announce/2020/12/msg00002.html
CVE: CVE-2019-14935
Published: 2019-08-12
Description: 3CX Phone 15 on Windows has insecure permissions on the "%PROGRAMDATA%\3CXPhone for Windows\PhoneApp" installation directory, allowing Full Control access for Everyone, and leading to privilege escalation because of a StartUp link.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432/; https://www.3cx.com/community/threads/security-issue-with-3cx-windows-client-install.64432/
CVE: CVE-2019-14939
Published: 2019-08-12
Description: An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/mysqljs/mysql/issues/2257; https://github.com/mysqljs/mysql/issues/2257
CVE: CVE-2019-14940
Published: 2019-08-12
Description: In Storage Performance Development Kit (SPDK) before 19.07, a user of a vhost can cause a crash if the target is sent invalid input.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/spdk/spdk/releases/tag/v19.07; https://github.com/spdk/spdk/releases/tag/v19.07
CVE: CVE-2019-14932
Published: 2019-08-12
Description: The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the website via a modified selApp variable to personalData/resumeDetail.cfm. This includes personal information and other sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://gist.github.com/donut117/1ddbb8290a1186502da81b46a5d53c63; https://gist.github.com/donut117/1ddbb8290a1186502da81b46a5d53c63
CVE: CVE-2015-9305
Published: 2019-08-12
Description: The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-google-map-plugin/#developers; https://wordpress.org/plugins/wp-google-map-plugin/#developers
CVE: CVE-2015-9306
Published: 2019-08-12
Description: The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-ultimate-csv-importer/#developers; https://wordpress.org/plugins/wp-ultimate-csv-importer/#developers
CVE: CVE-2016-10873
Published: 2019-08-12
Description: The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-database-backup/#developers; https://wpvulndb.com/vulnerabilities/9739; https://wordpress.org/plugins/wp-database-backup/#developers
CVE: CVE-2016-10874
Published: 2019-08-12
Description: The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-database-backup/#developers; https://wpvulndb.com/vulnerabilities/9739; https://wordpress.org/plugins/wp-database-backup/#developers
CVE: CVE-2016-10875
Published: 2019-08-12
Description: The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-database-backup/#developers; https://wpvulndb.com/vulnerabilities/9740; https://wordpress.org/plugins/wp-database-backup/#developers
CVE: CVE-2016-10876
Published: 2019-08-12
Description: The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/wp-database-backup/#developers; https://wordpress.org/plugins/wp-database-backup/#developers
CVE: CVE-2016-10877
Published: 2019-08-12
Description: The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-editor/#developers; https://wordpress.org/plugins/wp-editor/#developers
CVE: CVE-2016-10878
Published: 2019-08-12
Description: The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-google-map-plugin/#developers; https://wpvulndb.com/vulnerabilities/9741; https://wordpress.org/plugins/wp-google-map-plugin/#developers
CVE: CVE-2016-10879
Published: 2019-08-12
Description: The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-live-chat-support/#developers; https://wordpress.org/plugins/wp-live-chat-support/#developers
CVE: CVE-2017-18506
Published: 2019-08-12
Description: The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/#developers; https://wordpress.org/plugins/woocommerce-pdf-invoices-packing-slips/#developers
CVE: CVE-2017-18508
Published: 2019-08-12
Description: The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-live-chat-support/#developers; https://wpvulndb.com/vulnerabilities/9719; https://wordpress.org/plugins/wp-live-chat-support/#developers
CVE: CVE-2019-14948
Published: 2019-08-12
Description: The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/woocommerce-product-addon/#developers; https://wpvulndb.com/vulnerabilities/9502; https://www.pluginvulnerabilities.com/2019/08/08/this-authenticated-persistent-xss-vulnerability-might-be-what-hackers-are-targeting-ppom-for-woocommerce-for/
CVE: CVE-2019-14949
Published: 2019-08-12
Description: The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-database-backup/#developers; https://wpvulndb.com/vulnerabilities/9548; https://wordpress.org/plugins/wp-database-backup/#developers
CVE: CVE-2019-14950
Published: 2019-08-12
Description: The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/wp-live-chat-support/#developers; https://wordpress.org/plugins/wp-live-chat-support/#developers
CVE: CVE-2015-9303
Published: 2019-08-12
Description: The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/simple-share-buttons-adder/#developers; https://wordpress.org/plugins/simple-share-buttons-adder/#developers
CVE: CVE-2015-9304
Published: 2019-08-12
Description: The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9764; https://wordpress.org/plugins/ultimate-member/#developers
CVE: CVE-2016-10872
Published: 2019-08-12
Description: The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9738; https://wordpress.org/plugins/ultimate-member/#developers
CVE: CVE-2017-18499
Published: 2019-08-12
Description: The simple-membership plugin before 3.5.7 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/simple-membership/#developers; https://wpvulndb.com/vulnerabilities/9718; https://wordpress.org/plugins/simple-membership/#developers
CVE: CVE-2017-18500
Published: 2019-08-12
Description: The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/social-buttons-pack/#developers; https://wordpress.org/plugins/social-buttons-pack/#developers
CVE: CVE-2017-18501
Published: 2019-08-12
Description: The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/social-login-bws/#developers; https://wordpress.org/plugins/social-login-bws/#developers
CVE: CVE-2017-18502
Published: 2019-08-12
Description: The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/subscriber/#developers; https://wordpress.org/plugins/subscriber/#developers
CVE: CVE-2017-18503
Published: 2019-08-12
Description: The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/twitter-cards-meta/#developers; https://wordpress.org/plugins/twitter-cards-meta/#developers
CVE: CVE-2017-18504
Published: 2019-08-12
Description: The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/twitter-cards-meta/#developers; https://wordpress.org/plugins/twitter-cards-meta/#developers
CVE: CVE-2017-18505
Published: 2019-08-12
Description: The twitter-plugin plugin before 2.55 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/twitter-plugin/#developers; https://wordpress.org/plugins/twitter-plugin/#developers
CVE: CVE-2018-20965
Published: 2019-08-12
Description: The ultimate-member plugin before 2.0.4 for WordPress has XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9608; https://wordpress.org/plugins/ultimate-member/#developers
CVE: CVE-2018-20966
Published: 2019-08-12
Description: The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/woocommerce-jetpack/#developers; https://wordpress.org/plugins/woocommerce-jetpack/#developers
CVE: CVE-2019-14945
Published: 2019-08-12
Description: The ultimate-member plugin before 2.0.54 for WordPress has XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9506; https://wordpress.org/plugins/ultimate-member/#developers
CVE: CVE-2019-14946
Published: 2019-08-12
Description: The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9449; https://wordpress.org/plugins/ultimate-member/#developers
CVE: CVE-2019-14947
Published: 2019-08-12
Description: The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/ultimate-member/#developers; https://wpvulndb.com/vulnerabilities/9449; https://wordpress.org/plugins/ultimate-member/#developers