rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-9066 
Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-09T22:52:00.000Z
CVE-2014-9087 
Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T15:00:00.000Z
CVE-2014-9089 
Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to view_all_set.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-28T15:00:00.000Z
CVE-2014-9090 
The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modify_ldt system call, as demonstrated by sigreturn_32 in the linux-clock-tests test suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-30T01:00:00.000Z
CVE-2014-9091 
Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T15:00:00.000Z
CVE-2014-9092 
libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T13:00:00.000Z
CVE-2014-9093 
LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9094 
Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9095 
Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9096 
Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9097 
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the playlistId parameter in the newplaylist page or (3) videoId parameter in a newvideo page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9098 
Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to (1) videoads/videoads.php, (2) video/video.php, or (3) playlist/playlist.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9099 
Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9100 
Cross-site scripting (XSS) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydowork_adsense page to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9101 
Multiple cross-site request forgery (CSRF) vulnerabilities in Oxwall 1.7.0 (build 7907 and 7906) and SkaDate Lite 2.0 (build 7651) allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks or possibly have other unspecified impact via the (1) label parameter to admin/users/roles/, (2) lang[1][base][questions_account_type_5615100a931845eca8da20cfdf7327e0] in an AddAccountType action or (3) qst_name parameter in an addQuestion action to admin/questions/ajax-responder/, or (4) form_name or (5) restrictedUsername parameter to admin/restricted-usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9102 
Multiple SQL injection vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote authenticated users to execute arbitrary SQL commands via the index value in an array parameter, as demonstrated by the topics[] parameter in an unfavorite action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9103 
Multiple cross-site scripting (XSS) vulnerabilities in the Kunena component before 3.0.6 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) index value of an array parameter or the filename parameter in the Content-Disposition header to the (2) file or (3) profile image upload functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9104 
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) disconnecting established VPN sessions, (2) connect to arbitrary VPN servers, or (3) create VPN profiles and execute arbitrary commands via crafted API requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-26T15:00:00.000Z
CVE-2014-9112 
Heap-based buffer overflow in the process_copy_in function in GNU Cpio 2.11 allows remote attackers to cause a denial of service via a large block value in a cpio archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9113 
CCH Wolters Kluwer ProSystem fx Engagement (aka PFX Engagement) 7.1 and earlier uses weak permissions (Authenticated Users: Modify and Write) for the (1) Pfx.Engagement.WcfServices, (2) PFXEngDesktopService, (3) PFXSYNPFTService, and (4) P2EWinService service files in PFX Engagement\, which allows local users to obtain LocalSystem privileges via a Trojan horse file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9114 
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T15:00:00.000Z
CVE-2014-9115 
SQL injection vulnerability in the rate_picture function in include/functions_rate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a comparison of a non-numeric value that begins with a digit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-23T11:00:00.000Z
CVE-2014-9116 
The write_one_header function in mutt 1.5.23 does not properly handle newline characters at the beginning of a header, which allows remote attackers to cause a denial of service (crash) via a header with an empty body, which triggers a heap-based buffer overflow in the mutt_substrdup function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9117 
MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-06T21:00:00.000Z
CVE-2014-9118 
The web administrative portal in Zhone zNID GPON 2426A before S3.0.501 allows remote attackers to execute arbitrary commands via shell metacharacters in the ipAddr parameter to zhnping.cmd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-17T16:00:00.000Z
CVE-2014-9119 
Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-31T22:00:00.000Z
CVE-2014-9120 
Cross-site scripting (XSS) vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to subrion/search/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T15:00:00.000Z
CVE-2014-9126 
Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YII_CSRF_TOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T16:23:29.000Z
CVE-2014-9127 
Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T16:36:53.000Z
CVE-2014-9129 
Cross-site request forgery (CSRF) vulnerability in the CreativeMinds CM Downloads Manager plugin before 2.0.7 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the addons_title parameter in the CMDM_admin_settings page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-9130 
scanner.c in LibYAML 0.1.5 and 0.1.6, as used in the YAML-LibYAML (aka YAML-XS) module for Perl, allows context-dependent attackers to cause a denial of service (assertion failure and crash) via vectors involving line-wrapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-08T16:00:00.000Z
CVE-2014-9134 
Unrestricted file upload vulnerability in Huawei Honor Cube Wireless Router WS860s before V100R001C02B222 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T21:00:00.000Z
CVE-2014-9135 
The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-19T15:00:00.000Z
CVE-2014-9136 
Huawei FusionManager with software V100R002C03 and V100R003C00 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface.
Problem types: description: CSRF
Affected products: vendor: n/a
product: FusionManager FusionManager All V100R002C03 versions, All V100R003C00 versions,
Published: 2017-04-02T20:00:00.000Z
CVE-2014-9137 
Huawei USG9500 with software V200R001C01SPC800 and earlier versions, V300R001C00; USG2100 with software V300R001C00SPC900 and earlier versions; USG2200 with software V300R001C00SPC900; USG5100 with software V300R001C00SPC900 could allow an unauthenticated, remote attacker to conduct a CSRF attack against the user of the web interface.
Problem types: description: CSRF
Affected products: vendor: n/a
product: USG9500,USG2100,USG2200,USG5100,USG5500, USG9500 V200R001C01SPC800 and earlier versions, All V300R001C00 versions,USG2100 V300R001C00SPC900 and earlier versions,USG2200 V300R001C00SPC900,USG5100 V300R001C00SPC900,
Published: 2017-04-02T20:00:00.000Z
CVE-2014-9140 
Buffer overflow in the ppp_hdlc function in print-ppp.c in tcpdump 4.6.2 and earlier allows remote attackers to cause a denial of service (crash) cia a crafted PPP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T16:00:00.000Z
CVE-2014-9141 
The installer in Thomson Reuters Fixed Assets CS 13.1.4 and earlier uses weak permissions for connectbgdl.exe, which allows local users to execute arbitrary code by modifying this program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T01:00:00.000Z
CVE-2014-9142 
Cross-site scripting (XSS) vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to inject arbitrary web script or HTML via the failrefer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-9143 
Open redirect vulnerability in Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the failrefer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-9144 
Technicolor Router TD5130 with firmware 2.05.C29GV allows remote attackers to execute arbitrary commands via shell metacharacters in the ping field (setobject_ip parameter).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T15:00:00.000Z
CVE-2014-9145 
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an edit action to dapur/index.php; (2) cat, (3) user, or (4) level parameter to dapur/apps/app_article/controller/article_list.php; or (5) email parameter in an email action or (6) username parameter in a user action to dapur/apps/app_user/controller/check_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-14T14:00:00.000Z
CVE-2014-9146 
Multiple cross-site scripting (XSS) vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) id, (3) page, or (4) app parameter to the default URI or the (5) act parameter to dapur/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-14T14:00:00.000Z
CVE-2014-9147 
Fiyo CMS 2.0.1.8 allows remote attackers to obtain sensitive information via a direct request to the database backup file in .backup/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T15:00:00.000Z
CVE-2014-9148 
Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-16T15:00:00.000Z
CVE-2014-9150 
Race condition in the MoveFileEx call hook feature in Adobe Reader and Acrobat 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently write to files in arbitrary locations, via an NTFS junction attack, a similar issue to CVE-2014-0568.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-30T02:00:00.000Z
CVE-2014-9151 
The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T16:00:00.000Z
CVE-2014-9152 
The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T16:00:00.000Z
CVE-2014-9153 
Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T16:00:00.000Z
CVE-2014-9154 
The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to (1) new or (2) modified nodes or (3) their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T16:00:00.000Z
CVE-2014-9155 
Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T16:00:00.000Z
CVE-2014-9156 
The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-01T16:00:00.000Z
CVE-2014-9157 
Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vectors, which are not properly handled in an error string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-03T21:00:00.000Z
CVE-2014-9158 
Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-8445, CVE-2014-8446, CVE-2014-8447, CVE-2014-8456, CVE-2014-8458, CVE-2014-8459, and CVE-2014-8461.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9159 
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8457 and CVE-2014-8460.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9160 
Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-13T10:00:00.000Z
CVE-2014-9161 
CoolType.dll in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows, and 10.x through 10.1.13 and 11.x through 11.0.10 on OS X, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-9162 
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9163 
Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9164 
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0587.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9165 
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.13 and 11.x before 11.0.10 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8454 and CVE-2014-8455.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9166 
Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-10T21:00:00.000Z
CVE-2014-9173 
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z
CVE-2014-9174 
Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" (manual_ua_code_field) field in the General Settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-02T16:00:00.000Z