rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-1359 
Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document, related to an "intra-object-overflow" issue, a different vulnerability than CVE-2015-1205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T11:00:00.000Z
CVE-2015-1360 
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing, related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp, a different vulnerability than CVE-2015-1205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T11:00:00.000Z
CVE-2015-1361 
platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T11:00:00.000Z
CVE-2015-1362 
Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1363 
Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1364 
SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1365 
Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1366 
Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1367 
SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1368 
Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1369 
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1370 
Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1371 
Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1372 
SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1373 
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1374 
Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T17:00:00.000Z
CVE-2015-1375 
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-28T11:00:00.000Z
CVE-2015-1376 
pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-28T11:00:00.000Z
CVE-2015-1377 
The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T20:00:00.000Z
CVE-2015-1378 
cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2015-1379 
The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T21:00:00.000Z
CVE-2015-1380 
jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1381 
Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fault or memory consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1382 
parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1383 
Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-02T15:00:00.000Z
CVE-2015-1384 
Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1385 
Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-02T15:00:00.000Z
CVE-2015-1386 
Directory traversal vulnerability in unshield 1.0-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2015-1388 
The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-24T17:00:00.000Z
CVE-2015-1389 
Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-1390 
Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2015-1391 
Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-09-05T00:00:00.000Z
CVE-2015-1392 
Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-28T14:00:00.000Z
CVE-2015-1393 
SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-02T15:00:00.000Z
CVE-2015-1394 
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T16:45:44.000Z
CVE-2015-1395 
Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-25T18:00:00.000Z
CVE-2015-1396 
A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
Problem types: description: directory traversal
Affected products: vendor: n/a
product: n/a
Published: 2019-11-25T15:44:16.000Z
CVE-2015-1397 
SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-29T22:00:00.000Z
CVE-2015-1398 
Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism.  NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-29T22:00:00.000Z
CVE-2015-1399 
PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function.  NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-29T22:00:00.000Z
CVE-2015-1400 
SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1401 
Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2015-1402 
Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1403 
SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1404 
Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1405 
SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1414 
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-27T15:00:00.000Z
CVE-2015-1415 
The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1416 
Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T16:00:00.000Z
CVE-2015-1417 
The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-1418 
The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-05T16:00:00.000Z
CVE-2015-1419 
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-28T11:00:00.000Z
CVE-2015-1420 
Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T10:00:00.000Z
CVE-2015-1421 
Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-16T10:00:00.000Z
CVE-2015-1422 
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-29T15:00:00.000Z
CVE-2015-1423 
Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-29T15:00:00.000Z
CVE-2015-1424 
Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-29T15:00:00.000Z
CVE-2015-1425 
JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-18T12:47:55.000Z
CVE-2015-1426 
Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-23T17:00:00.000Z
CVE-2015-1427 
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-17T15:00:00.000Z
CVE-2015-1428 
Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1429 
Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T22:00:00.000Z
CVE-2015-1430 
Buffer overflow in xymon 4.3.17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2015-1431 
Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T17:00:00.000Z
CVE-2015-1432 
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T17:00:00.000Z
CVE-2015-1433 
program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1434 
Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-16T15:00:00.000Z