rainbutterfly/cve_corpus huggingface dataset:
CVE-2014-4476 
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4477 and CVE-2014-4479.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4477 
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4479.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4479 
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4476 and CVE-2014-4477.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4480 
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4481 
Integer overflow in CoreGraphics in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4483 
Buffer overflow in FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font file in a PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4484 
FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .dfont file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4485 
Buffer overflow in the XML parser in Foundation in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4486 
IOAcceleratorFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly handle resource lists and IOService userclient types, which allows attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4487 
Buffer overflow in IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4488 
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4489 
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4491 
The extension APIs in the kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 do not prevent the presence of addresses within an OSBundleMachOHeaders key in a response, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4492 
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4493 
The app-installation functionality in MobileInstallation in Apple iOS before 8.1.3 allows attackers to obtain control of the local app container by leveraging access to an enterprise distribution certificate for signing a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4494 
Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4495 
The kernel in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not enforce the read-only attribute of a shared memory segment during use of a custom cache mode, which allows attackers to bypass intended access restrictions via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4496 
The mach_port_kobject interface in the kernel in Apple iOS before 8.1.3 and Apple TV before 7.0.3 does not properly restrict kernel-address and heap-permutation information, which makes it easier for attackers to bypass the ASLR protection mechanism via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4497 
Integer signedness error in IOBluetoothFamily in the Bluetooth implementation in Apple OS X before 10.10 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (write to kernel memory) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4498 
The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the "Thunderstrike" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4499 
The App Store process in CommerceKit Framework in Apple OS X before 10.10.2 places Apple ID credentials in App Store logs, which allows local users to obtain sensitive information by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-30T11:00:00.000Z
CVE-2014-4501 
Multiple stack-based buffer overflows in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 3.3.0 allow remote pool servers to have unspecified impact via a long URL in a client.reconnect stratum message to the (1) extract_sockaddr or (2) parse_reconnect functions in util.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-23T14:00:00.000Z
CVE-2014-4502 
Multiple heap-based buffer overflows in the parse_notify function in sgminer before 4.2.2, cgminer before 4.3.5, and BFGMiner before 4.1.0 allow remote pool servers to have unspecified impact via a (1) large or (2) negative value in the Extranonc2_size parameter in a mining.subscribe response and a crafted mining.notify request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-23T14:00:00.000Z
CVE-2014-4503 
The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of service (application exit) via a crafted (1) bbversion, (2) prev_hash, (3) nbit, or (4) ntime parameter in a mining.notify action stratum message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-23T14:00:00.000Z
CVE-2014-4505 
Cross-site scripting (XSS) vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-20T14:00:00.000Z
CVE-2014-4506 
Cross-site scripting (XSS) vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the (1) attribute or (2) content value for a meta tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-20T14:00:00.000Z
CVE-2014-4507 
Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-20T14:00:00.000Z
CVE-2014-4508 
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-23T10:00:00.000Z
CVE-2014-4509 
The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute arbitrary commands by leveraging eDirectory POSIX attribute changes to insert shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-21T15:00:00.000Z
CVE-2014-4510 
Cross-site scripting (XSS) vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-06T23:00:00.000Z
CVE-2014-4511 
Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-22T14:00:00.000Z
CVE-2014-4513 
Multiple cross-site scripting (XSS) vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MESSAGE, (2) EMAIL, or (3) NAME parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4514 
Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T15:00:00.000Z
CVE-2014-4515 
Cross-site scripting (XSS) vulnerability in mce_anyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the text parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4516 
Cross-site scripting (XSS) vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4517 
Cross-site scripting (XSS) vulnerability in getNetworkSites.php in the CBI Referral Manager plugin 1.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the searchString parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-21T15:00:00.000Z
CVE-2014-4518 
Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4519 
Cross-site scripting (XSS) vulnerability in the Conversador plugin 2.61 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the 'page' parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T16:39:44.000Z
CVE-2014-4520 
Cross-site scripting (XSS) vulnerability in phprack.php in the DMCA WaterMarker plugin before 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the plugin_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4521 
Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4522 
Cross-site scripting (XSS) vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4523 
Cross-site scripting (XSS) vulnerability in the Easy Career Openings plugin 0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T13:43:51.000Z
CVE-2014-4524 
Cross-site scripting (XSS) vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4525 
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in the Ebay Feeds for WordPress plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T13:47:36.000Z
CVE-2014-4526 
Multiple cross-site scripting (XSS) vulnerabilities in callback.php in the efence plugin 1.3.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) zoneid, (3) pubKey, or (4) privKey parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4527 
Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) FormID or (2) AdministratorID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4528 
Multiple cross-site scripting (XSS) vulnerabilities in admin/swarm-settings.php in the Bugs Go Viral : Facebook Promotion Generator (fbpromotions) plugin 1.3.4 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) promo_type, (2) fb_edit_action, or (3) promo_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4529 
Cross-site scripting (XSS) vulnerability in fpg_preview.php in the Flash Photo Gallery plugin 0.7 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4530 
flog plugin 0.1 for WordPress has XSS
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T13:00:25.000Z
CVE-2014-4531 
Cross-site scripting (XSS) vulnerability in main_page.php in the Game tabs plugin 0.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the n parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4532 
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin before 1.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4533 
Cross-site scripting (XSS) vulnerability in ajax_functions.php in the GEO Redirector plugin 1.0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the hid_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4534 
Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T20:00:00.000Z
CVE-2014-4535 
Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T19:28:10.000Z
CVE-2014-4536 
Multiple cross-site scripting (XSS) vulnerabilities in tests/notAuto_test_ContactService_pauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) go, (2) contactId, or (3) campaignId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T19:01:40.000Z
CVE-2014-4537 
Cross-site scripting (XSS) vulnerability in inpage.tpl.php in the Keyword Strategy Internal Links plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) sort, (2) search, or (3) dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4538 
Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4539 
Cross-site scripting (XSS) vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T18:50:17.000Z
CVE-2014-4540 
Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4541 
Cross-site scripting (XSS) vulnerability in shortcode-generator/preview-shortcode-external.php in the OMFG Mobile Pro plugin 1.1.26 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4542 
Cross-site scripting (XSS) vulnerability in redirect.php in the Ooorl plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4543 
Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fcolor, (2) links, (3) stitle, (4) height, (5) width, (6) host, (7) bcolor, (8) msg, (9) id, or (10) size parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T18:00:00.000Z
CVE-2014-4544 
Cross-site scripting (XSS) vulnerability in the Podcast Channels plugin 0.20 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the Filename parameter to getid3/demos/demo.write.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-27T18:53:34.000Z
CVE-2014-4545 
Multiple cross-site scripting (XSS) vulnerabilities in pq_dialog.php in the Pro Quoter plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) leftorright or (2) author parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-01T14:00:00.000Z
CVE-2014-4546 
Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the response parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-02T20:00:00.000Z