rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-4823 
Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-25T21:00:00.000Z
CVE-2016-4824 
The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authentication attempts, which makes it easier for remote attackers to obtain network access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-25T21:00:00.000Z
CVE-2016-4825 
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-25T21:00:00.000Z
CVE-2016-4826 
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-25T21:00:00.000Z
CVE-2016-4827 
Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-25T21:00:00.000Z
CVE-2016-4828 
The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-25T21:00:00.000Z
CVE-2016-4829 
DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-4830 
Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-4831 
Untrusted search path vulnerability in LINE and LINE Installer 4.7.0 and earlier on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T01:00:00.000Z
CVE-2016-4832 
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-4833 
Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-03T01:00:00.000Z
CVE-2016-4834 
modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-01T01:00:00.000Z
CVE-2016-4837 
SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-01T01:00:00.000Z
CVE-2016-4838 
The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION allows an attacker to execute unintended operations via a specially crafted application.
Problem types: description: Unintended operation execution
Affected products: vendor: Money Foward, Inc.
product: Money Forward
vendor: Money Foward, Inc.
product: Money Forward for The Gunma Bank
vendor: Money Foward, Inc.
product: Money Forward for SHIGA BANK
vendor: Money Foward, Inc.
product: Money Forward for SHIZUOKA BANK
vendor: Money Foward, Inc.
product: Money Forward for SBI Sumishin Net Bank
vendor: Money Foward, Inc.
product: Money Forward for Tokai Tokyo Securities
vendor: Money Foward, Inc.
product: Money Forward for THE TOHO BANK
vendor: Money Foward, Inc.
product: Money Forward for YMFG
vendor: SOURCENEXT CORPORATION
product: Money Forward for AppPass
vendor: SOURCENEXT CORPORATION
product: Money Forward for au SMARTPASS
vendor: SOURCENEXT CORPORATION
product: Money Forward for Chou Houdai
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4839 
The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose information stored on the device via a specially crafted application.
Problem types: description: WebView implmentation issue
Affected products: vendor: Money Foward, Inc.
product: Money Forward
vendor: Money Foward, Inc.
product: Money Forward for The Gunma Bank
vendor: Money Foward, Inc.
product: Money Forward for SHIGA BANK
vendor: Money Foward, Inc.
product: Money Forward for SHIZUOKA BANK
vendor: Money Foward, Inc.
product: Money Forward for SBI Sumishin Net Bank
vendor: Money Foward, Inc.
product: Money Forward for Tokai Tokyo Securities
vendor: Money Foward, Inc.
product: Money Forward for THE TOHO BANK
vendor: Money Foward, Inc.
product: Money Forward for YMFG
vendor: SOURCENEXT CORPORATION
product: Money Forward for AppPass
vendor: SOURCENEXT CORPORATION
product: Money Forward for au SMARTPASS
vendor: SOURCENEXT CORPORATION
product: Money Forward for Chou Houdai
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4840 
Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-4841 
Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-4842 
Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2016-4843 
Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2016-4844 
Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2016-4845 
Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-24T10:00:00.000Z
CVE-2016-4846 
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-4847 
Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T17:00:00.000Z
CVE-2016-4848 
Cross-site scripting (XSS) vulnerability in ClipBucket before 2.8.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-02T01:00:00.000Z
CVE-2016-4849 
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or HTML by leveraging use of the COM_getCurrentURL function in (1) public_html/layout/default/header.thtml, (2) public_html/layout/bento/header.thtml, (3) public_html/layout/fotos/header.thtml, or (4) public_html/layout/default/article/article.thtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T17:00:00.000Z
CVE-2016-4850 
LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2016-4851 
Cross-site scripting (XSS) vulnerability in Let's PHP! simple chat before 2016-08-15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-02T01:00:00.000Z
CVE-2016-4852 
YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-12T10:00:00.000Z
CVE-2016-4853 
AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-02T01:00:00.000Z
CVE-2016-4854 
Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: NTT DOCOMO, INC.
product: L-04D
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4855 
Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: ADOdb
product: ADOdb
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4856 
Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Splunk Inc.
product: Splunk Enterprise
vendor: Splunk Inc.
product: Splunk Light
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4857 
Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splunk Light prior to 6.4.2 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: Open Redirect
Affected products: vendor: Splunk Inc.
product: Splunk Enterprise
vendor: Splunk Inc.
product: Splunk Light
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4858 
Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Splunk Inc.
product: Splunk Enterprise
vendor: Splunk Inc.
product: Splunk Light
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4859 
Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: Open Redirect
Affected products: vendor: Splunk Inc.
product: Splunk Enterprise
vendor: Splunk Inc.
product: Splunk Light
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4860 
Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-19T01:00:00.000Z
CVE-2016-4861 
The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T18:00:00.000Z
CVE-2016-4862 
Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2016-4863 
The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.
Problem types: description: Lack of authentication mechanism
Affected products: vendor: Toshiba
product: FlashAir SD-WD/WC series Class 6 model
vendor: Toshiba
product: FlashAir SD-WD/WC series Class 10 model W-02
vendor: Toshiba
product: FlashAir SD-WE series Class 10 model W-03
vendor: Toshiba
product: FlashAir Class 6 model
vendor: Toshiba
product: FlashAir II Class 10 model W-02 series
vendor: Toshiba
product: FlashAir III Class 10 model W-03 series
vendor: Toshiba
product: FlashAir Class 6 model
vendor: Toshiba
product: FlashAir W-02 series Class 10 model
vendor: Toshiba
product: FlashAir W-03 series Class 10 model
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4864 
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
Problem types: description: Format String Vulnerability
Affected products: vendor: Kazuho Oku
product: H2O
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4865 
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4866 
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4867 
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4868 
Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4869 
Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4870 
Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4871 
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4872 
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4873 
Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4874 
Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-17T15:00:00.000Z
CVE-2016-4875 
Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2016-4876 
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4877 
Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Mail
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4878 
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4879 
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Mail
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4880 
Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Blog
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4881 
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Blog
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4882 
Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4883 
Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: baserCMS Users Community
product: baserCMS
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4884 
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Blog
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4885 
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Feed
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4886 
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Mail
Published: 2017-05-12T18:00:00.000Z