stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2017-18464 (severity: MEDIUM, weakness: CWE-20)
cPanel before 62.0.17 allows arbitrary file-overwrite operations via the WHM Zone Template editor (SEC-226).
CVE-2017-18465 (severity: MEDIUM, weakness: CWE-20)
cPanel before 62.0.17 does not have a sufficient list of reserved usernames (SEC-227).
CVE-2017-18466 (severity: LOW, weakness: CWE-20)
cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).
CVE-2017-18467 (severity: MEDIUM, weakness: CWE-254)
cPanel before 62.0.17 allows access to restricted resources because of a URL filtering error (SEC-229).
CVE-2017-18468 (severity: MEDIUM, weakness: CWE-94)
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).
CVE-2017-18469 (severity: MEDIUM, weakness: CWE-20)
cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
CVE-2017-18470 (severity: HIGH, weakness: CWE-255)
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196).
CVE-2017-18471 (severity: MEDIUM, weakness: CWE-79)
cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).
CVE-2017-18472 (severity: MEDIUM, weakness: CWE-79)
cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).
CVE-2017-18473 (severity: MEDIUM, weakness: CWE-79)
cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
CVE-2017-18474 (severity: MEDIUM, weakness: CWE-200)
cPanel before 62.0.4 allows arbitrary file-read operations via Exim valiases (SEC-201).
CVE-2017-18475 (severity: HIGH, weakness: CWE-20)
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204).
CVE-2017-18476 (severity: HIGH, weakness: CWE-254)
Leech Protect in cPanel before 62.0.4 does not protect certain directories (SEC-205).
CVE-2017-18477 (severity: MEDIUM, weakness: CWE-254)
In cPanel before 62.0.4, Exim transports could execute in the context of the nobody account (SEC-206).
CVE-2017-18478 (severity: MEDIUM, weakness: CWE-200)
In cPanel before 62.0.4 incorrect ACL checks could occur in xml-api for Rearrange Account actions (SEC-207).
CVE-2017-18479 (severity: MEDIUM, weakness: CWE-295)
In cPanel before 62.0.4, WHM SSL certificate generation uses an unreserved e-mail address (SEC-209).
CVE-2017-18480 (severity: MEDIUM, weakness: CWE-254)
cPanel before 62.0.4 does not enforce account ownership for has_mycnf_for_cpuser WHM API calls (SEC-210).
CVE-2017-18481 (severity: MEDIUM, weakness: CWE-79)
cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
CVE-2017-18482 (severity: MEDIUM, weakness: CWE-20)
cPanel before 62.0.4 allows resellers to use the WHM enqueue_transfer_item API for queueing non-rearrange modules (SEC-213).
CVE-2017-18483 (severity: MEDIUM, weakness: CWE-79)
ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.
CVE-2017-18484 (severity: MEDIUM, weakness: CWE-79)
Cognitoys Dino devices allow XSS via the SSID.
CVE-2017-18485 (severity: MEDIUM, weakness: CWE-352)
Cognitoys Dino devices allow profiles_add.html CSRF.
CVE-2017-18486 (severity: HIGH, weakness: CWE-332)
Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin userHash parameter. By inspecting the token value provided in a password reset link, a user can leverage a weak PRNG to recover the shared secret used by the server for remote authentication. The shared secret can be used to escalate privileges by forging new tokens for any user. These tokens can be used to automatically log in as the affected user.
CVE-2017-18487 (severity: MEDIUM, weakness: CWE-79)
The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.
CVE-2017-18488 (severity: MEDIUM, weakness: CWE-79)
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
CVE-2017-18489 (severity: MEDIUM, weakness: CWE-79)
The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.
CVE-2017-18490 (severity: MEDIUM, weakness: CWE-79)
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.
CVE-2017-18491 (severity: MEDIUM, weakness: CWE-79)
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
CVE-2017-18492 (severity: MEDIUM, weakness: CWE-79)
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
CVE-2017-18493 (severity: MEDIUM, weakness: CWE-79)
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.
CVE-2017-18494 (severity: MEDIUM, weakness: CWE-79)
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.
CVE-2017-18495 (severity: MEDIUM, weakness: CWE-79)
The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.
CVE-2017-18496 (severity: MEDIUM, weakness: CWE-79)
The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.
CVE-2017-18497 (severity: MEDIUM, weakness: CWE-79)
The liveforms plugin before 3.4.0 for WordPress has XSS.
CVE-2017-18498 (severity: MEDIUM, weakness: CWE-79)
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.
CVE-2017-18499 (severity: MEDIUM, weakness: CWE-79)
The simple-membership plugin before 3.5.7 for WordPress has XSS.
CVE-2017-18500 (severity: MEDIUM, weakness: CWE-79)
The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.
CVE-2017-18501 (severity: MEDIUM, weakness: CWE-79)
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVE-2017-18502 (severity: MEDIUM, weakness: CWE-79)
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.
CVE-2017-18503 (severity: MEDIUM, weakness: CWE-79)
The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.
CVE-2017-18504 (severity: HIGH, weakness: CWE-352)
The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.
CVE-2017-18505 (severity: MEDIUM, weakness: CWE-79)
The twitter-plugin plugin before 2.55 for WordPress has XSS.
CVE-2017-18506 (severity: MEDIUM, weakness: CWE-79)
The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.
CVE-2017-18507 (severity: MEDIUM, weakness: CWE-79)
The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.
CVE-2017-18508 (severity: MEDIUM, weakness: CWE-79)
The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.
CVE-2017-18509 (severity: HIGH, weakness: CWE-20)
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before 4.9.187.
CVE-2017-18510 (severity: HIGH, weakness: CWE-352)
The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.
CVE-2017-18511 (severity: HIGH, weakness: CWE-352)
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.
CVE-2017-18512 (severity: HIGH, weakness: CWE-352)
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.
CVE-2017-18513 (severity: HIGH, weakness: CWE-352)
The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.
CVE-2017-18514 (severity: CRITICAL, weakness: CWE-89)
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
CVE-2017-18515 (severity: CRITICAL, weakness: CWE-89)
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.
CVE-2017-18516 (severity: MEDIUM, weakness: CWE-79)
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.
CVE-2017-18517 (severity: MEDIUM, weakness: CWE-79)
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
CVE-2017-18518 (severity: MEDIUM, weakness: CWE-79)
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
CVE-2017-18519 (severity: MEDIUM, weakness: CWE-79)
The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.
CVE-2017-18520 (severity: MEDIUM, weakness: CWE-79)
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
CVE-2017-18521 (severity: HIGH, weakness: CWE-352)
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.
CVE-2017-18522 (severity: MEDIUM, weakness: CWE-79)
The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.
CVE-2017-18523 (severity: HIGH, weakness: CWE-352)
The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.
CVE-2017-18524 (severity: MEDIUM, weakness: CWE-79)
The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.
CVE-2017-18525 (severity: MEDIUM, weakness: CWE-79)
The megamenu plugin before 2.4 for WordPress has XSS.
CVE-2017-18526 (severity: MEDIUM, weakness: CWE-79)
The moreads-se plugin before 1.4.7 for WordPress has XSS.
CVE-2017-18527 (severity: MEDIUM, weakness: CWE-79)
The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.
CVE-2017-18528 (severity: MEDIUM, weakness: CWE-79)
The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.
CVE-2017-18529 (severity: MEDIUM, weakness: CWE-79)
The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.
CVE-2017-18530 (severity: MEDIUM, weakness: CWE-79)
The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.
CVE-2017-18531 (severity: MEDIUM, weakness: CWE-79)
The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.
CVE-2017-18532 (severity: MEDIUM, weakness: CWE-79)
The realty plugin before 1.1.0 for WordPress has multiple XSS issues.
CVE-2017-18533 (severity: MEDIUM, weakness: CWE-79)
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.
CVE-2017-18534 (severity: MEDIUM, weakness: CWE-79)
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.
CVE-2017-18535 (severity: MEDIUM, weakness: CWE-79)
The smokesignal plugin before 1.2.7 for WordPress has XSS.
CVE-2017-18536 (severity: MEDIUM, weakness: CWE-79)
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.
CVE-2017-18537 (severity: MEDIUM, weakness: CWE-79)
The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.
CVE-2017-18538 (severity: MEDIUM, weakness: CWE-79)
The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.
CVE-2017-18539 (severity: MEDIUM, weakness: CWE-79)
The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.
CVE-2017-18540 (severity: MEDIUM, weakness: CWE-79)
The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.
CVE-2017-18541 (severity: MEDIUM, weakness: CWE-79)
The xo-security plugin before 1.5.3 for WordPress has XSS.
CVE-2017-18542 (severity: MEDIUM, weakness: CWE-79)
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
CVE-2017-18543 (severity: CRITICAL, weakness: CWE-284)
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
CVE-2017-18544 (severity: HIGH, weakness: CWE-352)
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
CVE-2017-18545 (severity: HIGH, weakness: CWE-20)
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
CVE-2017-18546 (severity: HIGH, weakness: CWE-352)
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
CVE-2017-18547 (severity: HIGH, weakness: CWE-352)
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
CVE-2017-18548 (severity: CRITICAL, weakness: CWE-89)
The note-press plugin before 0.1.2 for WordPress has SQL injection.
CVE-2017-18549 (severity: MEDIUM, weakness: CWE-200)
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_send_raw_srb does not initialize the reply structure.
CVE-2017-18550 (severity: MEDIUM, weakness: CWE-200)
An issue was discovered in drivers/scsi/aacraid/commctrl.c in the Linux kernel before 4.13. There is potential exposure of kernel stack memory because aac_get_hba_info does not initialize the hbainfo structure.
CVE-2017-18551 (severity: MEDIUM, weakness: CWE-787)
An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an out of bounds write in the function i2c_smbus_xfer_emulated.
CVE-2017-18552 (severity: HIGH, weakness: CWE-787)
An issue was discovered in net/rds/af_rds.c in the Linux kernel before 4.11. There is an out of bounds write and read in the function rds_recv_track_latency.
CVE-2017-18553 (severity: MEDIUM, weakness: CWE-79)
The ad-buttons plugin before 2.3.2 for WordPress has XSS.
CVE-2017-18554 (severity: MEDIUM, weakness: CWE-79)
The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.
CVE-2017-18555 (severity: MEDIUM, weakness: CWE-79)
The booking-sms plugin before 1.1.0 for WordPress has XSS.
CVE-2017-18556 (severity: MEDIUM, weakness: CWE-79)
The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.
CVE-2017-18557 (severity: MEDIUM, weakness: CWE-79)
The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.
CVE-2017-18558 (severity: MEDIUM, weakness: CWE-79)
The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.
CVE-2017-18559 (severity: MEDIUM, weakness: CWE-79)
The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.
CVE-2017-18560 (severity: MEDIUM, weakness: CWE-79)
The content-audit plugin before 1.9.2 for WordPress has XSS.
CVE-2017-18561 (severity: MEDIUM, weakness: CWE-79)
The embed-comment-images plugin before 0.6 for WordPress has XSS.
CVE-2017-18562 (severity: MEDIUM, weakness: CWE-79)
The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.
CVE-2017-18563 (severity: MEDIUM, weakness: CWE-79)
The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.
CVE-2017-18564 (severity: MEDIUM, weakness: CWE-79)
The sender plugin before 1.2.1 for WordPress has multiple XSS issues.
CVE-2017-18565 (severity: MEDIUM, weakness: CWE-79)
The updater plugin before 1.35 for WordPress has multiple XSS issues.
CVE-2017-18566 (severity: MEDIUM, weakness: CWE-79)
The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
CVE-2017-18567 (severity: MEDIUM, weakness: CWE-79)
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
CVE-2017-18568 (severity: MEDIUM, weakness: CWE-79)
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
CVE-2017-18569 (severity: HIGH, weakness: CWE-352)
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
CVE-2017-18570 (severity: CRITICAL, weakness: CWE-89)
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.
CVE-2017-18571 (severity: CRITICAL, weakness: CWE-89)
The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.
CVE-2017-18572 (severity: MEDIUM, weakness: CWE-79)
The gnucommerce plugin before 1.4.2 for WordPress has XSS.
CVE-2017-18573 (severity: CRITICAL, weakness: CWE-89)
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.
CVE-2017-18574 (severity: MEDIUM, weakness: CWE-20)
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
CVE-2017-18575 (severity: MEDIUM, weakness: CWE-79)
The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.
CVE-2017-18576 (severity: MEDIUM, weakness: CWE-79)
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
CVE-2017-18577 (severity: MEDIUM, weakness: CWE-79)
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
CVE-2017-18578 (severity: MEDIUM, weakness: CWE-79)
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
CVE-2017-18579 (severity: MEDIUM, weakness: CWE-79)
The corner-ad plugin before 1.0.8 for WordPress has XSS.
CVE-2017-18580 (severity: CRITICAL, weakness: CWE-20)
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
CVE-2017-18581 (severity: MEDIUM, weakness: CWE-79)
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
CVE-2017-18582 (severity: MEDIUM, weakness: CWE-79)
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
CVE-2017-18583 (severity: CRITICAL, weakness: CWE-74)
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
CVE-2017-18584 (severity: HIGH, weakness: CWE-264)
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
CVE-2017-18585 (severity: HIGH, weakness: CWE-22)
The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
CVE-2017-18586 (severity: CRITICAL, weakness: CWE-22)
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
CVE-2017-18587 (severity: MEDIUM, weakness: CWE-93)
An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
CVE-2017-18588 (severity: MEDIUM, weakness: CWE-295)
An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
CVE-2017-18589 (severity: HIGH, weakness: CWE-20)
An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
CVE-2017-18590 (severity: MEDIUM, weakness: CWE-79)
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
CVE-2017-18591 (severity: MEDIUM, weakness: CWE-79)
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
CVE-2017-18592 (severity: HIGH, weakness: CWE-434)
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
CVE-2017-18593 (severity: MEDIUM, weakness: CWE-79)
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
CVE-2017-18594 (severity: HIGH, weakness: CWE-415)
nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fails, as demonstrated by a leading \n character to ssh-brute.nse or ssh-auth-methods.nse.
CVE-2017-18595 (severity: HIGH, weakness: CWE-415)
An issue was discovered in the Linux kernel before 4.14.11. A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c.
CVE-2017-18596 (severity: HIGH, weakness: CWE-269)
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.
CVE-2017-18597 (severity: HIGH, weakness: CWE-89)
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.
CVE-2017-18598 (severity: MEDIUM, weakness: CWE-79)
The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.
CVE-2017-18599 (severity: MEDIUM, weakness: CWE-79)
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.
CVE-2017-18600 (severity: MEDIUM, weakness: CWE-79)
The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.
CVE-2017-18601 (severity: MEDIUM, weakness: CWE-79)
The examapp plugin 1.0 for WordPress has XSS via exam input text fields.
CVE-2017-18602 (severity: HIGH, weakness: CWE-89)
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.
CVE-2017-18603 (severity: MEDIUM, weakness: CWE-79)
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
CVE-2017-18604 (severity: HIGH, weakness: CWE-74)
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
CVE-2017-18605 (severity: CRITICAL, weakness: CWE-74)
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
CVE-2017-18606 (severity: MEDIUM, weakness: CWE-79)
The avada theme before 5.1.5 for WordPress has stored XSS.
CVE-2017-18607 (severity: HIGH, weakness: CWE-352)
The avada theme before 5.1.5 for WordPress has CSRF.
CVE-2017-18608 (severity: MEDIUM, weakness: CWE-79)
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
CVE-2017-18609 (severity: MEDIUM, weakness: CWE-79)
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
CVE-2017-18610 (severity: MEDIUM, weakness: CWE-79)
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
CVE-2017-18611 (severity: MEDIUM, weakness: CWE-79)
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
CVE-2017-18612 (severity: MEDIUM, weakness: CWE-79)
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
CVE-2017-18613 (severity: MEDIUM, weakness: CWE-79)
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
CVE-2017-18614 (severity: HIGH, weakness: CWE-89)
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
CVE-2017-18615 (severity: MEDIUM, weakness: CWE-79)
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
CVE-2017-18634 (severity: CRITICAL, weakness: CWE-74)
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
CVE-2017-18635 (severity: MEDIUM, weakness: CWE-79)
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
CVE-2017-18636 (severity: HIGH, weakness: CWE-22)
CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.
CVE-2017-18638 (severity: HIGH, weakness: CWE-918)
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
CVE-2017-18639 (severity: MEDIUM, weakness: CWE-79)
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title.