CVE-2015-9xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
547 records · Page 3 of 6
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
UpdatedThe feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
UpdatedThe ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
UpdatedThe sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
UpdatedThe wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
UpdatedThe cp-polls plugin before 1.0.5 for WordPress has XSS.
UpdatedThe link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
UpdatedThe link-log plugin before 2.1 for WordPress has SQL injection.
UpdatedThe wp-rollback plugin before 1.2.3 for WordPress has CSRF.
UpdatedThe wp-rollback plugin before 1.2.3 for WordPress has XSS.
UpdatedThe wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
UpdatedThe wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
UpdatedThe wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
UpdatedThe wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
UpdatedThe profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
UpdatedThe clean-login plugin before 1.5.1 for WordPress has reflected XSS.
UpdatedThe limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.
UpdatedThe email-newsletter plugin through 20.15 for WordPress has SQL injection.
UpdatedThe cforms2 plugin before 14.6.10 for WordPress has SQL injection.
UpdatedThe uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
UpdatedThe wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Updated- CVE-2015-9330: The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. Unscored
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Updated The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
UpdatedThe profile-builder plugin before 2.2.5 for WordPress has XSS.
UpdatedThe flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.
UpdatedThe wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
UpdatedThe visitors-online plugin before 0.4 for WordPress has SQL injection.
Updated- CVE-2015-9324: The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. Unscored
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Updated The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Updated- CVE-2015-9322: The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. Unscored
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Updated - CVE-2015-9321: The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. Unscored
The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.
Updated - CVE-2015-9320: The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. Unscored
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Updated The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
UpdatedThe awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
UpdatedThe awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
UpdatedThe wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.
UpdatedThe newstatpress plugin before 1.0.1 for WordPress has SQL injection.
UpdatedThe newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
UpdatedThe newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Updated- CVE-2015-9312: The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element. Unscored
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.
Updated The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
UpdatedThe wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.
UpdatedThe wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.
UpdatedThe wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.
UpdatedThe wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.
UpdatedThe wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Updated- CVE-2015-9304: The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input. Unscored
The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Updated The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
UpdatedThe simple-fields plugin before 1.4.11 for WordPress has XSS.
UpdatedThe liveforms plugin before 3.2.0 for WordPress has SQL injection.
Updated- CVE-2015-9300: The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues. Unscored
The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.
Updated The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.
UpdatedThe events-manager plugin before 5.6 for WordPress has code injection.
UpdatedThe events-manager plugin before 5.6 for WordPress has XSS.
UpdatedThe download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
UpdatedThe contact-form-plugin plugin before 3.96 for WordPress has XSS.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.
Updated6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).
UpdatedcPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).
UpdatedIn FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of cur and limit are sensible before going to Again.
UpdatedIn the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
UpdatedThe Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
UpdatedDirectory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdP's HTTP response message ("WLS-Response") can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is therefore trivial. The "kid" field should only ever represent an integer. However, it is possible to pr
Updated- CVE-2015-9286: Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS. Unscored
Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
Updated esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.
UpdatedThe request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
UpdatedThe Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
UpdatedLogon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.
UpdatedMailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
UpdatedMailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
UpdatedMailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-change request.
UpdatedMailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../" and "/.. /" are mishandled.
UpdatedSmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.
Updated- CVE-2015-9275: ARC 5.21q allows directory traversal via a full pathname in an archive file. Unscored
ARC 5.21q allows directory traversal via a full pathname in an archive file.
Updated HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
UpdatedThe wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
UpdatedThe videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
UpdatedThe VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
UpdatedXSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
UpdatedThe export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.
UpdatedNullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.
UpdatedNullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program.
UpdatedThe web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions a
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14622. Reason: This candidate is a reservation duplicate of CVE-2018-14622. Notes: All CVE users should reference CVE-2018-14622 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Updated · Rejected recordLansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
UpdatedAn issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute arbitrary OS commands.
Updated_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Updatedhuft_build in archival/libarchive/decompress_gunzip.c in BusyBox before 1.27.2 misuses a pointer, causing segfaults and an application crash during an unzip operation on a specially crafted ZIP file.
UpdatedAn issue was discovered in BEdita before 3.7.0. A cross-site scripting (XSS) attack occurs via a crafted pages/showObjects URI, as demonstrated by appending a payload to a pages/showObjects/2/0/0/leafs URI.
UpdatedIn Docker Notary before 0.1, the checkRoot function in gotuf/client/client.go does not check expiry of root.json files, despite a comment stating that it does. Even if a user creates a new root.json file after a key compromise, an attacker can produce update files referring to an old root.json file.
UpdatedIn Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
UpdatedBMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS.
UpdatedDatto ALTO and SIRIS devices allow remote attackers to obtain sensitive information via access to device/VM restore mount points, because they do not have ACLs by default.
UpdatedDatto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.
UpdatedDatto ALTO and SIRIS devices have a default VNC password.
UpdatedAn issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs,
UpdatedAn issue was discovered in QPDF before 7.0.0. Endless recursion causes stack exhaustion in QPDFTokenizer::resolveLiteral() in QPDFTokenizer.cc, related to the QPDF::resolve function in QPDF.cc.
UpdatedjQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Updated