CVE-2015-9463

The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter...

CVE-2015-9470

CVE-2015-9470 concerns the WordPress history-collection plugin (

CVE-2015-9469

CVE-2015-9469 — WordPress Content Grabber 1.0 XSS . The WordPress plugin content-grabber (version 1.0) is vulnerable to cross-site scripting via the fields obj_field_name or obj_field_id. Multiple sources (NVD, Red Hat, CNVD, CVE lists, and WPVulnDB) corroborate an XSS vulnerability affecting thi...

CVE-2015-9469

The content-grabber plugin 1.0 for WordPress has XSS via objfieldname or objfieldid...

CVE-2015-9468

The CVE-2015-9468 entry concerns the WordPress Broken Link Manager plugin v0.4.5, which is vulnerable to cross-site scripting (XSS) via the page parameter in a delURL action. This vulnerability is documented across multiple sources (NVD/NVD-derived entries and related advisories) and is tied to t...

CVE-2015-9467

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...

CVE-2015-9467

The CVE-2015-9467 vulnerability affects the WordPress Broken Link Manager plugin (before 0.5.0). The root cause is an SQL injection via the url parameter using the wpslDelURL or wpslEditURL vectors, enabling an attacker to execute arbitrary SQL commands. References (NVD/Red Hat/CNVD) corroborate ...

CVE-2015-9465

CVE-2015-9465 affects the WordPress plugin Yet Another Stars Rating (yasr) prior to version 0.9.1. The vulnerability is a SQL injection in yasr_get_multi_set_values_and_field via the set_id parameter. Several sources corroborate an SQL injection issue, including records describing an Authenticate...

CVE-2015-9462

CVE-2015-9462 concerns the WordPress plugin awesome-filterable-portfolio (before 1.9). The vulnerability is an SQL injection in the function afp_get_new_category_page, exploitable via the cat_id parameter. The issue is documented across multiple sources (NVD entry referencing the same function an...

CVE-2015-9462

The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...

CVE-2015-9461

The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewportfolioitempage SQL injection via the itemid parameter...

CVE-2015-9461

The CVE-2015-9461 vulnerability concerns the WordPress plugin awesome-filterable-portfolio (before version 1.9). The issue is an SQL injection in the function afp_get_new_portfolio_item_page exploitable via the item_id parameter. Reported impact in the sources includes unsafe data handling leadin...

CVE-2015-9460

The CVE refers to CVE-2015-9460 in the WordPress Pinpoint/booking-system plugin. A SQL injection exists in the booking-system plugin before 2.1 via DOPBSPBackEndTranslation::display and the language parameter. Several connected records confirm the vulnerability, its association with the WordPress...

CVE-2015-9458

The CVE-2015-9458 entry concerns the WordPress plugin SearchTerms Tagging 2 (up to v1.535). A SQL injection is possible via the pk_stt2_db_get_popular_terms count parameter and is exploitable through CSRF, as described in multiple sources (NVD, RH/Red Hat, CNVD, PRION, CVE List, WPVulnDB). The vu...

CVE-2015-9458

The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pkstt2dbgetpopularterms count parameter exploitable via CSRF...

CVE-2015-9457

The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::listlinks SQL injection via the group parameter...

CVE-2015-9457

CVE-2015-9457 : The WordPress "pretty-link" plugin (before 1.6.8) contains a SQL injection in PrliLinksController::list_links that is exploitable via the group parameter. Public sources in connected documents confirm this as an authenticated SQL injection vulnerability affecting Pretty Link plugi...

CVE-2018-1000156

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...

Puppet Enterprise < 2016.2.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version prior to 2016.2.1. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the mcollective puppet-agent plugin due to an...

Puppet Enterprise < 2015.3.0 Information Disclosure Vulnerability

According to its self-reported version number, the Puppet install on the remote host is affected by an information disclosure vulnerability. An unauthenticated, unpriviledged remote attacker can cause a user to send jsessionid cookies in plain text, allowing the attacker the ability to potentiall...