Puppet Enterprise 2015.x / 2016.x < 2016.4.0 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x or 2016.x prior to 2016.4.0. It is, therefore, affected by the following vulnerabilities : - A cross-site redirection vulnerability exists within the /auth/login script du...

Puppet Enterprise 2015.x < 2015.3.3 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x prior to 2015.3.3. It is, therefore, affected by the following vulnerabilities : - A invalid validation of the server certificate by the pxp-agent. An unauthenticated,...

Puppet Enterprise 2015.x < 2016.4.0 Denial of Service Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2017.2.2. It is, therefore, affected by a denial of service DoS vulnerability which exists in the puppet communications protocol broker due to incorrect validation of message...

Puppet Enterprise < 2015.3.1 Information Disclosure Vulnerability

According to its self-reported version number, the Puppet install on the remote host is affected by an information disclosure vulnerability. An unauthenticated, unpriviledged remote attacker can cause a user to send jsessionid cookies in plain text, allowing the attacker the ability to potentiall...

CVE-2015-9450

creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:33+00:00| seen| https://t.me/cibsecurity/7272...

CVE-2015-9451

creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:32+00:00| seen| https://t.me/cibsecurity/7271...

CVE-2015-9452

creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:28+00:00| seen| https://t.me/cibsecurity/7270...

CVE-2015-9454

creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:27+00:00| seen| https://t.me/cibsecurity/7268...

CVE-2015-9452

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2015-9456

The CVE concerns the WordPress plugin “orbisius-child-theme-creator” (before version 1.2.8). The issue is incorrect access control on file modification via wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file with parameters theme_1, theme_1_file, or theme_1_file_conten...

CVE-2015-9455

The CVE-2015-9455 issue affects the WordPress plugin buddypress-activity-plus (before 1.6.2). The vulnerability is a CSRF leading to directory traversal via the wp-admin/admin-ajax.php parameter bpfb_photos[] in the action bpfb_remove_temp_images . This can enable an attacker to traverse director...

CVE-2015-9454

The CVE corresponds to a SQL Injection in the WordPress Smooth Slider plugin (versions before 2.7). The vulnerability is triggered via the admin page parameter current_slider_id on wp-admin/admin.php?page=smooth-slider-admin, with the issue reported by multiple sources; CVSS data in the NVD shows...

CVE-2015-9453

The CVE concerns the WordPress Broken Link Manager plugin, affected versions before 0.6.0. Root cause: the plugin does not properly validate or sanitize input via HTTP Referer or User‑Agent headers when requests target a non-existent URL, enabling cross‑site scripting. Impact: attacker can inject...

CVE-2015-9452

CVE-2015-9452 affects the WordPress plugin nex-forms-express-wp-form-builder prior to version 4.6.1, with an SQL injection vulnerability exploitable via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. The issue is documented across multiple sources; CVSS shows high to critical ...

CVE-2015-9451

The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfbmailchimp pmfbtid parameter...

CVE-2015-9451

The CVE-2015-9451 entry concerns the WordPress plugin plugmatter-optin-feature-box-lite (before 2.0.14). The vulnerability is an SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter, affecting unauthenticated users and potentially enabling unauthorized access to ...

CVE-2015-9450

The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfbcc pmfbtid parameter...

CVE-2015-9450

Summary: The plugmatter-optin-feature-box-lite WordPress plugin is affected by an SQL injection vulnerability in versions before 2.0.14, exploitable via the request parameter wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid. This is documented across CVE/NVD records and corroborated by other datab...

CVE-2015-7873

The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...

[ASA-201910-4] ruby-rdoc: cross-site scripting

Arch Linux Security Advisory ASA-201910-4 ========================================= Severity: Medium Date : 2019-10-02 CVE-ID : CVE-2012-6708 CVE-2015-9251 Package : ruby-rdoc Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1041 Summary ======= The package...