CVE-2015-9286

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS...

CVE-2015-5601

edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .tar.gz files...

CVE-2015-1204

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

CVE-2015-9321

The shortcode-factory plugin before 1.1.1 for WordPress has XSS via addqueryarg...

CVE-2015-6519

SQL injection vulnerability in Arab Portal 3 allows remote attackers to execute arbitrary SQL commands via the showemail parameter in a signup action to members.php...

CVE-2015-6914

Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx...

CVE-2015-9498

The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value...

CVE-2015-9497

The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php...

CVE-2015-9437

The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...

CVE-2015-1618

The ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL...

CVE-2016-11053

An issue was discovered on Samsung mobile devices with software through 2015-11-11 supporting FRP/RL. There is a Factory Reset Protection FRP bypass. The Samsung ID is SVE-2015-5131 January 2016...

CVE-2015-3028

McAfee Advanced Threat Defense MATD before 3.4.4.63 allows remote authenticated users to bypass intended restrictions and change or update configuration settings via crafted parameters...

CVE-2015-9292

6kbbs 7.1 and 8.0 allows CSRF via portalchannelajax.php id or code parameter or admin.php fileids parameter...

CVE-2015-9495

The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier...

CVE-2015-7603

Directory traversal vulnerability in Konica Minolta FTP Utility 1.0 allows remote attackers to read arbitrary files via a ..\ dot dot backslash in a RETR command...

CVE-2015-9384

The relevant plugin before 1.0.8 for WordPress has XSS...

CVE-2015-9377

iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9470

The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter...

CVE-2015-9345

The link-log plugin before 2.0 for WordPress has HTTP Response Splitting...

CVE-2015-6969

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...