36252 matches found
CVE-2015-9457
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::listlinks SQL injection via the group parameter...
CVE-2015-9457
CVE-2015-9457 : The WordPress "pretty-link" plugin (before 1.6.8) contains a SQL injection in PrliLinksController::list_links that is exploitable via the group parameter. Public sources in connected documents confirm this as an authenticated SQL injection vulnerability affecting Pretty Link plugi...
CVE-2018-1000156
GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITORPROGRAM invocation using ed can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's...
Puppet Enterprise < 2015.3.1 Information Disclosure Vulnerability
According to its self-reported version number, the Puppet install on the remote host is affected by an information disclosure vulnerability. An unauthenticated, unpriviledged remote attacker can cause a user to send jsessionid cookies in plain text, allowing the attacker the ability to potentiall...
Puppet Enterprise < 2015.3.0 Information Disclosure Vulnerability
According to its self-reported version number, the Puppet install on the remote host is affected by an information disclosure vulnerability. An unauthenticated, unpriviledged remote attacker can cause a user to send jsessionid cookies in plain text, allowing the attacker the ability to potentiall...
Puppet Enterprise 2015.x / 2016.x < 2016.4.0 Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x or 2016.x prior to 2016.4.0. It is, therefore, affected by the following vulnerabilities : - A cross-site redirection vulnerability exists within the /auth/login script du...
Puppet Enterprise 2015.x < 2015.3.3 Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x prior to 2015.3.3. It is, therefore, affected by the following vulnerabilities : - A invalid validation of the server certificate by the pxp-agent. An unauthenticated,...
Puppet Enterprise 2015.x < 2016.4.0 Denial of Service Vulnerability
According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2017.2.2. It is, therefore, affected by a denial of service DoS vulnerability which exists in the puppet communications protocol broker due to incorrect validation of message...
Puppet Enterprise < 2016.2.1 Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application running on the remote host is version prior to 2016.2.1. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the mcollective puppet-agent plugin due to an...
CVE-2015-9450
creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:33+00:00| seen| https://t.me/cibsecurity/7272...
CVE-2015-9451
creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:32+00:00| seen| https://t.me/cibsecurity/7271...
CVE-2015-9452
creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:28+00:00| seen| https://t.me/cibsecurity/7270...
CVE-2015-9454
creationtimestamp| type| source ---|---|--- 2019-10-08 15:49:27+00:00| seen| https://t.me/cibsecurity/7268...
CVE-2015-9452
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...
CVE-2015-9456
The CVE concerns the WordPress plugin “orbisius-child-theme-creator” (before version 1.2.8). The issue is incorrect access control on file modification via wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file with parameters theme_1, theme_1_file, or theme_1_file_conten...
CVE-2015-9455
The CVE-2015-9455 issue affects the WordPress plugin buddypress-activity-plus (before 1.6.2). The vulnerability is a CSRF leading to directory traversal via the wp-admin/admin-ajax.php parameter bpfb_photos[] in the action bpfb_remove_temp_images . This can enable an attacker to traverse director...
CVE-2015-9454
The CVE corresponds to a SQL Injection in the WordPress Smooth Slider plugin (versions before 2.7). The vulnerability is triggered via the admin page parameter current_slider_id on wp-admin/admin.php?page=smooth-slider-admin, with the issue reported by multiple sources; CVSS data in the NVD shows...
CVE-2015-9453
The CVE concerns the WordPress Broken Link Manager plugin, affected versions before 0.6.0. Root cause: the plugin does not properly validate or sanitize input via HTTP Referer or User‑Agent headers when requests target a non-existent URL, enabling cross‑site scripting. Impact: attacker can inject...
CVE-2015-9452
CVE-2015-9452 affects the WordPress plugin nex-forms-express-wp-form-builder prior to version 4.6.1, with an SQL injection vulnerability exploitable via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. The issue is documented across multiple sources; CVSS shows high to critical ...