CVE-2015-9396

The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS...

CVE-2015-9396

The CVE-2015-9396 entry documents a reflected XSS in the WordPress plugin Auto ThickBox Plus (

CVE-2015-9395

The CVE-2015-9395 entry concerns the WordPress Users Ultra plugin (before version 1.5.64). The vulnerability is an SQL Injection via an AJAX action in this plugin. Public sources (NVD) report high impact with CVSS v3.1 metrics: Network attack vector, no user interaction, privileges required Low, ...

CVE-2015-9394

The CVE concerns the WordPress plugin Users Ultra Membership (plugin) before 1.5.63. A CSRF vulnerability exists via action=package_add_new to wp-admin/admin-ajax.php, enabling an attacker to perform actions on behalf of authenticated users. Exploitation details are not provided beyond the CSRF d...

CVE-2015-9393

CVE-2015-9393 affects the WordPress Users Ultra plugin prior to 1.5.63, where the p_desc parameter is vulnerable to cross-site scripting (XSS). The vulnerability is confirmed across multiple sources (NVD entry and Red Hat, with WPVulndb/PRION and CVE lists reiterating the same issue). Impact rang...

CVE-2015-9392

The CVE-2015-9392 case affects the WordPress plugin Users Ultra before version 1.5.63 , where processing of the parameter p_name enables a cross-site scripting (XSS ) vulnerability. This is reported as an XSS issue in multiple sources (NVD description mentions XSS via p_name; related records refe...

CVE-2015-9391

CVE-2015-9391 affects the WordPress yawpp plugin up to version 1.2.2. The vulnerability is an XSS condition caused by the field1 parameter, reported as an unauthenticated stored XSS in multiple sources. Connected documents describe the issue as a stored XSS vector in yawpp, with PoCs indicating c...

CVE-2015-9390

CVE-2015-9390 affects the WordPress plugin Admin Management Xtended prior to version 2.4.0.1. The vulnerability is a privilege escalation caused by mishandling of wp_ajax functions. Exploit details are not provided in the supplied documents. No explicit remediation/version fix is listed in the av...

CVE-2015-9389

The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name...

CVE-2015-9389

CVE-2015-9389 affects the mTouch Quiz WordPress plugin prior to version 3.1.3 , with XSS via the quiz name . The vulnerability is described in multiple sources as a client‑side/script injection issue in the plugin’s quiz name field, enabling cross‑site scripting. The supplied connected documents ...

CVE-2015-9386

The CVE-2015-9386 entry concerns the mtouch-quiz WordPress plugin, affected in versions before 3.1.3. The provided documents describe an XSS vulnerability via the quiz parameter during a Quiz Manage operation. This is supported by multiple sources (NVD entry notes XSS in mtouch-quiz before 3.1.3;...

CVE-2015-9387

The CVE-2015-9387 entry concerns the mTouch Quiz WordPress plugin prior to version 3.1.3. The root cause is a cross-site request forgery (CSRF) vulnerability in wp-admin/options-general.php, which could allow an attacker to induce an administrator’s browser to perform unwanted actions on the Word...

CVE-2015-9384

The relevant plugin before 1.0.8 for WordPress has XSS...

CVE-2015-9384

The CVE-2015-9384 entry concerns the WordPress plugin named “relevant” prior to version 1.0.8, which contains a Cross-Site Scripting (XSS) flaw in its input handling. The vulnerability enables crafted data to be reflected into user pages, with impact described as partial integrity and low confide...

EulerOS Virtualization for ARM 64 3.0.2.0 : libarchive (EulerOS-SA-2019-1954)

According to the version of the libarchive package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The archivestringappend function in archivestring.c in libarchive before 3.2.0 allows remote attackers to cause a deni...

EulerOS Virtualization for ARM 64 3.0.2.0 : icu (EulerOS-SA-2019-1946)

According to the versions of the icu package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java ...

EulerOS 2.0 SP2 : perl (EulerOS-SA-2019-1864)

According to the version of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The 1 Sreghop3, 2 Sreghop4, and 3 Sreghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of...

EulerOS 2.0 SP2 : gd (EulerOS-SA-2019-1842)

According to the version of the gd package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder...

EulerOS 2.0 SP2 : squashfs-tools (EulerOS-SA-2019-1871)

According to the versions of the squashfs-tools package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Integer overflow in the readfragmenttable4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial o...

[SECURITY] [DLA 1923-1] ansible security update

Package : ansible Version : 1.7.2+dfsg-2+deb8u2 CVE ID : CVE-2015-3908 CVE-2015-6240 CVE-2018-10875 CVE-2019-10156 Debian Bug : 930065 Several vulnerabilities were discovered in Ansible, a configuration management, deployment, and task execution system. CVE-2015-3908 A potential man-in-the-middle...