CVE-2012-0760

The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764,...

CVE-2015-9369

Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2012-4399

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity XXE injection attack...

CVE-2017-16358

In radare 2.0.1, an out-of-bounds read vulnerability exists in stringscanrange in libr/bin/bin.c when doing a string search...

CVE-2012-4974

Layton Helpbox 4.4.0 allows remote authenticated users to change the login context and gain privileges via a modified 1 loggedinenduser, 2 loggedinendusername, 3 loggedinuserusergroup, 4 loggedinuser, or 5 loggedinusername cookie...

CVE-2010-5181

Race condition in VIPRE Antivirus Premium 4.0.3272 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during...

CVE-2015-9533

The Easy Digital Downloads EDD Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2012-0311

Cross-site scripting XSS vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-5164

Race condition in KingSoft Personal Firewall 9 Plus 2009.05.07.70 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory chang...

CVE-2011-1223

Buffer overflow in the Alternate Data Stream aka ADS or named stream functionality in the backup-archive client in IBM Tivoli Storage Manager TSM before 5.4.3.4, 5.5.x before 5.5.3, 6.x before 6.1.4, and 6.2.x before 6.2.2 on Windows allows local users to gain privileges via unspecified vectors...

CVE-2014-5011

DOMPDF before 0.6.2 allows Information Disclosure...

CVE-2013-3949

The posixspawn system call in the XNU kernel in Apple Mac OS X 10.8.x does not prevent use of the POSIXSPAWNDISABLEASLR and POSIXSPAWNALLOWDATAEXEC flags for setuid and setgid programs, which allows local users to bypass intended access restrictions via a wrapper program that calls the...

CVE-2015-9404

The neuvoo-jobroll plugin 2.0 for WordPress has neuvookeywords XSS...

CVE-2017-20041

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title leads to improper restriction of rendered ui layers URL. It is possible to launch the attack remotely...

CVE-2011-5301

Multiple cross-site scripting XSS vulnerabilities in PHPDug 2.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the storyurl parameter to addstory.php, 2 the email parameter to editprofile.php, 3 the title parameter to adm/contentadd.php, or 4 the username parameter to...

CVE-2011-5286

SQL injection vulnerability in social-slider-2/ajax.php in the Social Slider plugin before 7.4.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the rA array parameter...

CVE-2011-5237

PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2011-5193

Cross-site scripting XSS vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different vulnerability than...

CVE-2017-18508

The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS...

CVE-2010-5141

wxBitcoin and bitcoind before 0.3.5 do not properly handle script opcodes in Bitcoin transactions, which allows remote attackers to spend bitcoins owned by other users via unspecified vectors...