|
266611
|
6.1 |
MEDIUM
Network
|
wp-slimstat
|
slimstat_analytics
|
The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.
|
CWE-79
Cross-site Scripting
|
CVE-2015-9273
|
2024-11-21 11:40 |
2018-10-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266612
|
9.8 |
CRITICAL
Network
|
videowhisper
|
video_presentation
|
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four charact…
|
CWE-94
Code Injection
|
CVE-2015-9272
|
2024-11-21 11:40 |
2018-10-5 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266613
|
9.8 |
CRITICAL
Network
|
videowhisper
|
video_conference
|
The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2015-9271
|
2024-11-21 11:40 |
2018-10-5 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266614
|
6.1 |
MEDIUM
Network
|
theholidaycalendar
|
holiday_calendar
|
XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
|
CWE-79
Cross-site Scripting
|
CVE-2015-9270
|
2024-11-21 11:40 |
2018-10-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266615
|
7.5 |
HIGH
Network
|
wpmobilepack
|
wordpress_mobile_pack
|
The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a…
|
CWE-200
Information Exposure
|
CVE-2015-9269
|
2024-11-21 11:40 |
2018-10-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266616
|
7.8 |
HIGH
Local
|
nullsoft
debian
|
nullsoft_scriptable_install_system
debian_linux
|
Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the depend…
|
CWE-20
Improper Input Validation
|
CVE-2015-9268
|
2024-11-21 11:40 |
2018-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266617
|
5.5 |
MEDIUM
Local
|
nullsoft
debian
|
nullsoft_scriptable_install_system
debian_linux
|
Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or th…
|
CWE-269
Improper Privilege Management
|
CVE-2015-9267
|
2024-11-21 11:40 |
2018-10-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266618
|
9.8 |
CRITICAL
Network
|
ui
ubnt
|
airmax_ac_firmware
airmax_m_xm_firmware
airmax_m_xw_firmware
airmax_m_ti_firmware
airgateway_firmware
airfiber_af24_firmware
airfiber_af24hd_firmware
af5x_firmware
af5_firmwar…
|
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory t…
|
CWE-22
Path Traversal
|
CVE-2015-9266
|
2024-11-21 11:40 |
2018-09-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266619
|
9.8 |
CRITICAL
Network
|
lansweeper
|
lansweeper
|
Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service.
|
CWE-20
Improper Input Validation
|
CVE-2015-9264
|
2024-11-21 11:40 |
2018-08-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
266620
|
9.8 |
CRITICAL
Network
|
idera
|
uptime_infrastructure_monitor
|
An issue was discovered in post2file.php in Up.Time Monitoring Station 7.5.0 (build 16) and 7.4.0 (build 13). It allows an attacker to upload an arbitrary file, such as a .php file that can execute a…
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2015-9263
|
2024-11-21 11:40 |
2018-08-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
