CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2015-9434 – Logo Carousel < 1.7.2 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9434
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter. El plugin kiwi-logo-carousel versiones anteriores a 1.7.2 para WordPress, presenta una vulnerabilidad de tipo CSRF con un XSS resultante por medio del parámetro tab o tab_flags_order de wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings. The Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp-admin/edit.php? • http://cinu.pl/research/wp-plugins/mail_3764bb40db5ed12aac2c7812d7544730.html https://wordpress.org/plugins/kiwi-logo-carousel/#developers https://wpvulndb.com/vulnerabilities/8290 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17532
https://notcve.org/view.php?id=CVE-2017-17532
examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. examples/framework/news/news3.py en Kiwi 1.9.22 no valida cadenas antes de iniciar el programa especificado por la variable de entorno BROWSER. Esto podría permitir que atacantes remotos lleven a cabo ataques de inyección de argumentos mediante una URL manipulada. • https://security-tracker.debian.org/tracker/CVE-2017-17532 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •