CVE

Id
70133  
CVE No.
CVE-2014-2838  
Status
Candidate  
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.  
Phase
Assigned (20140410)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
668794 70133 CVE-2014-2838 FULLDISC:20140328 XSS, CSRF and blind SQL injection in GD Star Rating 1.9.22 (WordPress plugin)  View
668795 70133 CVE-2014-2838 URL:http://seclists.org/fulldisclosure/2014/Mar/399  View
668796 70133 CVE-2014-2838 SECUNIA:57667  View
668797 70133 CVE-2014-2838 URL:http://secunia.com/advisories/57667  View
668798 70133 CVE-2014-2838 XF:gdstart-wordpress-sql-injection(92156)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
13418 JVNDB-2014-002293 WD Arkeia Virtual Appliance のファームウェアの opt/arkeia/wui/htdocs/index.php におけるディレクトリトラバーサルの脆弱性 WD Arkeia Virtual Appliance (AVA) のファームウェアの opt/arkeia/wui/htdocs/index.php には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2014-2846 70133 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002293.html  View