{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-12-02T00:00:00", "descriptions": [{"lang": "en", "value": "lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the \"Width of preview image\" and possibly other input fields in the \"Video Gallery Settings\" page."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-09T18:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.vapidlabs.com/advisory.php?v=158"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html"}, {"name": "[oss-security] 20151202 Command Injection in cool-video-gallery v1.9 Wordpress plugin", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/12/02/9"}, {"tags": ["x_refsource_MISC"], "url": "https://wpvulndb.com/vulnerabilities/8348"}, {"tags": ["x_refsource_MISC"], "url": "https://wordpress.org/support/topic/command-injection-vulnerability-in-v19"}, {"name": "20151207 Command Injection in cool-video-gallery v1.9 Wordpress plugin", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/537051/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2015-7527", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the \"Width of preview image\" and possibly other input fields in the \"Video Gallery Settings\" page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.vapidlabs.com/advisory.php?v=158", "refsource": "MISC", "url": "http://www.vapidlabs.com/advisory.php?v=158"}, {"name": "http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html"}, {"name": "[oss-security] 20151202 Command Injection in cool-video-gallery v1.9 Wordpress plugin", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/12/02/9"}, {"name": "https://wpvulndb.com/vulnerabilities/8348", "refsource": "MISC", "url": "https://wpvulndb.com/vulnerabilities/8348"}, {"name": "https://wordpress.org/support/topic/command-injection-vulnerability-in-v19", "refsource": "MISC", "url": "https://wordpress.org/support/topic/command-injection-vulnerability-in-v19"}, {"name": "20151207 Command Injection in cool-video-gallery v1.9 Wordpress plugin", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/537051/100/0/threaded"}]}}}}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2015-7527", "datePublished": "2015-12-17T19:00:00", "dateReserved": "2015-09-29T00:00:00", "dateUpdated": "2018-10-09T18:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cool_video_gallery_project:cool_video_gallery:1.9:*:*:*:*:wordpress:*:*", "matchCriteriaId": "FFCDE6AA-59D9-4670-B1B5-73654DCCD957", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the \"Width of preview image\" and possibly other input fields in the \"Video Gallery Settings\" page."}, {"lang": "es", "value": "lib/core.php en el plugin Cool Video Gallery 1.9 para WordPress permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de meta car\u00e1cteres shell en el 'Ancho de la imagen de vista previa' y posiblemente en otros campos de entrada en la p\u00e1gina 'Video Gallery Settings'."}], "id": "CVE-2015-7527", "lastModified": "2018-10-09T19:58:08.863", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-12-17T19:59:04.573", "references": [{"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://packetstormsecurity.com/files/134626/WordPress-Cool-Video-Gallery-1.9-Command-Injection.html"}, {"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://www.openwall.com/lists/oss-security/2015/12/02/9"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/archive/1/537051/100/0/threaded"}, {"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://www.vapidlabs.com/advisory.php?v=158"}, {"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "https://wordpress.org/support/topic/command-injection-vulnerability-in-v19"}, {"source": "secalert@redhat.com", "url": "https://wpvulndb.com/vulnerabilities/8348"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}