>> ARCHIVE: 2016-04

Virtual Freer version 1.58 suffers from a cross site scripting vulnerability.

WordPress Scoreme theme suffers from a cross site scripting vulnerability.

WordPress Advanced Video plugin version 1.0 suffers from a local file inclusion vulnerability.

Xion Audio Player versions 1.5 build 160 and below local proof of concept crash exploit.

Mautic version 1.3.0 suffers from cross site request forgery, denial of service, user enumeration, and cross site scripting vulnerabilities.

Microsoft Internet Explorer suffers from a MSHTML!CSVGHelpers::SetAttributeStringAndPointer use-after-free vulnerability.

BugCrowd’s file upload allows for CSVs that may have malicious formulas in them.

Techsoft Web Solutions CMS version 2016 Q2 suffers from a remote SQL injection vulnerability.

FortiManager and FortiAnalyzer version 5.x suffer from a client-side malicious script insertion vulnerability.

ManageEngine Password Manager Pro builds 8.1 through 8.3 suffer from bypass, cross site request forgery, privilege escalation, user enumeration, and cross site scripting vulnerabilities.