CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16218 – WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-16218
WordPress before 5.2.3 allows XSS in stored comments. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en los comentarios almacenados. • https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html https://seclists.org/bugtraq/2020/Jan/8 https://wordpress.org/news/2019/09/wordpress-5-2-3-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/9861 https://www.debian.org/security/2020/dsa-4599 https://www.debian.org/security/2020/dsa-4677 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 47%CPEs: 1EXPL: 2CVE-2019-9787 – WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php. WordPress, en versiones anteriores a la 5.1.1, no filtra correctamente el contenido, lo que conduce a la ejecución remota de código por parte de usuarios no autenticados en una configuración por defecto. • https://github.com/dexXxed/CVE-2019-9787 http://www.securityfocus.com/bid/107411 https://blog.ripstech.com/2019/wordpress-csrf-to-rce https://github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b https://lists.debian.org/debian-lts-announce/2019/03/msg00044.html https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release https://wordpress.org/support/wordpress-version/version-5-1-1 https://wpvulndb.com/vulnerabilities/9230 https://www.debian.org& • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 90%CPEs: 1EXPL: 7CVE-2019-8943 – WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion
https://notcve.org/view.php?id=CVE-2019-8943
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. WordPress hasta la versión 5.0.3 permite saltos de directorio en wp_crop_image(). • https://www.exploit-db.com/exploits/46662 https://www.exploit-db.com/exploits/46511 https://github.com/v0lck3r/CVE-2019-8943 http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html http://packetstormsecurity.com/files/161213/WordPress-5.0.0-Remote-Code-Execution.html http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce http://www.securityfocus.com/bid/107089 https://blog.ripstech.com/2019/wordpress-image-remote-code-execution • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 8.8EPSS: 94%CPEs: 11EXPL: 8CVE-2019-8942 – WordPress Core < 5.0.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8942
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. WordPress, en versiones anteriores a la 4.99 y en las 5.x anteriores a la 5.0.1, permite la ejecución remota de código debido a que una entrada "Post Meta" _wp_attached_file puede modificarse a una cadena arbitraria, como uno que termina en una subcadena ".jpg? • https://www.exploit-db.com/exploits/46662 https://www.exploit-db.com/exploits/46511 https://github.com/synacktiv/CVE-2019-8942 https://github.com/tuannq2299/CVE-2019-8942 http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce http://www.securityfocus.com/bid/107088 https://blog.ripstech.com/2019/wordpress-image-remote-code-execution https://lists.debian.org/debian-lts-announce/2 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-20151 – WordPress Core < 5.0.1 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2018-20151
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default. En WordPress, en versiones anteriores a la 4.9.9 y versiones 5.x anteriores a la 5.0.1, la página de activación de usuarios podría ser leída por el crawler web de un motor de búsqueda si se elige una configuración inusual. El motor de búsqueda podría listar y mostrar la dirección de email de un usuario y (raramente) la contraseña que se generó por defecto. • http://www.securityfocus.com/bid/106220 https://codex.wordpress.org/Version_4.9.9 https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release https://wordpress.org/support/wordpress-version/version-5-0-1 https://wpvulndb.com/vulnerabilities/9174 https://www.debian.org/security/2019/dsa-4401 https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •