CVSS: 7.2EPSS: 1%CPEs: 23EXPL: 2CVE-2007-1049 – WordPress Core < 2.09 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1049
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función wp_explain_nonce de la funcionalidad nonce AYS (wp-includes/functions.php) para WordPress 2.0 anterior a 2.0.9 y 2.1 anterior a 2.1.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el parámetro file a wp-admin/templates.php, y posiblemente otros vectores que implican la variable action. • https://www.exploit-db.com/exploits/29598 http://downloads.securityfocus.com/vulnerabilities/exploits/22534.html http://osvdb.org/33766 http://secunia.com/advisories/24306 http://secunia.com/advisories/24566 http://trac.wordpress.org/changeset/4876 http://trac.wordpress.org/changeset/4877 http://trac.wordpress.org/ticket/3781 http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml http://www.securityfocus.com/bid/22534 http://www.vupen.com/english/advisories/2007/0741 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2007-0476
https://notcve.org/view.php?id=CVE-2007-0476
The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack. La secuencia de comandos gencert.sh, cuando se instala OpenLDAP anterior a la 2.1.30-r10, la 2.2.x anterior a la 2.2.28-r7 y la 2.3.x anterior a la 2.3.30-r2 como en el ebuild del Gentoo Linux, no crea directorios temporales en /tmp de forma segura durante la salida, lo que permite a usuarios locales sobrescribir ficheros de su elección a través de un ataque mediante symlink. • http://osvdb.org/31617 http://secunia.com/advisories/23881 http://security.gentoo.org/glsa/glsa-200701-19.xml http://www.securityfocus.com/bid/22195 http://www.vupen.com/english/advisories/2007/0305 •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2006-3005
https://notcve.org/view.php?id=CVE-2006-3005
The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature, which could allow context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted JPEG file that exceeds the intended memory limits. • http://bugs.gentoo.org/show_bug.cgi?id=130889 http://secunia.com/advisories/20563 http://www.gentoo.org/security/en/glsa/glsa-200606-11.xml http://www.osvdb.org/26317 https://exchange.xforce.ibmcloud.com/vulnerabilities/31451 •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 2CVE-2006-1390
https://notcve.org/view.php?id=CVE-2006-1390
The configuration of NetHack 3.4.3-r1 and earlier, Falcon's Eye 1.9.4a and earlier, and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks. • http://bugs.gentoo.org/show_bug.cgi?id=122376 http://bugs.gentoo.org/show_bug.cgi?id=125902 http://bugs.gentoo.org/show_bug.cgi?id=127167 http://bugs.gentoo.org/show_bug.cgi?id=127319 http://secunia.com/advisories/19376 http://www.gentoo.org/security/en/glsa/glsa-200603-23.xml http://www.osvdb.org/24104 http://www.securityfocus.com/archive/1/428739/100/0/threaded http://www.securityfocus.com/archive/1/428743/100/0/threaded http://www.securityfocus.com&# •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2006-0071
https://notcve.org/view.php?id=CVE-2006-0071
The ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0. • http://secunia.com/advisories/18284 http://www.gentoo.org/security/en/glsa/glsa-200601-01.xml http://www.osvdb.org/22211 http://www.securityfocus.com/bid/16120 •