CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 3CVE-2007-1277 – WordPress Core 2.2.1 - Backdoor
https://notcve.org/view.php?id=CVE-2007-1277
WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to execute arbitrary commands via (1) an eval injection vulnerability in the ix parameter to wp-includes/feed.php, and (2) an untrusted passthru call in the iz parameter to wp-includes/theme.php. WordPress 2.1.1, descargado desde algunos sitios de distribución oficial durante febrero y marzo de 2007, contiene una puerta trasera introducida externamente que permite a atacantes remotos ejecutar comandos de su elección mediante (1) una vulnerabilidad de inyección en eval en el parámetro ix de wp-includes/feed.php, y (2) una llamada a passthru no confiable en el parámetro iz de wp-includes/theme.php. • https://www.exploit-db.com/exploits/29702 https://www.exploit-db.com/exploits/29701 http://ifsec.blogspot.com/2007/03/wordpress-code-compromised-to-enable.html http://secunia.com/advisories/24374 http://wordpress.org/development/2007/03/upgrade-212 http://www.kb.cert.org/vuls/id/214480 http://www.kb.cert.org/vuls/id/641456 http://www.securityfocus.com/archive/1/461794/100/0/threaded http://www.securityfocus.com/bid/22797 http://www.vupen.com/english/advisories&#x • CWE-20: Improper Input Validation CWE-506: Embedded Malicious Code •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1230 – WordPress Core <= 2.1.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1230
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en wp_includes/functions.php de WordPress anterior a 2.1.2-alpha permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de (1)la acbecera HTTP Referer o (2) el URI, una vulnerabilidad distinta de CVE-2007-1049. • http://osvdb.org/34361 http://secunia.com/advisories/24566 http://trac.wordpress.org/changeset/4951 http://trac.wordpress.org/changeset/4952 http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml http://www.vupen.com/english/advisories/2007/0756 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 5%CPEs: 1EXPL: 2CVE-2007-1244 – WordPress Core <= 2.1.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1244
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el AdminPanel en WordPress 2.1.1 y anteriores permite a atacantes remotos realizar acciones privilegiadas como administradores, como se demostró con el uso de una acción de borrado en wp-admin/post.php. NOTA: este asunto podría estar apalancado en los ataques de secuencias de comandos en sitios cruzados (XSS) y robar cookies a través del parámetro post. • https://www.exploit-db.com/exploits/29682 http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0583.html http://osvdb.org/33787 http://osvdb.org/33788 http://secunia.com/advisories/24566 http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml http://www.securityfocus.com/archive/1/461351/100/0/threaded http://www.securityfocus.com/bid/22735 https://exchange.xforce.ibmcloud.com/vulnerabilities/32703 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 1%CPEs: 23EXPL: 2CVE-2007-1049 – WordPress Core < 2.09 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1049
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función wp_explain_nonce de la funcionalidad nonce AYS (wp-includes/functions.php) para WordPress 2.0 anterior a 2.0.9 y 2.1 anterior a 2.1.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante el parámetro file a wp-admin/templates.php, y posiblemente otros vectores que implican la variable action. • https://www.exploit-db.com/exploits/29598 http://downloads.securityfocus.com/vulnerabilities/exploits/22534.html http://osvdb.org/33766 http://secunia.com/advisories/24306 http://secunia.com/advisories/24566 http://trac.wordpress.org/changeset/4876 http://trac.wordpress.org/changeset/4877 http://trac.wordpress.org/ticket/3781 http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml http://www.securityfocus.com/bid/22534 http://www.vupen.com/english/advisories/2007/0741 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2011-0700 – WordPress Core <= 3.0.4 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-0700
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Wordpress en versiones anteriores a v3.0.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) Quick/Bulk Edit title (también conocido como post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, y (5)saliendo de tags sin usar tags meta box . • http://codex.wordpress.org/Version_3.0.5 http://core.trac.wordpress.org/changeset/17397 http://core.trac.wordpress.org/changeset/17401 http://core.trac.wordpress.org/changeset/17406 http://core.trac.wordpress.org/changeset/17412 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056412.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056998.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/057003.html http://openwall.com/lists&#x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •