CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2018-20149 – WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads
https://notcve.org/view.php?id=CVE-2018-20149
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data. En WordPress, en versiones anteriores a la 4.9.9 y versiones 5.x anteriores a la 5.0.1, cuando se emplea el servidor HTTP de Apache, los autores podrían subir archivos arbitrarios que omiten las restricciones de tipo MIME planeadas, lo que conduce a Cross-Site Scripting (XSS). Esto queda demostrado por un archivo .jpg sin datos JPEG. • http://www.securityfocus.com/bid/106220 https://codex.wordpress.org/Version_4.9.9 https://github.com/WordPress/WordPress/commit/246a70bdbfac3bd45ff71c7941deef1bb206b19a https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release https://wordpress.org/support/wordpress-version/version-5-0-1 https://wpvulndb.com/vulnerabilities/9175 https://www.debian.org/security/2019/dsa-4401 https://www.zdnet.com/article/wordpress- • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2018-19296
https://notcve.org/view.php?id=CVE-2018-19296
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. PHPMailer en versiones anteriores a la 5.2.27 y versiones 6.x anteriores a la 6.0.6 es vulnerable a un ataque de inyección de objetos. • https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27 https://github.com/PHPMailer/PHPMailer/releases/tag/v6.0.6 https://lists.debian.org/debian-lts-announce/2018/12/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3B5WDPGUFNPG4NAZ6G4BZX43BKLAVA5B https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPU66INRFY5BQ3ESVPRUXJR4DXQAFJVT https://www.debian.org/security/2018/dsa-4351 • CWE-502: Deserialization of Untrusted Data CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000773 – WordPress Core < 5.0.1 - PHAR Unserialization
https://notcve.org/view.php?id=CVE-2018-1000773
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. WordPress en versiones 4.9.8 y anteriores contiene una vulnerabilidad de validación de entradas (CWE-20) en el procesamiento de miniaturas que puede resultar en la ejecución remota de código. Esto se debe a una solución incompleta para CVE-2017-1000600. El ataque parece ser explotable mediante una miniatura subida por un usuario autenticado y podría requerir plugins adicionales para su explotación. • http://www.securityfocus.com/bid/105306 https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln https://youtu.be/GePBmsNJw6Y?t=1763 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000600 – WordPress Core < 4.9 - Insecure Deserialization
https://notcve.org/view.php?id=CVE-2017-1000600
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely fixed in WordPress 4.9 WordPress en versiones anteriores a la 4.9 contiene una vulnerabilidad de validación de entradas (CWE-20) en el procesamiento de miniaturas que puede resultar en la ejecución remota de código. El ataque parece ser explotable mediante una miniatura subida por un usuario autenticado y podría requerir plugins adicionales para su explotación. Sin embargo, esto aún no ha sido confirmado. • http://www.securityfocus.com/bid/105305 https://www.theregister.co.uk/2018/08/20/php_unserialisation_wordpress_vuln https://youtu.be/GePBmsNJw6Y?t=1763 • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.2EPSS: 19%CPEs: 1EXPL: 0CVE-2018-14028 – WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload
https://notcve.org/view.php?id=CVE-2018-14028
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins. En WordPress 4.9.7, los plugins subidos mediante el área de admin no se verifican como archivos ZIP. • http://www.securityfocus.com/bid/105060 https://core.trac.wordpress.org/ticket/44710 https://github.com/rastating/wordpress-exploit-framework/pull/52 https://rastating.github.io/unrestricted-file-upload-via-plugin-uploader-in-wordpress • CWE-434: Unrestricted Upload of File with Dangerous Type •