CVSS: 6.4EPSS: 1%CPEs: 9EXPL: 0CVE-2014-9031 – WordPress Core < 4.0.1 - Cross-Site Scripting via Shortcode Brackets
https://notcve.org/view.php?id=CVE-2014-9031
20 Nov 2014 — Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post. Vulnerabilidad de XSS en la función wptexturize en WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, y 3.9.x anterior a 3.9.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a tr... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2014-9039 – WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset
https://notcve.org/view.php?id=CVE-2014-9039
20 Nov 2014 — wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. wp-login.php en WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 podría permitir a atacantes remotos reconfigurar las contraseñas mediante el aprovechamiento del acceso a una cuenta de email que recibió un mensaje de reconfiguració... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-254: 7PK - Security Features CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2014-9032 – WordPress Core < 4.0.1 - Cross-Site Scripting via media-playlists
https://notcve.org/view.php?id=CVE-2014-9032
20 Nov 2014 — Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la caracteristica media-playlists en WordPress anterior a 3.9.x anterior a 3.9.3 y 4.x anterior a 4.0.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. An updated wordpress package fixes cross ... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 13%CPEs: 10EXPL: 4CVE-2014-9034 – WordPress Core < 4.0.1 - Denial of Service via Long Password
https://notcve.org/view.php?id=CVE-2014-9034
20 Nov 2014 — wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016. wp-includes/class-phpass.php en WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 permite a atacantes remotos causar una denegación de servicio (consumo de CPU) a través de una c... • https://packetstorm.news/files/id/129341 • CWE-19: Data Processing Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.6EPSS: 0%CPEs: 10EXPL: 0CVE-2014-9038 – WordPress Core < 4.0.1 - Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2014-9038
20 Nov 2014 — wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource. wp-includes/http.php en WordPress anterior a 3.7.5, 3.8.x anterior a 3.8.5, 3.9.x anterior a 3.9.3, y 4.x anterior a 4.0.1 permite a atacantes remotos realizar ataques de CSRF mediante la referencia a un recurso 127.0.0.0/8. Multiple security issues have been discovered in Wordpress, ... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-20: Improper Input Validation CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2014-9033 – WordPress Core < 4.0.1 - Cross-Site Request Forgery to Authentication Takeover
https://notcve.org/view.php?id=CVE-2014-9033
06 Aug 2014 — Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. Vulnerabilidad de CSRF en wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, y 4.0 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para solicitudes que reconfiguran contraseñas. Multiple security issues have been discovered in Wordpress, a web blogging tool, resulting in... • http://advisories.mageia.org/MGASA-2014-0493.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 4%CPEs: 2EXPL: 0CVE-2014-5203 – WordPress Core < 3.9.2 - Deserialization via Widgets
https://notcve.org/view.php?id=CVE-2014-5203
06 Aug 2014 — wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data. wp-includes/class-wp-customize-widgets.php en la implementación widget en WordPress 3.9.x anterior a 3.9.2 podría permitir a atacantes remotos ejecutar código arbitrario a través de datos serializados manipulados. • http://openwall.com/lists/oss-security/2014/08/13/3 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2014-5205 – WordPress Core < 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens
https://notcve.org/view.php?id=CVE-2014-5205
06 Aug 2014 — wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack. wp-includes/pluggable.php en WordPress anterior a 3.9.2 no utiliza delimitadores durante la concatenación de los valores de acción y los valores uid en los tokens CSRF, lo que facilita a aqtacantes remotos evadir un mecanismo de protección CSRF a través de un ... • http://openwall.com/lists/oss-security/2014/08/13/3 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 4.8EPSS: 0%CPEs: 33EXPL: 0CVE-2014-5240 – WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL
https://notcve.org/view.php?id=CVE-2014-5240
06 Aug 2014 — Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. Vulnerabilidad de XSS en wp-includes/pluggable.php en WordPress anterior a 3.9.2, cuando Multisite está habilitado, permite a administradores remotos autenticados inyectar secuencias de comandos web o HTML, y obtener privilegios de super admini... • http://openwall.com/lists/oss-security/2014/08/13/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-5204 – WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass
https://notcve.org/view.php?id=CVE-2014-5204
06 Aug 2014 — wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack. wp-includes/pluggable.php en WordPress anterior a 3.9.2 rechaza cadenas de caracteres de un sólo uso CSRF inválidos con diferencias de tiempo dependiendo de qué caracteres en la cadena de caracteres de un sólo uso sean incorrectos, lo que faci... • http://openwall.com/lists/oss-security/2014/08/13/3 • CWE-352: Cross-Site Request Forgery (CSRF) •