CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2017-9063 – WordPress Core < 4.7.5 - Cross-Site Scripting via Customizer
https://notcve.org/view.php?id=CVE-2017-9063
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. En WordPress anteriores a 4.7.5, existe una vulnerabilidad de XSS (cross-site scripting) relacionada con la salida del personalizador, en una sesión de personalización no válida. • http://www.debian.org/security/2017/dsa-3870 http://www.securityfocus.com/bid/98509 http://www.securitytracker.com/id/1038520 https://codex.wordpress.org/Version_4.7.5 https://github.com/WordPress/WordPress/commit/3d10fef22d788f29aed745b0f5ff6f6baea69af3 https://wordpress.org/news/2017/05/wordpress-4-7-5 https://wpvulndb.com/vulnerabilities/8820 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-9064 – WordPress Core < 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update
https://notcve.org/view.php?id=CVE-2017-9064
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials. En WordPress antes de 4.7.5, existe una vulnerabilidad de Cross Site Request Forgery (CSRF) en el diálogo de credenciales del sistema de archivos porque no se requiere un nonce para actualizar las credenciales. • http://www.debian.org/security/2017/dsa-3870 http://www.securityfocus.com/bid/98509 http://www.securitytracker.com/id/1038520 https://codex.wordpress.org/Version_4.7.5 https://github.com/WordPress/WordPress/commit/38347d7c580be4cdd8476e4bbc653d5c79ed9b67 https://wordpress.org/news/2017/05/wordpress-4-7-5 https://wpvulndb.com/vulnerabilities/8818 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-9065 – WordPress Core < 4.7.5 - Authorization Bypass Allowing Post Meta Updates
https://notcve.org/view.php?id=CVE-2017-9065
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. En WordPress anteriores a 4.7.5, hay una falta de verificaciones de capacidad para el envío de metadatos en la API XML-RPC. • http://www.debian.org/security/2017/dsa-3870 http://www.securityfocus.com/bid/98509 http://www.securitytracker.com/id/1038520 https://codex.wordpress.org/Version_4.7.5 https://github.com/WordPress/WordPress/commit/e88a48a066ab2200ce3091b131d43e2fab2460a4 https://wordpress.org/news/2017/05/wordpress-4-7-5 https://wpvulndb.com/vulnerabilities/8817 • CWE-20: Improper Input Validation CWE-285: Improper Authorization •
CVSS: 8.6EPSS: 1%CPEs: 3EXPL: 0CVE-2017-9066 – WordPress Core < 4.7.5 - Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2017-9066
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. En WordPress anterior a versión 4.7.5, no hay suficiente validación de redireccionamiento en la clase de HTTP, lo que conlleva a una vulnerabilidad de tipo SSRF. • http://www.securityfocus.com/bid/98509 http://www.securitytracker.com/id/1038520 https://codex.wordpress.org/Version_4.7.5 https://github.com/WordPress/WordPress/commit/76d77e927bb4d0f87c7262a50e28d84e01fd2b11 https://twitter.com/skansing/status/865362551097393153 https://wordpress.org/news/2017/05/wordpress-4-7-5 https://wpvulndb.com/vulnerabilities/8815 https://www.debian.org/security/2018/dsa-4090 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.9EPSS: 2%CPEs: 1EXPL: 4CVE-2017-8295 – Wordpress Core < 5.5 - Unauthorized Password Reset via Interception
https://notcve.org/view.php?id=CVE-2017-8295
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message. WordPress hasta la versión 4.7.4 se basa en el encabezado HOST de HTTP para un mensaje de correo electrónico de restablecimiento de contraseña, lo que hace más fácil para los atacantes remotos restablecer contraseñas arbitrarias mediante una solicitud wp-login.php? • https://www.exploit-db.com/exploits/41963 https://github.com/cyberheartmi9/CVE-2017-8295 https://github.com/homjxi0e/CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset http://www.debian.org/security/2017/dsa-3870 http://www.securityfocus.com/bid/98295 http://www.securitytracker.com/id/1038403 https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html https://wpvulndb.com/vulnerabilities/8807 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •