CVSS: 6.4EPSS: 0%CPEs: 23EXPL: 0CVE-2014-1888 – BuddyPress <= 1.9.1 - Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-1888
Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-1889. Vulnerabilidad de XSS en el plugin BuddyPress anterior a 1.9.2 para WordPress permite a usuarios remotos autenticados inyectar script Web o HTML arbitrarios a través del campo name hacia groups/create/step/group-details. NOTA: esto puede ser explotado sin autenticación mediante el aprovechamiento de CVE-2014-1889. Cross-site scripting (XSS) vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. • http://buddypress.org/2014/02/buddypress-1-9-2 http://osvdb.org/103307 http://packetstormsecurity.com/files/125212/WordPress-Buddypress-1.9.1-Cross-Site-Scripting.html http://secunia.com/advisories/56950 http://www.securityfocus.com/archive/1/531049/100/0/threaded http://www.securityfocus.com/bid/65555 https://exchange.xforce.ibmcloud.com/vulnerabilities/91175 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 2CVE-2014-1889 – BuddyPress <= 1.9.1 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2014-1889
The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check. El proceso de creación de grupos en el plugin Buddypress, en versiones anteriores a la 1.9.2 para WordPress, permite que usuarios autenticados remotos obtengan el control de grupos arbitrarios aprovechando una falta de comprobación de permisos. The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check. An attacker could exploit this vulnerability to modify the name, description, avatar and settings of groups. WordPress Buddypress plugin versions 1.9.1 and below suffer from a privilege escalation vulnerability. • https://www.exploit-db.com/exploits/31571 http://www.securityfocus.com/archive/1/531050/100/0/threaded http://www.securityfocus.com/bid/65554 https://buddypress.org/2014/02/buddypress-1-9-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/91261 • CWE-264: Permissions, Privileges, and Access Controls CWE-287: Improper Authentication •