CVSS: 6.4EPSS: 2%CPEs: 6EXPL: 0CVE-2020-28038 – WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs
https://notcve.org/view.php?id=CVE-2020-28038
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://blog.ripstech.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 1CVE-2020-28032 – WordPress Core < 5.5.2 - Deserialization Gadget
https://notcve.org/view.php?id=CVE-2020-28032
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://github.com/nth347/CVE-2020-28032_PoC • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 0CVE-2020-28037 – WordPress Core < 5.5.2 - Misconfiguration That Allows Trigger of New Installation
https://notcve.org/view.php?id=CVE-2020-28037
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c • CWE-285: Improper Authorization CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-28033 – WordPress Core < 5.5.2 - Spam Embed on Multisite Installations
https://notcve.org/view.php?id=CVE-2020-28033
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-28036 – WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC
https://notcve.org/view.php?id=CVE-2020-28036
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://github.com/WordPress/wordpress-develop/commit/c9e6b98968025b1629015998d12c3102165a7d32 • CWE-269: Improper Privilege Management CWE-862: Missing Authorization •
CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-28039 – WordPress Core < 5.5.2 - Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2020-28039
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://github.com/WordPress/wordpress-develop/commit/d5ddd6d4be1bc9fd16b7796842e6fb26315705ad • CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-28040 – WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change
https://notcve.org/view.php?id=CVE-2020-28040
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://blog.wpscan.com/2020/10/30/wordpress-5.5.2-security-release.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-28034 – WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables
https://notcve.org/view.php?id=CVE-2020-28034
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2020-28035 – WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC
https://notcve.org/view.php?id=CVE-2020-28035
29 Oct 2020 — They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 1CVE-2020-11858 – Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.
https://notcve.org/view.php?id=CVE-2020-11858
27 Oct 2020 —  La vulnerabilidad podría permitir a atacantes locales ejecutar código con privilegios escalados This vulnerability allows local attackers to escalate privileges on affected installations of Micro Focus Operations Bridge Manager. ... An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. • https://packetstorm.news/files/id/161411 •