CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7168 – WordPress Core < 4.6.1 - Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-7168
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename. Vulnerabilidad de XSS en la función media_handle_upload en wp-admin/includes/media.php en WordPress en versiones anteriores a 4.6.1 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios engañando a un administrador para subir un archivo de imagen que tiene un nombre de archivo manipulado. • http://www.debian.org/security/2016/dsa-3681 http://www.openwall.com/lists/oss-security/2016/09/08/19 http://www.openwall.com/lists/oss-security/2016/09/08/24 http://www.securityfocus.com/bid/92841 https://codex.wordpress.org/Version_4.6.1 https://github.com/WordPress/WordPress/commit/c9e60dab176635d4bfaaf431c0ea891e4726d6e0 https://sumofpwn.nl/advisory/2016/persistent_cross_site_scripting_vulnerability_in_wordpress_due_to_unsafe_processing_of_file_names.html https://wordpress.org/news/20 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7169 – WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access
https://notcve.org/view.php?id=CVE-2016-7169
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter. Vulnerabilidad de salto de directorio en la clase File_Upload_Upgrader en wp-admin/includes/class-file-upload-upgrader.php en el cargador del paquete de actualización en WordPress en versiones anteriores a 4.6.1 permite a usuarios remotos autenticados acceder a archivos arbitrarios a través de un parámetro urlholder manipulado. • http://www.debian.org/security/2016/dsa-3681 http://www.securityfocus.com/bid/92841 https://codex.wordpress.org/Version_4.6.1 https://github.com/WordPress/WordPress/commit/54720a14d85bc1197ded7cb09bd3ea790caa0b6e https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/8616 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10148 – WordPress Core < 4.6 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2016-10148
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896. La función wp_ajax_update_plugin en wp-admin/includes/ajax-actions.php en WordPress en versiones anteriores a 4.6 hace una llamada get_plugin_data antes de comprobar la capacidad update_plugins, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso de lectura a través del parámetro plugin a wp-admin/admin-ajax.php, un caso relacionado con CVE-2016-6896. • http://www.openwall.com/lists/oss-security/2016/08/20/1 http://www.securityfocus.com/bid/96847 https://core.trac.wordpress.org/changeset/38168 https://core.trac.wordpress.org/ticket/37490 https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html • CWE-254: 7PK - Security Features CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-6897 – WordPress Core < 4.6 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2016-6897
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. Vulnerabilidad de CSRF en la función wp_ajax_update_plugin en wp-admin/includes/ajax-actions.php en WordPress en versiones anteriores a 4.6 permite a atacantes remotos secuestrar la autenticación de subscriptores para operaciones de lectura /dev/random aprovechando una llamada tardía a la función check_ajax_referer, un caso relacionado con CVE-2016-6896. Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to • https://www.exploit-db.com/exploits/40288 http://www.openwall.com/lists/oss-security/2016/08/20/1 http://www.securityfocus.com/bid/92572 http://www.securitytracker.com/id/1036683 https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568 https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html https://wpvulndb.com/vulnerabilities/8606 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2016-4029 – WordPress Core < 4.5 - Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2016-4029
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address. WordPress en versiones anteriores a 4.5 no considera formatos de dirección IP octal y hexadecimal cuando determina una dirección de intranet, lo que permite a atacantes remotos eludir un mecanismo de protección SSRF intencionado a través de una dirección manipulada. • http://codex.wordpress.org/Version_4.5 http://www.debian.org/security/2016/dsa-3681 http://www.securitytracker.com/id/1036594 https://core.trac.wordpress.org/query?status=closed&milestone=4.5 https://wpvulndb.com/vulnerabilities/8473 • CWE-918: Server-Side Request Forgery (SSRF) •