CVSS: 7.1EPSS: 32%CPEs: 1EXPL: 2CVE-2016-6896 – WordPress Core <= 4.5.3 - Denial of Service
https://notcve.org/view.php?id=CVE-2016-6896
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool. Vulnerabilidad de salto de directorio en la función wp_ajax_update_plugin en wp-admin/includes/ajax-actions.php en WordPress 4.5.3 permite a usuarios remotos autenticados provocar una denegación de servicio o leer ciertos archivos de texto a través de un .. (punto punto) en el parámetro plugin para wp-admin/admin-ajax.php, según lo demostrado por operaciones de lectura /dev/random que agotan el pool de entropia. • https://www.exploit-db.com/exploits/40288 http://www.openwall.com/lists/oss-security/2016/08/20/1 http://www.securitytracker.com/id/1036683 https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html https://wpvulndb.com/vulnerabilities/8606 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-6897 – WordPress Core < 4.6 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2016-6897
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. Vulnerabilidad de CSRF en la función wp_ajax_update_plugin en wp-admin/includes/ajax-actions.php en WordPress en versiones anteriores a 4.6 permite a atacantes remotos secuestrar la autenticación de subscriptores para operaciones de lectura /dev/random aprovechando una llamada tardía a la función check_ajax_referer, un caso relacionado con CVE-2016-6896. Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to • https://www.exploit-db.com/exploits/40288 http://www.openwall.com/lists/oss-security/2016/08/20/1 http://www.securityfocus.com/bid/92572 http://www.securitytracker.com/id/1036683 https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568 https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html https://wpvulndb.com/vulnerabilities/8606 - • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10148 – WordPress Core < 4.6 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2016-10148
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896. La función wp_ajax_update_plugin en wp-admin/includes/ajax-actions.php en WordPress en versiones anteriores a 4.6 hace una llamada get_plugin_data antes de comprobar la capacidad update_plugins, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso de lectura a través del parámetro plugin a wp-admin/admin-ajax.php, un caso relacionado con CVE-2016-6896. • http://www.openwall.com/lists/oss-security/2016/08/20/1 http://www.securityfocus.com/bid/96847 https://core.trac.wordpress.org/changeset/38168 https://core.trac.wordpress.org/ticket/37490 https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html • CWE-254: 7PK - Security Features CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2016-4029 – WordPress Core < 4.5 - Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2016-4029
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address. WordPress en versiones anteriores a 4.5 no considera formatos de dirección IP octal y hexadecimal cuando determina una dirección de intranet, lo que permite a atacantes remotos eludir un mecanismo de protección SSRF intencionado a través de una dirección manipulada. • http://codex.wordpress.org/Version_4.5 http://www.debian.org/security/2016/dsa-3681 http://www.securitytracker.com/id/1036594 https://core.trac.wordpress.org/query?status=closed&milestone=4.5 https://wpvulndb.com/vulnerabilities/8473 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5837 – WordPress Core < 4.5.3 - Authorization Bypass to Remove Category Attribute
https://notcve.org/view.php?id=CVE-2016-5837
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors. WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos eludir las restricciones destinadas al acceso y eliminar un atributo de categoría desde un post a través de vectores no especificados. • http://www.debian.org/security/2016/dsa-3639 http://www.securityfocus.com/bid/91365 http://www.securitytracker.com/id/1036163 https://codex.wordpress.org/Version_4.5.3 https://wordpress.org/news/2016/06/wordpress-4-5-3 https://wpvulndb.com/vulnerabilities/8520 • CWE-285: Improper Authorization •