CVSS: 5.3EPSS: 95%CPEs: 2EXPL: 3CVE-2009-2335 – WordPress Core & WordPress MU < 2.8.1 - Username Enumeration
https://notcve.org/view.php?id=CVE-2009-2335
09 Jul 2009 — WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience." WordPress y WordPress MU anterior a v2.8.1 expone un comportamiento diferente para un intento fallido de acceso en función de si existe la cuenta de usuario, lo cual permite a atacant... • https://www.exploit-db.com/exploits/17702 • CWE-16: Configuration CWE-204: Observable Response Discrepancy •
CVSS: 5.3EPSS: 1%CPEs: 2EXPL: 2CVE-2009-2336 – WordPress Core & WordPress MU < 2.8.1 - Username Enumeration
https://notcve.org/view.php?id=CVE-2009-2336
09 Jul 2009 — The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience." El interfaz de correo olvidado en WordPress y WordPress MU anterior a v2.8.1 muestra diferentes comportamientos para una petición de contraseña dependiend... • http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked • CWE-16: Configuration CWE-203: Observable Discrepancy •
CVSS: 6.1EPSS: 8%CPEs: 101EXPL: 5CVE-2009-2334 – WordPress Core <= 2.8 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2009-2334
09 Jul 2009 — wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be lev... • https://www.exploit-db.com/exploits/9110 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-287: Improper Authentication •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2431 – WordPress Core < 2.8 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2009-2431
11 Jun 2009 — WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source. WordPress v2.7.1 coloca el nombre de usuario del autor de un post en un comentario HTML, lo cual permite a atacantes remotos obtener información sensible mediante la lectura del código fuente HTML. • http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2008-6762 – WordPress Core < 2.8.1 - Open Redirect
https://notcve.org/view.php?id=CVE-2008-6762
22 Dec 2008 — Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter. Vulnerabilidad de redirección abierta en wp-admin/upgrade.php en WordPress, probablemente v2.6.x, permite a atacantes remotos redirigir a los usuarios a sitios Web a su elección y llevar a cabo ataques de phishing a través de una URL en el parámetro backto. • http://archives.neohapsis.com/archives/bugtraq/2008-12/0226.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2008-6767 – WordPress Core < 2.7 - Denial of Service
https://notcve.org/view.php?id=CVE-2008-6767
22 Dec 2008 — wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request. wp-admin/upgrade.php en WordPress, probablemente v2.6.x, permite a atacantes remotos actualizar la aplicación, y posiblemente causar una denegación de servicio (caída de la aplicación), a través de una solicitud directa. wp-admin/upgrade.php in WordPress up to and including 2.6.1, allows remote attackers to upgrade the appli... • http://archives.neohapsis.com/archives/bugtraq/2008-12/0226.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.2EPSS: 5%CPEs: 74EXPL: 1CVE-2008-5278 – WordPress Core < 2.6.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-5278
28 Nov 2008 — Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable). Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función self_link en el RSS Feed Generator (wp-includes/feed.php) para WordPress versiones anteriores a v2.6.5 permite a atacantes remotos inyectar web script o HTML de su elección a través... • http://osvdb.org/50214 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-5113
https://notcve.org/view.php?id=CVE-2008-5113
17 Nov 2008 — WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection. WordPress 2.6.3 se basa en el array superglobal REQUEST en al... • http://bugs.debian.org/504771 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2008-4796 – Feed2JS File Disclosure
https://notcve.org/view.php?id=CVE-2008-4796
30 Oct 2008 — The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs. La función _httpsrequest function (Snoopy/Snoopy.class.php) en Snoopy 1.2.3 y versiones anteriores, cuando es usada en (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost y posi... • https://packetstorm.news/files/id/127352 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 1%CPEs: 34EXPL: 2CVE-2008-4106 – WordPress Core < 2.6.2 - Arbitrary User Password Reset
https://notcve.org/view.php?id=CVE-2008-4106
08 Sep 2008 — WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploit... • http://marc.info/?l=oss-security&m=122152830017099&w=2 • CWE-20: Improper Input Validation CWE-197: Numeric Truncation Error •