CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6635 – WordPress Core < 4.5 - Cross-Site Request Forgery via wp_ajax_wp_compression_test
https://notcve.org/view.php?id=CVE-2016-6635
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option. Vulnerabilidad de CSRF en la función wp_ajax_wp_compression_test en wp-admin/includes/ajax-actions.php en WordPress en versiones anteriores a 4.5 permite a atacantes remotos secuestrar la autenticación de administradores para peticiones que cambian la opción de compresión de la escritura. • http://codex.wordpress.org/Version_4.5 http://www.debian.org/security/2016/dsa-3681 https://github.com/WordPress/WordPress/commit/9b7a7754133c50b82bd9d976fb5b24094f658aab https://wpvulndb.com/vulnerabilities/8475 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2221 – WordPress Core < 4.4.2 - Open Redirect via wp_validate_redirect
https://notcve.org/view.php?id=CVE-2016-2221
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL. Vulnerabilidad de redirección abierta en la función wp_validate_redirect en wp-includes/pluggable.php en WordPress en versiones anteriores a 4.4.2 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar acabo ataques de phishing a través de una URL mal formada que desencadena un análisis gramatical del nombre de host incorrecto, según lo demostrado mediante una URL https:example.com. • http://www.debian.org/security/2016/dsa-3472 http://www.securityfocus.com/bid/82463 http://www.securitytracker.com/id/1034933 https://codex.wordpress.org/Version_4.4.2 https://core.trac.wordpress.org/changeset/36444 https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/8377 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 1CVE-2016-1564 – WordPress Core < 4.4.1 - Cross-Site Scripting via Theme Names
https://notcve.org/view.php?id=CVE-2016-1564
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php. Múltiples vulnerabilidades de XSS en wp-includes/class-wp-theme.php en WordPress en versiones anteriores a 4.4.1 permiten a atacantes remotos inyectar comandos de web o HTML arbitrarios a través de (1) nombre de hoja de estilo o (2) nombre de plantilla para wp-admin/customize.php. • http://twitter.com/brutelogic/statuses/685105483397619713 http://www.debian.org/security/2016/dsa-3444 http://www.openwall.com/lists/oss-security/2016/01/08/4 http://www.securitytracker.com/id/1034622 https://codex.wordpress.org/Version_4.4.1 https://core.trac.wordpress.org/changeset/36185 https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release https://wpvulndb.com/vulnerabilities/8358 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5715 – WordPress Core < 4.3.1 - Authorization Bypass to Information Disclosure
https://notcve.org/view.php?id=CVE-2015-5715
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors. La función mw_editPost en wp-includes/class-wp-xmlrpc-server.php en el subsistema XMLRPC en WordPress en versiones anteriores a 4.3.1 permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y disponer para una publicación privada que sera publicada y adherida, a través de vectores no especificados. • http://www.debian.org/security/2015/dsa-3375 http://www.debian.org/security/2015/dsa-3383 http://www.securityfocus.com/bid/76748 http://www.securitytracker.com/id/1033979 https://codex.wordpress.org/Version_4.3.1 https://github.com/WordPress/WordPress/commit/9c57f3a4291f2311ae05f22c10eedeb0f69337ab https://security-tracker.debian.org/tracker/CVE-2015-5715 https://wordpress.org/news/2015/09/wordpress-4-3-1 https://wpvulndb.com/vulnerabilities/8188 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7989 – WordPress Core < 4.3.1 - Authenticated Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-7989
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714. Vulnerabilidad de XSS en la tabla de lista de usuarios en WordPress en versiones anteriores a 4.3.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una dirección de e-mail manipulada, una vulnerabilidad diferente de CVE-2015-5714. • http://www.debian.org/security/2015/dsa-3375 http://www.debian.org/security/2015/dsa-3383 http://www.securitytracker.com/id/1033979 https://codex.wordpress.org/Version_4.3.1 https://github.com/WordPress/WordPress/commit/f91a5fd10ea7245e5b41e288624819a37adf290a https://security-tracker.debian.org/tracker/CVE-2015-7989 https://wordpress.org/news/2015/09/wordpress-4-3-1 https://wpvulndb.com/vulnerabilities/8187 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •