CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5837 – WordPress Core < 4.5.3 - Authorization Bypass to Remove Category Attribute
https://notcve.org/view.php?id=CVE-2016-5837
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors. WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos eludir las restricciones destinadas al acceso y eliminar un atributo de categoría desde un post a través de vectores no especificados. • http://www.debian.org/security/2016/dsa-3639 http://www.securityfocus.com/bid/91365 http://www.securitytracker.com/id/1036163 https://codex.wordpress.org/Version_4.5.3 https://wordpress.org/news/2016/06/wordpress-4-5-3 https://wpvulndb.com/vulnerabilities/8520 • CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5832 – WordPress Core < 4.5.3 - Cross-Site Scripting via Customizer
https://notcve.org/view.php?id=CVE-2016-5832
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors. El customizador en WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos eludir las restricciones destinadas a la redirección a través de vectores no especificados. • http://www.debian.org/security/2016/dsa-3639 http://www.securityfocus.com/bid/91362 http://www.securitytracker.com/id/1036163 https://codex.wordpress.org/Version_4.5.3 https://wordpress.org/news/2016/06/wordpress-4-5-3 https://wpvulndb.com/vulnerabilities/8522 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5838 – WordPress Core < 4.5.3 - Password Change via Stolen Cookie
https://notcve.org/view.php?id=CVE-2016-5838
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos eludir las restricciones destinadas al cambio de contraseña aprovechando el conocimiento de una cookie. • http://www.debian.org/security/2016/dsa-3639 http://www.securityfocus.com/bid/91367 http://www.securitytracker.com/id/1036163 https://codex.wordpress.org/Version_4.5.3 https://wordpress.org/news/2016/06/wordpress-4-5-3 https://wpvulndb.com/vulnerabilities/8524 • CWE-255: Credentials Management Errors CWE-285: Improper Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5839 – WordPress Core < 4.5.3 - Bypass sanitize_file_name Protection
https://notcve.org/view.php?id=CVE-2016-5839
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors. WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos eludir el mecanismo de protección sanitize_file_name a través de vectores no especificados. • http://www.debian.org/security/2016/dsa-3639 http://www.securityfocus.com/bid/91364 http://www.securitytracker.com/id/1036163 https://codex.wordpress.org/Version_4.5.3 https://wordpress.org/news/2016/06/wordpress-4-5-3 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5833 – WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name #2
https://notcve.org/view.php?id=CVE-2016-5833
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834. Vulnerabilidad de XSS en la función column_title en wp-admin/includes/class-wp-media-list-table.php en WordPress en versiones anteriores a 4.5.3 permite a atacantes remotos inyectar secuencia de comandos web o HTML a través de un nombre adjunto manipulado, una vulnerabilidad diferente a CVE-2016-5834. • http://www.securityfocus.com/bid/91368 http://www.securitytracker.com/id/1036163 https://codex.wordpress.org/Version_4.5.3 https://github.com/WordPress/WordPress/commit/4372cdf45d0f49c74bbd4d60db7281de83e32648 https://wordpress.org/news/2016/06/wordpress-4-5-3 https://wpvulndb.com/vulnerabilities/8518 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •