Page 30 of 265 results (0.005 seconds)

CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 1

CVE-2013-7233 – WordPress Core < 2.1 - Cross-Site Request Forgery to Denial of Service

https://notcve.org/view.php?id=CVE-2013-7233

Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list. V ulnerabilidad Cross-site request forgery (CSRF) en el componente retrospam en wp-admin/options-discussion.php en WordPress 2.0.11 y anteriores permite a atacantes remotos secuestrar la autenticación de los administradores de las solicitudes que mueven comentarios a la moderación de la lista. • https://www.exploit-db.com/exploits/38924 http://seclists.org/fulldisclosure/2013/Dec/145 http://www.osvdb.org/101184 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 1

CVE-2013-5918 – Platinum SEO <= 1.3.7 - Reflected Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2013-5918

Cross-site scripting (XSS) vulnerability in platinum_seo_pack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter. Vulnerabilidad XSS en platinum_seo_pack.php en el plugin Platinum SEO anterior a v1.3.8 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarias a través del parámetro "s". • http://osvdb.org/ref/97/platinum_seo.txt http://www.osvdb.org/97263 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 10%CPEs: 25EXPL: 2

CVE-2013-5963 – Simple Dropbox Upload < 1.8.8.1 - Arbitrary File Upload

https://notcve.org/view.php?id=CVE-2013-5963

Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/. Vulnerabilidad de subida de ficheros sin restricciones en multi.php en el plugin Simple Dropbox Upload anteriores a 1.8.8.1 para WordPress permite a atacantes remotos ejecutar código arbitrario subiendo un fichero con una extensión ejecutable y después accediendo a él a través de una petición directa al fichero wp-content/uploads/wpdb/. • http://packetstormsecurity.com/files/123235 http://plugins.trac.wordpress.org/changeset?reponame=&old=774214%40simple-dropbox-upload-form%2Ftrunk&new=774214%40simple-dropbox-upload-form%2Ftrunk http://secunia.com/advisories/54856 http://wordpress.org/plugins/simple-dropbox-upload-form/changelog https://exchange.xforce.ibmcloud.com/vulnerabilities/87166 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2013-4340 – WordPress Core < 3.6.1 - Spoof Post Authorship

https://notcve.org/view.php?id=CVE-2013-4340

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter. wp-admin/includes/post.php en WordPress anteriores a 3.6.1 permite a usuarios remotos autentificados falsear la autoría de una entrada aprovechando el rol Author y utilizando un parámetro user_ID modificado. • http://codex.wordpress.org/Version_3.6.1 http://core.trac.wordpress.org/changeset/25321 http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116828.html http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116832.html http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117118.html http://wordpress.org/news/2013/09/wordpress-3-6-1 http://www.debian.org/security/2013/dsa-2757 • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization •

CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2013-5739 – WordPress Core < 3.6.1 - .swf and .exe File Upload

https://notcve.org/view.php?id=CVE-2013-5739

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php. La configuración por defecto de Wordpress anteriores a 3.6.1 no previene la carga de archivos .swf y .exe, lo que podría hacer fácil para un usuario remoto autentificado realizar ataques cross-site scripting (XSS) a través de archivos manipulados, relacionado con la función get_allowed_mime_types en wp-includes/functions.php. • http://codex.wordpress.org/Version_3.6.1 http://core.trac.wordpress.org/changeset/25322 http://wordpress.org/news/2013/09/wordpress-3-6-1 http://www.debian.org/security/2013/dsa-2757 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •