CVSS: 5.5EPSS: 0%CPEs: 80EXPL: 0CVE-2012-2402 – WordPress Core < 3.3.2 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2012-2402
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors. wp-admin/plugins.php en WordPress antes de v3.3.2 permite eludir restricciones de acceso a los administradores autenticados del sitio y desactivar plugins de red a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20526/branches/3.3/wp-admin/plugins.php http://osvdb.org/81462 http://secunia.com/advisories/48957 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com/vulnerabilities/75090 https://exchange.xforce.ibmcloud.com/vulnerabilities/75207 • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 89EXPL: 0CVE-2012-2401 – WordPress Core <= 3.3.1 - Same Origin Policy Bypass
https://notcve.org/view.php?id=CVE-2012-2401
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content. Plupload antes de v1.5.4, tal y como se utiliza en wp-includes/js/plupload/ en WordPress antes de v3.3.2 y otros productos, permite ejecutar secuencias de comandos, independientemente del dominio desde el que se cargó el contenido SWF, lo que permite a atacantes remotos evitar la política de mismo origen a través de contenido malicioso. • http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487 http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487 http://osvdb.org/81461 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.plupload.com/punbb/viewtopic.php?id=1685 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 1%CPEs: 80EXPL: 0CVE-2012-2403 – WordPress Core < 3.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2403
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. wp-includes/formatting.php en WordPress antes de v3.3.2 intenta habilitar los enlaces 'clicables' dentro de los atributos, lo que hace que facilita a los atacantes remotos a la hora de realizar ataques de ejecución de comandos en sitios cruzados(XSS) a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php http://osvdb.org/81463 http://secunia.com/advisories/48957 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com/vulnerabilities/75093 https://exch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 76EXPL: 0CVE-2012-4033 – Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-4033
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en el plug-in Zingiri Web Shop antes de v2.4.0 para WordPress tienen un impacto y vectores de ataque desconocidos. The Zingiri Web Shop plugin for WordPress has multiple vulnerabilities in versions up to, and including, 2.3.7. This is due to the inclusion of timthumb.php, along with several cross-site scripting and SQL injection vulnerabilities. This makes it possible for unauthenticated attackers to access and altar data, and create administrator-level accounts. • http://forums.zingiri.com/announcements.php?aid=2 http://secunia.com/advisories/48909 http://wordpress.org/extend/plugins/zingiri-web-shop/changelog https://exchange.xforce.ibmcloud.com/vulnerabilities/75044 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 4CVE-2012-2109 – BuddyPress - 1.5-1.5.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-2109
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action. Vulnerabilidad de inyección SQL en wp-load.php en el complemento BuddyPress v1.5.x antes de v1.5.5 para WordPress, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro page en una acción activity_widget_filter • https://www.exploit-db.com/exploits/18690 http://buddypress.org/2012/03/buddypress-1-5-5 http://osvdb.org/80763 http://seclists.org/bugtraq/2012/Apr/4 http://www.exploit-db.com/exploits/18690 http://www.openwall.com/lists/oss-security/2012/04/15/2 http://www.openwall.com/lists/oss-security/2012/04/16/10 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •