CVSS: 6.5EPSS: 0%CPEs: 89EXPL: 0CVE-2012-2401 – WordPress Core <= 3.3.1 - Same Origin Policy Bypass
https://notcve.org/view.php?id=CVE-2012-2401
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content. Plupload antes de v1.5.4, tal y como se utiliza en wp-includes/js/plupload/ en WordPress antes de v3.3.2 y otros productos, permite ejecutar secuencias de comandos, independientemente del dominio desde el que se cargó el contenido SWF, lo que permite a atacantes remotos evitar la política de mismo origen a través de contenido malicioso. • http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487 http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487 http://osvdb.org/81461 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.plupload.com/punbb/viewtopic.php?id=1685 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 1%CPEs: 80EXPL: 0CVE-2012-2403 – WordPress Core < 3.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2403
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. wp-includes/formatting.php en WordPress antes de v3.3.2 intenta habilitar los enlaces 'clicables' dentro de los atributos, lo que hace que facilita a los atacantes remotos a la hora de realizar ataques de ejecución de comandos en sitios cruzados(XSS) a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php http://osvdb.org/81463 http://secunia.com/advisories/48957 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com/vulnerabilities/75093 https://exch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 76EXPL: 0CVE-2012-4033 – Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-4033
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en el plug-in Zingiri Web Shop antes de v2.4.0 para WordPress tienen un impacto y vectores de ataque desconocidos. The Zingiri Web Shop plugin for WordPress has multiple vulnerabilities in versions up to, and including, 2.3.7. This is due to the inclusion of timthumb.php, along with several cross-site scripting and SQL injection vulnerabilities. This makes it possible for unauthenticated attackers to access and altar data, and create administrator-level accounts. • http://forums.zingiri.com/announcements.php?aid=2 http://secunia.com/advisories/48909 http://wordpress.org/extend/plugins/zingiri-web-shop/changelog https://exchange.xforce.ibmcloud.com/vulnerabilities/75044 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2012-1786 – Videopack (formerly Video Embed & Thumbnail Generator) <= 1.1 - Full Path Disclosure
https://notcve.org/view.php?id=CVE-2012-1786
The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors. El formulario de subida de contenido multimedia del complemento Video Embed & Thumbnail Generator anteriores a la versión 2.0 para WordPress permite a atacantes remotos obtener la ruta de instalación a través de vectores sin especificar. • http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924 http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog http://www.securityfocus.com/bid/52652 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2012-1785 – Videopack (formerly Video Embed & Thumbnail Generator) < 2.0 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-1785
kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors. kg_callffmpeg.php en el complemento de Wordpress "Video Embed & Thumbnail Generator" antes de v2.0 permite a atacantes remotos ejecutar comandos de su elección a través de vectores no especificados. The Videopack (formerly Video Embed & Thumbnail Generator) plugin for WordPress is vulnerable to remote code execution in versions up to 2.0 due to insufficient input validation on data supplied to the runCom() function that executes code. This makes it possible for attackers to run arbitrary code on the system. • http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924 http://secunia.com/advisories/48087 http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog http://www.securityfocus.com/bid/52180 https://exchange.xforce.ibmcloud.com/vulnerabilities/73508 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •