CVSS: 6.4EPSS: 1%CPEs: 80EXPL: 0CVE-2012-2403 – WordPress Core < 3.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2403
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. wp-includes/formatting.php en WordPress antes de v3.3.2 intenta habilitar los enlaces 'clicables' dentro de los atributos, lo que hace que facilita a los atacantes remotos a la hora de realizar ataques de ejecución de comandos en sitios cruzados(XSS) a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php http://osvdb.org/81463 http://secunia.com/advisories/48957 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com/vulnerabilities/75093 https://exch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 7CVE-2012-1835 – Timely All-in-One Events Calendar < 1.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-1835
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en el plugin All-in-One Event Calendar v1.4 y v1.5 para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) title a app/view/agenda-widget-form.php, (2) args, (3) title, (4) before_title, o (5) after_title a app/view/agenda-widget.php; (6) button_value a app/view/box_publish_button.php; o (7) msg a /app/view/save_successful.php. WordPress All-In-One Event Calendar plugin version 1.4 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/37075 https://www.exploit-db.com/exploits/37078 https://www.exploit-db.com/exploits/37076 https://www.exploit-db.com/exploits/37077 http://archives.neohapsis.com/archives/bugtraq/2012-04/0071.html http://www.securityfocus.com/bid/52986 https://www.htbridge.com/advisory/HTB23082 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 4CVE-2012-2109 – BuddyPress - 1.5-1.5.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-2109
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action. Vulnerabilidad de inyección SQL en wp-load.php en el complemento BuddyPress v1.5.x antes de v1.5.5 para WordPress, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro page en una acción activity_widget_filter • https://www.exploit-db.com/exploits/18690 http://buddypress.org/2012/03/buddypress-1-5-5 http://osvdb.org/80763 http://seclists.org/bugtraq/2012/Apr/4 http://www.exploit-db.com/exploits/18690 http://www.openwall.com/lists/oss-security/2012/04/15/2 http://www.openwall.com/lists/oss-security/2012/04/16/10 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 73EXPL: 3CVE-2012-0937 – WordPress Core 3.3.1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-0937
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time ** CUESTIONADA ** wp-admin/setup-config.php en la instalación del componente en WordPress v3.3.1 y versiones anteriores. No limita el número de peticiones MySQL enviados a servidores externos de la base de datos MySQL, lo que permite que atacantes remotos que usan WordPress como proxy para ataques de fuerza-bruta o denegación de servicio ataquen a través del parámetro 'dbhost', una vulnerabilidad diferente que CVE-2011-4898. NOTA: El vendedor ha puesto en duda la importancia de este informe porque una instalación incompleta de WordPress debería presentarse en la red por un periodo de corto de tiempo. • https://www.exploit-db.com/exploits/18417 http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html http://www.exploit-db.com/exploits/18417 https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt •
CVSS: 4.3EPSS: 0%CPEs: 73EXPL: 4CVE-2012-0782 – WordPress Core 3.3.1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-0782
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance ** CUESTIONADA ** Varias vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en wp-admin/setup-config.php en la instalación de componente en WordPress 3.3.1 y anteriores apermite a atacantes remotos inyectar código HTML o script web a través del parámetro (1)dbhost, (2) dbname, o (3) uname. NOTA: el desarrollador ha disputado la importancia de este vulnerabilidad; no está claro que el escenario XSS específico tenga relevancia de seguridad. WordPress versions 3.3.1 and below suffer from MySQL username/password disclosure, PHP code execution and cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/18417 http://archives.neohapsis.com/archives/bugtraq/2012-01/0150.html http://www.exploit-db.com/exploits/18417 https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •