CVSS: 5.3EPSS: 96%CPEs: 2EXPL: 3CVE-2009-2335 – WordPress Core & WordPress MU < 2.8.1 - Username Enumeration
https://notcve.org/view.php?id=CVE-2009-2335
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience." WordPress y WordPress MU anterior a v2.8.1 expone un comportamiento diferente para un intento fallido de acceso en función de si existe la cuenta de usuario, lo cual permite a atacantes remotos enumerar nombres de usuario válidos. NOTA: el proveedor informa de que cuestiona la importancia de esta incidencia, indicando que el comportamiento existe para conveniencia del usuario. • https://www.exploit-db.com/exploits/17702 http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked http://securitytracker.com/id?1022528 http://www.exploit-db.com/exploits/9110 http://www.osvdb.org/55713 http://www.securityfocus.com/archive/1/504795/100/0/threaded http://www.securityfocus.com/bid/35581 http://www.vupen.com/english/advisories/2009/1833 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00597.html https&# • CWE-16: Configuration CWE-204: Observable Response Discrepancy •
CVSS: 6.4EPSS: 0%CPEs: 26EXPL: 1CVE-2009-1030 – WordPress MU < 2.7 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-1030
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función choose_primary_blog en wp-includes/wpmu-functions.php en WordPress MU (WPMU) anterior a v2.7 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de la cabecera HTTP Host. • https://www.exploit-db.com/exploits/8196 http://marc.info/?l=bugtraq&m=126996727024732&w=2 http://www.securityfocus.com/archive/1/501667/100/0/threaded http://www.securityfocus.com/bid/34075 http://www.securitytracker.com/id?1021838 https://exchange.xforce.ibmcloud.com/vulnerabilities/49184 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 43%CPEs: 74EXPL: 1CVE-2008-5278 – WordPress Core < 2.6.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-5278
Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable). Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función self_link en el RSS Feed Generator (wp-includes/feed.php) para WordPress versiones anteriores a v2.6.5 permite a atacantes remotos inyectar web script o HTML de su elección a través de una cabecera Host (variable HTTP_HOST). • http://osvdb.org/50214 http://secunia.com/advisories/32882 http://secunia.com/advisories/32966 http://securityreason.com/securityalert/4662 http://wordpress.org/development/2008/11/wordpress-265 http://www.securityfocus.com/archive/1/498652 http://www.securityfocus.com/bid/32476 https://exchange.xforce.ibmcloud.com/vulnerabilities/46882 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00000.html https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2008-5113
https://notcve.org/view.php?id=CVE-2008-5113
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection. WordPress 2.6.3 se basa en el array superglobal REQUEST en algunas situaciones peligrosas, lo cual facilita a los atacantes remotos a llevar a cabo ataques de falsificación de petición en sitios cruzados tanto persistentes como retardados a través de "cookies" modificadas a mano, como lo demuestran los ataques que (1) eliminan cuentas de usuario o (2) provocan una denegación de servicio (pérdida de acceso a la aplicación). NOTA: Este problema se basa en la presencia de una vulnerabilidad independiente que permite la inyección de cookies. • http://bugs.debian.org/504771 http://openwall.com/lists/oss-security/2008/11/14/1 http://www.debian.org/security/2009/dsa-1871 https://exchange.xforce.ibmcloud.com/vulnerabilities/46698 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2011-0700 – WordPress Core <= 3.0.4 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-0700
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Wordpress en versiones anteriores a v3.0.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro (1) Quick/Bulk Edit title (también conocido como post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, y (5)saliendo de tags sin usar tags meta box . • http://codex.wordpress.org/Version_3.0.5 http://core.trac.wordpress.org/changeset/17397 http://core.trac.wordpress.org/changeset/17401 http://core.trac.wordpress.org/changeset/17406 http://core.trac.wordpress.org/changeset/17412 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056412.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056998.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/057003.html http://openwall.com/lists&#x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •