Page 44 of 290 results (0.023 seconds)

CVSS: 5.3EPSS: 1%CPEs: 2EXPL: 0

WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure. WordPress 2.2.x y 2.3.x permite a atacantes remotos obtener información sensible mediante un parámetro p inválido en una acción rss2 al URI por defecto, lo cual revela la ruta completa y la estructura de base de datos SQL. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html http://securityreason.com/securityalert/3539 http://securityvulns.ru/Sdocument663.html http://websecurity.com.ua/1634 http://www.securityfocus.com/archive/1/485786/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/39423 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 1

Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then generating the authentication cookie from that hash. Wordpress versiones 1.5 hasta 2.3.1, usa valores de cookies basados ??en el hash MD5 de un hash MD5 de contraseñas, lo que permite a atacantes omitir la autenticación mediante la obtención del hash MD5 desde la base de datos del usuario, y luego generar la cookie de autenticación a partir de ese hash. • http://lists.grok.org.uk/pipermail/full-disclosure/2007-November/058576.html http://osvdb.org/40801 http://secunia.com/advisories/27714 http://secunia.com/advisories/28310 http://securityreason.com/securityalert/3375 http://trac.wordpress.org/ticket/5367 http://www.cl.cam.ac.uk/~sjm217/advisories/wordpress-cookie-auth.txt http://www.securityfocus.com/archive/1/483927/100/0/threaded http://www.securitytracker.com/id?1018980 http://www.vupen.com/english/advisories/2007/3941 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-327: Use of a Broken or Risky Cryptographic Algorithm •

CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1

Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the user_login parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el wp-register.php del WordPress 2.0 permite a atacantes remotos la inyección de secuencias de comandos web o HTML de su elección a través del parámetro user_login. • http://blogsecurity.net/wordpress/2-vanilla-xss-on-wordpress-wp-registerphp http://securityreason.com/securityalert/3175 http://www.securityfocus.com/archive/1/480327/100/0/threaded http://www.securityfocus.com/bid/25769 https://exchange.xforce.ibmcloud.com/vulnerabilities/36742 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 0%CPEs: 31EXPL: 0

Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the post_type parameter to the pingback.extensions.getPingbacks method in the XMLRPC interface, and other unspecified parameters related to "early database escaping" and missing validation of "query string like parameters." Múltiples vulnerabilidades de inyección SQL en Wordpress versiones anteriores a 2.2.3 y Wordpress multi-user (MU) versiones anteriores a 1.2.5a permiten a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro post_type en el método pingback.extensions.getPingbacks en el interfaz XMLRPC, y otros parámetros no especificados relativos a "escapado temprano de base de datos" y omisión de validación de "cadena de consulta como parámetros". • http://fedoranews.org/updates/FEDORA-2007-214.shtml http://secunia.com/advisories/26771 http://secunia.com/advisories/26796 http://trac.wordpress.org/ticket/4770 http://wordpress.org/development/2007/09/wordpress-223 http://www.buayacorp.com/files/wordpress/wordpress-sql-injection-advisory.html http://www.vupen.com/english/advisories/2007/3132 https://bugzilla.redhat.com/show_bug.cgi?id=285831 https://exchange.xforce.ibmcloud.com/vulnerabilities/36578 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 1%CPEs: 38EXPL: 0

The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors. La implementación XML-RPC (xmlrpc.php) en versiones anteriores a WordPress 2.3.3, cuando el registro está activado, permite a atacantes remotos editar mensajes de otros usuarios del blog a través de vectores desconocidos. • http://secunia.com/advisories/28823 http://secunia.com/advisories/28920 http://secunia.com/advisories/30960 http://wordpress.org/development/2008/02/wordpress-233 http://www.debian.org/security/2008/dsa-1601 http://www.securityfocus.com/bid/27669 http://www.securitytracker.com/id?1019316 http://www.village-idiot.org/archives/2008/02/02/wordpress-232-exploit-confirmed http://www.vupen.com/english/advisories/2008/0448 https://bugzilla.redhat.com/show_bug.cgi?id=431547 https:& • CWE-264: Permissions, Privileges, and Access Controls CWE-639: Authorization Bypass Through User-Controlled Key •