Page 47 of 345 results (0.022 seconds)

CVSS: 6.4EPSS: 0%CPEs: 75EXPL: 0

Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en WordPress antes de v3.1.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://secunia.com/advisories/44038 http://secunia.com/advisories/49138 http://wordpress.org/news/2011/04/wordpress-3-1-1 http://www.debian.org/security/2012/dsa-2470 http://www.openwall.com/lists/oss-security/2012/04/19/17 http://www.openwall.com/lists/oss-security/2012/04/19/6 http://www.osvdb.org/72141 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter. wp-admin/async-upload.php en media uploader en WordPress anterior a v3.0.5 permite a usuarios remotos autenticados leer (1) posts borradores o (2) posts privados a través del parámetro modificado attachment_id. • http://codex.wordpress.org/Version_3.0.5 http://core.trac.wordpress.org/changeset/17393 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056412.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056998.html http://lists.fedoraproject.org/pipermail/package-announce/2011-March/057003.html http://openwall.com/lists/oss-security/2011/02/08/7 http://openwall.com/lists/oss-security/2011/02/09/13 http://secunia.com/advisories/43729 http://www • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-285: Improper Authorization •

CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0

WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files. WordPress v2.9.2 y v3.0.4 permiten a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con wp-admin/includes/user.php y algunos otros archivos. • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/wordpress_2.9.2 http://www.openwall.com/lists/oss-security/2011/06/27/6 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.4EPSS: 0%CPEs: 48EXPL: 1

wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action. wp-includes/capabilities.php en WordPress anterior a la versión 3.0.2, cuando se usa una configuración Multisite, no requiere el rol Super Admin para la capacidad delete_users, lo que permite a administradores remotos autenticados evadir restricciones de acceso intencionadas a través de una acción de eliminación. • http://codex.wordpress.org/Version_3.0.2 https://core.trac.wordpress.org/changeset/15562 • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •

CVSS: 6.4EPSS: 1%CPEs: 1EXPL: 0

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en KSES, como las utilizadas en WordPress antes de v3.0.4, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con (1) & (carácter ampersand), (2) el caso de un nombre de atributo, (3) una entidad con relleno, y (4) una entidad que no está en forma normalizada. • http://core.trac.wordpress.org/changeset/17172/branches/3.0 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053289.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053293.html http://secunia.com/advisories/42755 http://secunia.com/advisories/43000 http://wordpress.org/news/2010/12/3-0-4-update http://www.openwall.com/lists/oss-security/2010/12/30/1 http://www.securityfocus.com/bid/45620 http://www.vupen.com/english/advisories/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •