CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2006-5705 – WordPress Core <= 2.0.4 - Directory Traversal
https://notcve.org/view.php?id=CVE-2006-5705
Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request. Vulnerabilidad de directorio transversal en plugins/wp-db-backup.php en WordPress anterior a 2.0.5 permite a un atacante remoto leer ficheros de su elección a través de secuencias de directorio transversal en parámetros no especificados relacionados con el backup de fragmentos de ficheros. • http://bugs.gentoo.org/show_bug.cgi?id=153303 http://markjaquith.wordpress.com/2006/10/17/changes-in-wordpress-205 http://secunia.com/advisories/22683 http://secunia.com/advisories/22942 http://trac.wordpress.org/changeset/4226 http://wordpress.org/development/2006/10/205-ronan http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.027-wordpress.html http://www.securityfocus.com/bid/20869 http://www.vupen.c • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-6017 – WordPress Core <= 2.0.4 - Denial of Service
https://notcve.org/view.php?id=CVE-2006-6017
WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service (application crash) via a string that represents a (1) malformed or (2) large serialized object, because the object triggers automatic unserialization for display. WordPress anterior a 2.0.5 no almacena adecuadamente un perfil que contiene una representación de un objeto serializado en una cadena, lo cual permite a usuarios remotos autenticados provocar una denegación de servicio (caída de la aplicación) mediante una cadena que representa un objeto serializado (1) mal formado o (2) grande, debido a que el objeto dispara una deserialización automática para mostrarse. • http://bugs.gentoo.org/show_bug.cgi?id=153303 http://trac.wordpress.org/ticket/2591 http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml • CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2006-6016 – WordPress Core < 2.0.5 - User Metadata Information Disclosure
https://notcve.org/view.php?id=CVE-2006-6016
wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter. wp-admin/user-edit.php en WordPress anterior a 2.0.5 permite a atacantes remotos autenticados leer la metainformación de un usuario de su elección mediante un parámetro user_id modificado. • http://bugs.gentoo.org/show_bug.cgi?id=153303 http://trac.wordpress.org/ticket/3142 http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2008-0194 – WordPress Core <= 2.0.3 - Denial of Service
https://notcve.org/view.php?id=CVE-2008-0194
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php. NOTE: this might be the same as CVE-2006-5705.1. Vulnerabilidad de salto de directorio en wp-db-backup.php de WordPress 2.0.3 y anteriores permite a atacantes remotos leer y borrar archivos de su elección, y provocar una denegación de servicio mediante un .. (punto punto) en el parámetro backup en una acción wp-db-backup.php de wp-admin/edit.php. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html http://secunia.com/advisories/29014 http://securityreason.com/securityalert/3539 http://securityvulns.ru/Sdocument755.html http://websecurity.com.ua/1676 http://www.debian.org/security/2008/dsa-1502 http://www.securityfocus.com/archive/1/485786/100/0/threaded http://www.securityfocus.com/bid/27123 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 12%CPEs: 1EXPL: 2CVE-2006-2667 – WordPress Core < 2.0.3 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2006-2667
Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when updating a profile, which is appended after a special comment sequence into files in (1) wp-content/cache/userlogins/ (2) wp-content/cache/users/ which are later included by cache.php, as demonstrated using the displayname argument. • https://www.exploit-db.com/exploits/6 http://retrogod.altervista.org/wordpress_202_xpl.html http://secunia.com/advisories/20271 http://secunia.com/advisories/20608 http://www.gentoo.org/security/en/glsa/glsa-200606-08.xml http://www.osvdb.org/25777 http://www.securityfocus.com/archive/1/435039/100/0/threaded http://www.securityfocus.com/bid/18372 http://www.vupen.com/english/advisories/2006/1992 https://exchange.xforce.ibmcloud.com/vulnerabilities/26687 • CWE-94: Improper Control of Generation of Code ('Code Injection') •