CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 0CVE-2007-0109 – WordPress < 2.0.6 - Username Enumeration via Error Messages
https://notcve.org/view.php?id=CVE-2007-0109
wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks. wp-login.php en WordPress 2.0.5 y anteriores muestra diferentes mensajes de error si un usuario existe o no, lo cual permite a atacantes remotos obtener información sensible y facilita ataques de fuerza bruta. • http://osvdb.org/31577 http://secunia.com/advisories/23621 http://secunia.com/advisories/23741 http://security.gentoo.org/glsa/glsa-200701-10.xml http://securityreason.com/securityalert/2113 http://www.securityfocus.com/archive/1/455927/100/0/threaded http://www.vupen.com/english/advisories/2007/0062 https://exchange.xforce.ibmcloud.com/vulnerabilities/31262 • CWE-204: Observable Response Discrepancy •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2007-0107 – WordPress Core <= 2.0.5 - SQL Injection
https://notcve.org/view.php?id=CVE-2007-0107
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7. WordPress anterior a 2.0.6, cuando mbstring está habilitado para PHP, decodifica juegos de caracteres alternativos tras escapar la petición SQL, lo cual permite a atacantes remotos evitar los esquemas de protección contra inyección SQL y ejecutar comandos SQL de su elección mediante juegos de caracteres multi-byte, como se ha demostrado utilizando UTF-7. • https://www.exploit-db.com/exploits/3095 http://osvdb.org/31579 http://secunia.com/advisories/23595 http://secunia.com/advisories/23741 http://security.gentoo.org/glsa/glsa-200701-10.xml http://securityreason.com/securityalert/2112 http://wordpress.org/development/2007/01/wordpress-206 http://www.hardened-php.net/advisory_022007.141.html http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.005.html http://www.securityfocus.com/archive/1/456049/100/0/threaded http:/ • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 0CVE-2007-0106 – WordPress Core <= 2.0.5 - Cross-Site Request Forgery to Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-0106
Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el esquema de protección ante CSRF de WordPress anterior a 2.0.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante un ataque CSRF con un token inválido y comillas o etiquetas HTML en los nombres de variable de la URL, que no son manejados adecuadamente cuando WordPress genera un nuevo enlace para verificar la petición. • http://osvdb.org/33397 http://secunia.com/advisories/23595 http://securityreason.com/securityalert/2114 http://wordpress.org/development/2007/01/wordpress-206 http://www.hardened-php.net/advisory_012007.140.html http://www.securityfocus.com/archive/1/456048/100/0/threaded http://www.securityfocus.com/bid/21893 http://www.vupen.com/english/advisories/2007/0061 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 3%CPEs: 18EXPL: 2CVE-2006-6808 – WordPress Core <= 2.0.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2006-6808
Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php. Vulnerabilidad de XSS en wp-admin/templates.php en WordPress 2.0.5 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro de archivo. NOTA: algunas fuentes han informado que esta es una vulnerabilidad en la función get_file_description en wp-admin/admin-functions.php. • https://www.exploit-db.com/exploits/29356 http://marc.info/?l=full-disclosure&m=116722128631087&w=2 http://michaeldaw.org http://secunia.com/advisories/23587 http://secunia.com/advisories/23741 http://security.gentoo.org/glsa/glsa-200701-10.xml http://trac.wordpress.org/changeset/4665 http://www.securityfocus.com/bid/21782 http://www.vupen.com/english/advisories/2006/5191 https://exchange.xforce.ibmcloud.com/vulnerabilities/31133 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2006-5705 – WordPress Core <= 2.0.4 - Directory Traversal
https://notcve.org/view.php?id=CVE-2006-5705
Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request. Vulnerabilidad de directorio transversal en plugins/wp-db-backup.php en WordPress anterior a 2.0.5 permite a un atacante remoto leer ficheros de su elección a través de secuencias de directorio transversal en parámetros no especificados relacionados con el backup de fragmentos de ficheros. • http://bugs.gentoo.org/show_bug.cgi?id=153303 http://markjaquith.wordpress.com/2006/10/17/changes-in-wordpress-205 http://secunia.com/advisories/22683 http://secunia.com/advisories/22942 http://trac.wordpress.org/changeset/4226 http://wordpress.org/development/2006/10/205-ronan http://www.gentoo.org/security/en/glsa/glsa-200611-10.xml http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.027-wordpress.html http://www.securityfocus.com/bid/20869 http://www.vupen.c • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •