CVSS: 5.5EPSS: 0%CPEs: 80EXPL: 0CVE-2012-2402 – WordPress Core < 3.3.2 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2012-2402
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors. wp-admin/plugins.php en WordPress antes de v3.3.2 permite eludir restricciones de acceso a los administradores autenticados del sitio y desactivar plugins de red a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20526/branches/3.3/wp-admin/plugins.php http://osvdb.org/81462 http://secunia.com/advisories/48957 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com/vulnerabilities/75090 https://exchange.xforce.ibmcloud.com/vulnerabilities/75207 • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 89EXPL: 0CVE-2012-2401 – WordPress Core <= 3.3.1 - Same Origin Policy Bypass
https://notcve.org/view.php?id=CVE-2012-2401
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content. Plupload antes de v1.5.4, tal y como se utiliza en wp-includes/js/plupload/ en WordPress antes de v3.3.2 y otros productos, permite ejecutar secuencias de comandos, independientemente del dominio desde el que se cargó el contenido SWF, lo que permite a atacantes remotos evitar la política de mismo origen a través de contenido malicioso. • http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487 http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487 http://osvdb.org/81461 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.plupload.com/punbb/viewtopic.php?id=1685 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 1%CPEs: 80EXPL: 0CVE-2012-2403 – WordPress Core < 3.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2403
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. wp-includes/formatting.php en WordPress antes de v3.3.2 intenta habilitar los enlaces 'clicables' dentro de los atributos, lo que hace que facilita a los atacantes remotos a la hora de realizar ataques de ejecución de comandos en sitios cruzados(XSS) a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php http://osvdb.org/81463 http://secunia.com/advisories/48957 http://secunia.com/advisories/49138 http://wordpress.org/news/2012/04/wordpress-3-3-2 http://www.debian.org/security/2012/dsa-2470 http://www.securityfocus.com/bid/53192 https://exchange.xforce.ibmcloud.com/vulnerabilities/75093 https://exch • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 76EXPL: 0CVE-2012-4033 – Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-4033
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en el plug-in Zingiri Web Shop antes de v2.4.0 para WordPress tienen un impacto y vectores de ataque desconocidos. The Zingiri Web Shop plugin for WordPress has multiple vulnerabilities in versions up to, and including, 2.3.7. This is due to the inclusion of timthumb.php, along with several cross-site scripting and SQL injection vulnerabilities. This makes it possible for unauthenticated attackers to access and altar data, and create administrator-level accounts. • http://forums.zingiri.com/announcements.php?aid=2 http://secunia.com/advisories/48909 http://wordpress.org/extend/plugins/zingiri-web-shop/changelog https://exchange.xforce.ibmcloud.com/vulnerabilities/75044 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 7CVE-2012-1835 – Timely All-in-One Events Calendar < 1.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-1835
Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en el plugin All-in-One Event Calendar v1.4 y v1.5 para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) title a app/view/agenda-widget-form.php, (2) args, (3) title, (4) before_title, o (5) after_title a app/view/agenda-widget.php; (6) button_value a app/view/box_publish_button.php; o (7) msg a /app/view/save_successful.php. WordPress All-In-One Event Calendar plugin version 1.4 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/37075 https://www.exploit-db.com/exploits/37078 https://www.exploit-db.com/exploits/37076 https://www.exploit-db.com/exploits/37077 http://archives.neohapsis.com/archives/bugtraq/2012-04/0071.html http://www.securityfocus.com/bid/52986 https://www.htbridge.com/advisory/HTB23082 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •