CVSS: 9.6EPSS: 48%CPEs: 1EXPL: 2CVE-2019-9787 – WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-9787
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php. WordPress, en versiones anteriores a la 5.1.1, no filtra correctamente el contenido, lo que conduce a la ejecución remota de código por parte de usuarios no autenticados en una configuración por defecto. • https://github.com/dexXxed/CVE-2019-9787 http://www.securityfocus.com/bid/107411 https://blog.ripstech.com/2019/wordpress-csrf-to-rce https://github.com/WordPress/WordPress/commit/0292de60ec78c5a44956765189403654fe4d080b https://lists.debian.org/debian-lts-announce/2019/03/msg00044.html https://wordpress.org/news/2019/03/wordpress-5-1-1-security-and-maintenance-release https://wordpress.org/support/wordpress-version/version-5-1-1 https://wpvulndb.com/vulnerabilities/9230 https://www.debian.org& • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 94%CPEs: 11EXPL: 8CVE-2019-8942 – WordPress Core < 5.0.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8942
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. WordPress, en versiones anteriores a la 4.99 y en las 5.x anteriores a la 5.0.1, permite la ejecución remota de código debido a que una entrada "Post Meta" _wp_attached_file puede modificarse a una cadena arbitraria, como uno que termina en una subcadena ".jpg? • https://www.exploit-db.com/exploits/46662 https://www.exploit-db.com/exploits/46511 https://github.com/synacktiv/CVE-2019-8942 https://github.com/tuannq2299/CVE-2019-8942 http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce http://www.securityfocus.com/bid/107088 https://blog.ripstech.com/2019/wordpress-image-remote-code-execution https://lists.debian.org/debian-lts-announce/2 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 92%CPEs: 1EXPL: 7CVE-2019-8943 – WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion
https://notcve.org/view.php?id=CVE-2019-8943
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. WordPress hasta la versión 5.0.3 permite saltos de directorio en wp_crop_image(). • https://www.exploit-db.com/exploits/46662 https://www.exploit-db.com/exploits/46511 https://github.com/v0lck3r/CVE-2019-8943 http://packetstormsecurity.com/files/152396/WordPress-5.0.0-crop-image-Shell-Upload.html http://packetstormsecurity.com/files/161213/WordPress-5.0.0-Remote-Code-Execution.html http://www.rapid7.com/db/modules/exploit/multi/http/wp_crop_rce http://www.securityfocus.com/bid/107089 https://blog.ripstech.com/2019/wordpress-image-remote-code-execution • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2018-20147 – WordPress Core < 5.0.1 - Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2018-20147
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. En WordPress, en versiones anteriores a la 4.9.9 y versiones 5.x anteriores a la 5.0.1, los autores podrían modificar metadatos para omitir las restricciones planeadas de la eliminación de archivos. • http://www.securityfocus.com/bid/106220 https://codex.wordpress.org/Version_4.9.9 https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release https://wordpress.org/support/wordpress-version/version-5-0-1 https://wpvulndb.com/vulnerabilities/9169 https://www.debian.org/security/2019/dsa-4401 https://www.zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2018-20148 – WordPress Core < 5.0.1 - PHP Object Injection
https://notcve.org/view.php?id=CVE-2018-20148
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php. En WordPress, en versiones anteriores a la 4.9.9 y versiones 5.x anteriores a la 5.0.1, los contribuyentes pueden llevar a cabo ataques de inyección de objetos PHP mediante metadatos manipulados en una llamada wp.getMediaItem. Esto viene provocado por la gestión incorrecta de datos serializados en URL phar:// en la función wp_get_attachment_thumb_file en wp-includes/post.php. • http://www.securityfocus.com/bid/106220 https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-are https://codex.wordpress.org/Version_4.9.9 https://lists.debian.org/debian-lts-announce/2019/02/msg00019.html https://wordpress.org/news/2018/12/wordpress-5-0-1-security-release https://wordpress.org/support/wordpress-version/version-5-0-1 https://wpvulndb.com/vulnerabilities/9171 https://www.debian.org/security/2019/dsa-4401 https://www.zdnet.com/articl • CWE-502: Deserialization of Untrusted Data •