CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0444 – XCloner < 4.3.6 - Plugin Settings Reset
https://notcve.org/view.php?id=CVE-2022-0444
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key. El plugin Backup, Restore and Migrate WordPress Sites With the XCloner Plugin de WordPress versiones anteriores a 4.3.6, no dispone de comprobaciones de autorización y de tipo CSRF cuando son restablecidos sus ajustes, lo que permite a atacantes no autenticados restablecerlos, incluyendo la generación de una nueva clave de cifrado de la copia de seguridad • https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-35950 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.152 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2020-35950
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). Se detectó un problema en el plugin XCloner Backup and Restore versiones anteriores a 4.2.153 para WordPress. Permite un ataque de tipo CSRF (por medio de casi cualquier endpoint). • https://wpscan.com/vulnerability/10413 https://www.wordfence.com/blog/2020/09/critical-vulnerabilities-patched-in-xcloner-backup-and-restore-plugin • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13424
https://notcve.org/view.php?id=CVE-2020-13424
The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure. El componente XCloner versiones anteriores a 3.5.4 para Joomla!, permite una Divulgación de Archivo Local Autenticada • https://github.com/mkelepce/CVE-2020-13424 https://www.xcloner.com/xcloner-news/security-release-available-for-archived-joomla-version •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8607 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8607
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! proporciona el nombre de usuario y la contraseña de MySQL en la línea de comando, lo que permite a usuarios locales obtener información sensible a través de el comando ps. The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8606 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2014-8606
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php. Vulnerabilidad de salto de directorio en el plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! permite a administradores remotos leer ficheros arbitrarios a través de un .. • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •