CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-0444 – XCloner < 4.3.6 - Plugin Settings Reset
https://notcve.org/view.php?id=CVE-2022-0444
06 Jun 2022 — The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key. El plugin Backup, Restore and Migrate WordPress Sites With the XCloner Plugin de WordPress versiones anteriores a 4.3.6, no dispone de comprobaciones de autorización y de tipo CSRF cuando son restablecidos sus ajustes, lo que permite a a... • https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b • CWE-352: Cross-Site Request Forgery (CSRF) CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-35950 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 4.2.152 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2020-35950
18 Aug 2020 — An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint). Se detectó un problema en el plugin XCloner Backup and Restore versiones anteriores a 4.2.153 para WordPress. Permite un ataque de tipo CSRF (por medio de casi cualquier endpoint). • https://wpscan.com/vulnerability/10413 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 8%CPEs: 1EXPL: 1CVE-2020-13424
https://notcve.org/view.php?id=CVE-2020-13424
23 May 2020 — The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure. El componente XCloner versiones anteriores a 3.5.4 para Joomla!, permite una Divulgación de Archivo Local Autenticada • https://github.com/mkelepce/CVE-2020-13424 •
CVSS: 9.8EPSS: 6%CPEs: 2EXPL: 4CVE-2014-8603 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-8603
17 Oct 2014 — cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable. c... • https://packetstorm.news/files/id/129011 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 8%CPEs: 2EXPL: 4CVE-2014-8604 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8604
17 Oct 2014 — The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! devuelve la contraseña MySQL en texto plano al cuadro de texto en el panel de configuración, lo que permite a atacantes remotos obtener información sensible a través de vectores no especificados. XCloner plugin version 3.1... • https://packetstorm.news/files/id/129011 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 7%CPEs: 2EXPL: 4CVE-2014-8605 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Improper Access Control to Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8605
17 Oct 2014 — The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! almacena ficheros de copias de seguridad de la base de datos con nombres previsibles bajo el root web con un control de acceso insuficiente, lo que permite a ... • https://packetstorm.news/files/id/129011 • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 7%CPEs: 2EXPL: 4CVE-2014-8606 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2014-8606
17 Oct 2014 — Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php. Vulnerabilidad de salto de directorio en el plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! permite a administradores remotos leer ficheros arbitrarios a través de un .. • https://packetstorm.news/files/id/129011 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 4CVE-2014-8607 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8607
17 Oct 2014 — The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! proporciona el nombre de usuario y la contraseña de MySQL en la línea de comando, lo que permite a usuarios locales obtener información sensible a través de el comando ps. The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! • https://packetstorm.news/files/id/129011 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •