Full Path Disclosure in file upload

Skrevet den af i WordPress

WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.

Full Path Disclosure (FPD) during File Upload.

http://www.cvedetails.com/cve/CVE-2013-2203/

http://core.trac.wordpress.org/changeset/24464/branches/3.5

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4
  • WordPress 3.0.5
  • WordPress 3.0.6
  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.4
  • WordPress 3.4.1
  • WordPress 3.4.2
  • WordPress 3.5
  • WordPress 3.5.1

XSS vulnerability in style filter

Skrevet den af i WordPress

A cross-site scripting issue that a contributor or author could use to compromise a site.

See https://wordpress.org/news/2014/11/wordpress-4-0-1/

This vulnerability affects the following application versions:

  • WordPress 2.8.1
  • WordPress 2.8.2
  • WordPress 2.8.3
  • WordPress 2.8.4
  • WordPress 2.8.5
  • WordPress 2.8.6
  • WordPress 2.9
  • WordPress 2.9.1
  • WordPress 2.9.2
  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4
  • WordPress 3.0.5
  • WordPress 3.0.6
  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.3
  • WordPress 3.3.1
  • WordPress 3.3.2
  • WordPress 3.3.3
  • WordPress 3.4
  • WordPress 3.4.1
  • WordPress 3.4.2
  • WordPress 3.5
  • WordPress 3.5.1
  • WordPress 3.5.2
  • WordPress 3.6
  • WordPress 3.6.1
  • WordPress 3.7
  • WordPress 3.7.1
  • WordPress 3.7.2
  • WordPress 3.7.3
  • WordPress 3.7.4
  • WordPress 3.8
  • WordPress 3.8.1
  • WordPress 3.8.2
  • WordPress 3.8.3
  • WordPress 3.8.4
  • WordPress 3.9
  • WordPress 3.9.1
  • WordPress 3.9.2
  • WordPress 4.0

Privilege escalation in deactivating plugins

Skrevet den af i WordPress

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

http://www.cvedetails.com/cve/CVE-2012-2402/

http://core.trac.wordpress.org/changeset/20526/branches/3.3

This vulnerability affects the following application versions:

  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.3
  • WordPress 3.3.1

Taxonomy get_terms SQL injection

Skrevet den af i WordPress

SQL injection in get_terms.

http://www.cvedetails.com/cve/CVE-2011-3130/

http://core.trac.wordpress.org/changeset/21759

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4
  • WordPress 3.0.5
  • WordPress 3.0.6
  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.3
  • WordPress 3.3.1
  • WordPress 3.3.2
  • WordPress 3.3.3
  • WordPress 3.4
  • WordPress 3.4.1

XSS in get_pagenum_link

Skrevet den af i WordPress

xss in get_pagenum_link()

http://core.trac.wordpress.org/ticket/14556

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4
  • WordPress 3.0.5
  • WordPress 3.0.6
  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.3
  • WordPress 3.3.1
  • WordPress 3.3.2

XSS vulnerability in Press This error handling

Skrevet den af i WordPress

A cross-site scripting issue that a contributor or author could use to compromise a site.

See https://wordpress.org/news/2014/11/wordpress-4-0-1/

This vulnerability affects the following application versions:

  • WordPress 2.9
  • WordPress 2.9.1
  • WordPress 2.9.2
  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4
  • WordPress 3.0.5
  • WordPress 3.0.6
  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.3
  • WordPress 3.3.1
  • WordPress 3.3.2
  • WordPress 3.3.3
  • WordPress 3.4
  • WordPress 3.4.1
  • WordPress 3.4.2
  • WordPress 3.5
  • WordPress 3.5.1
  • WordPress 3.5.2
  • WordPress 3.6
  • WordPress 3.6.1
  • WordPress 3.7
  • WordPress 3.7.1
  • WordPress 3.7.2
  • WordPress 3.7.3
  • WordPress 3.7.4
  • WordPress 3.8
  • WordPress 3.8.1
  • WordPress 3.8.2
  • WordPress 3.8.3
  • WordPress 3.8.4
  • WordPress 3.9
  • WordPress 3.9.1
  • WordPress 3.9.2
  • WordPress 4.0

Unfiltered HTML in Multisite

Skrevet den af i WordPress

The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.

http://www.cvedetails.com/cve/CVE-2012-3383/

http://core.trac.wordpress.org/changeset/21774

This vulnerability affects the following application versions:

  • WordPress 3.4
  • WordPress 3.4.1

Full Path Disclosure in file upload

Skrevet den af i WordPress

WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.

Full Path Disclosure (FPD) during File Upload.

http://www.cvedetails.com/cve/CVE-2013-2203/

http://core.trac.wordpress.org/changeset/24464/branches/3.5

This vulnerability affects the following application versions:

  • WordPress 3.3
  • WordPress 3.3.1
  • WordPress 3.3.2
  • WordPress 3.3.3

Denial of Service in XML-RPC processing

Skrevet den af i WordPress

The XML processing of XML-RPC requests is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site’s database to reach the maximum number of open connections. Any of these may lead to the site becoming unavailable or unresponsive (denial of service).

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4
  • WordPress 3.0.5
  • WordPress 3.0.6
  • WordPress 3.1
  • WordPress 3.1.1
  • WordPress 3.1.2
  • WordPress 3.1.3
  • WordPress 3.1.4
  • WordPress 3.2
  • WordPress 3.2.1
  • WordPress 3.3
  • WordPress 3.3.1
  • WordPress 3.3.2
  • WordPress 3.3.3
  • WordPress 3.4
  • WordPress 3.4.1
  • WordPress 3.4.2
  • WordPress 3.5
  • WordPress 3.5.1
  • WordPress 3.5.2
  • WordPress 3.6
  • WordPress 3.6.1
  • WordPress 3.7
  • WordPress 3.7.1
  • WordPress 3.7.2
  • WordPress 3.7.3
  • WordPress 3.8
  • WordPress 3.8.1
  • WordPress 3.8.2
  • WordPress 3.8.3
  • WordPress 3.9
  • WordPress 3.9.1

XSS in post_status, comment_status and ping_status

Skrevet den af i WordPress

Fix XSS bug: Properly encode title used in Quick/Bulk Edit, and offer additional sanitization to various fields. Affects users of the Author or Contributor role.

http://www.cvedetails.com/cve/CVE-2011-0700/
http://core.trac.wordpress.org/changeset/17406
http://core.trac.wordpress.org/changeset/17397
http://core.trac.wordpress.org/changeset/17412

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4

XSS in wp-includes/class-wp-embed.php maybe_make_link

Skrevet den af i WordPress

Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.

http://www.cvedetails.com/cve/CVE-2013-0236/

http://core.trac.wordpress.org/changeset/23322/branches/3.5

This vulnerability affects the following application versions:

  • WordPress 3.5

XSS vulnerabilities in the KSES library

Skrevet den af i WordPress

Multiple XSS vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

http://www.cvedetails.com/cve/CVE-2010-4536/
http://core.trac.wordpress.org/changeset/17172

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3

Attachment disclosure in wp-includes/post.php

Skrevet den af i WordPress

WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.

http://www.cvedetails.com/cve/CVE-2011-3128/

This vulnerability affects the following application versions:

  • WordPress 3.0
  • WordPress 3.0.1
  • WordPress 3.0.2
  • WordPress 3.0.3
  • WordPress 3.0.4