354 results · Feed
-
Unscored —
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add use…
-
Unscored —
wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll,…
-
Unscored —CVE-2013-7233 Public exploit
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPr…
-
Unscored —
wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which…
-
Unscored —
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a pos…
-
Unscored —
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to…
-
Unscored —
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfilte…
-
Unscored —
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make i…
-
Unscored —CVE-2012-3414 Public exploit
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrar…
-
Unscored —
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before…
-
Unscored —
The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, whi…
-
Unscored —
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other produc…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrar…
-
Unscored —
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecifie…
-
Unscored —
WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to by…
-
Unscored —
WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing a…
-
Unscored —
WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive in…
-
Unscored —
wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to caus…
-
Medium —
PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests
classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle cont…
-
Unscored —
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes i…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hij…
-
Unscored —
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-admin…
-
Unscored —
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capabilit…
-
Unscored —
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, w…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to …
-
Unscored —
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature i…
-
Unscored —
WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows …
-
Unscored —
Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web scri…
-
Unscored —
The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before…
-
Unscored —
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vector…
-
Unscored —
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers t…
-
Unscored —
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes …
-
Unscored —
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables script…
-
Unscored —
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before…
-
Unscored —
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended acces…
-
Unscored —CVE-2011-4898 Public exploit
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messag…
-
Unscored —CVE-2011-4899 Public exploit
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specifi…
-
Unscored —CVE-2012-0937 Public exploit
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MyS…