PT-2014-2678

Name of the Vulnerable Software and Affected Versions WordPress Related Posts plugin versions prior to 2.6.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that change settings. Recommendations For versions prior to 2.6.2,...

PT-2014-2666

Name of the Vulnerable Software and Affected Versions Related Posts plugin versions prior to 2.7.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack user authentication for requests that modify settings. Recommendations For versions prior to 2.7.2, update to...

PT-2014-2623

Name of the Vulnerable Software and Affected Versions Contextual Related Posts plugin versions prior to 1.8.7 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks...

CVE-2014-3937: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Contextual Related Posts plugin before 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-3477

The CVE-2013-3477 vulnerability is a CSRF flaw in the WordPress plugin Related Posts by Zemanta up to version 1.3.1/1.3.1 (and before 1.3.2), allowing remote attackers to hijack user authentication and change settings via unknown vectors. Affected component: Related Posts by Zemanta plugin; impac...

CVE-2013-3477: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Related Posts by Zemanta plugin before 1.3.2 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that change settings via unknown vectors...

Jetpack Plugin for WordPress Security Bypass

The WordPress Jetpack plugin installed on the remote host is affected by a security bypass vulnerability due to a flaw in the 'class.jetpack.php' script. This can allow a remote, unauthenticated attacker to submit crafted XML-RPC requests that bypass access controls, allowing the attacker to...

CVE-2014-0173

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to...

CVE-2014-0173: Undefined Security Weakness

The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to...

PT-2014-3516

Name of the Vulnerable Software and Affected Versions Jetpack plugin versions 1.9 through 1.9.3 Jetpack plugin versions 2.0.x through 2.0.8 Jetpack plugin versions 2.1.x through 2.1.3 Jetpack plugin versions 2.2.x through 2.2.6 Jetpack plugin versions 2.3.x through 2.3.6 Jetpack plugin versions...

CVE-2014-0165

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

DEBIAN-CVE-2014-0165

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

CVE-2014-0165

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

CVE-2014-0165

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

CVE-2014-0165: Undefined Security Weakness

WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php...

PT-2014-3510

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.7.2 WordPress versions 3.8.x prior to 3.8.2 Description The issue allows remote authenticated users to publish posts by leveraging the Contributor role. This is related to the files wp-admin/includes/post.php and...

Sql injection

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the 1 newsid parameter to news/send.php, 2 threadid parameter to posts/edit.php, or 3 useremail parameter to users/password.php or 4 users/register.php. NOTE: these issues were SPLIT...

CVE-2013-5640

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the 1 answerid or 2 questionid parameter to polls/vote.php, 3 storyid parameter to comments/add.php or 4 comments/edit.php, or 5 threadid parameter to posts/add.php. NOTE: this issue...

Sql injection

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the 1 answerid or 2 questionid parameter to polls/vote.php, 3 storyid parameter to comments/add.php or 4 comments/edit.php, or 5 threadid parameter to posts/add.php. NOTE: this issue...

PT-2014-3384

Name of the Vulnerable Software and Affected Versions Gnew version 2013.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the news id parameter to "news/send.php", the thread id parameter to "posts/edit.php", or the user email parameter to...