186 matches found
Design/Logic Flaw
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2014-8603
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the 1 file name when creating a backup or vectors related to the 2 $CONFIGtarpath, 3 $exclude, 4 $CONFIG'tarcompress', 5...
CVE-2014-8603
The CVE-2014-8603 issue affects the XCloner Backup and Restore plugin for WordPress (3.1.1) and Joomla! (3.5.1). The vulnerability arises from cloner.functions.php, allowing remote code execution via shell metacharacters in the backup file name or in multiple configuration variables (e.g., tarpat...
CVE-2014-8604
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration panel, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2014-8605
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/...
CVE-2014-8607
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command...
CVE-2014-8606
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...
CVE-2014-8607
The CVE-2014-8607 entry concerns the XCloner Backup and Restore plugin for WordPress (3.1.1) and Joomla (3.5.1). The public description states that the plugin exposes the MySQL username and password on the command line, enabling local users to read sensitive information via the ps command. Connec...
CVE-2014-8604
The CVE-2014-8604 entry concerns the XCloner Backup and Restore plugin for WordPress (3.1.1) and Joomla (3.5.1). The vulnerability is that the plugin returns the MySQL password in cleartext to a configuration panel text box, allowing remote attackers to obtain sensitive information via unspecifie...
CVE-2014-8603
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the 1 file name when creating a backup or vectors related to the 2 $CONFIGtarpath, 3 $exclude, 4 $CONFIG'tarcompress', 5...
CVE-2014-8606
The CVE-2014-8606 entry concerns XCloner Backup and Restore for WordPress (v3.1.1) and Joomla! (v3.5.1). The vulnerability is a directory traversal flaw in the xcloner_show page, exploited by sending a .. in the file parameter of the json_return action to wp-admin/admin-ajax.php, allowing remote ...
CVE-2014-8605
The CVE concerns the XCloner Backup and Restore plugin for WordPress (v3.1.1) and Joomla! (v3.5.1), where database backup files are stored under the web root with predictable names due to insufficient access control. This allows remote attackers to obtain sensitive information by directly request...
WordPress Plugin XCloner Remote Command Execution Vulnerability
WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL server set up a personal blog site. XCloner is one of the plug-ins for backing up and restoring data and databases. A remote command execution...
WordPress plugin XCloner cross-site scripting vulnerability
WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL server set up a personal blog site. XCloner is one of the plug-ins for backing up and restoring data and databases. WordPress plugin XCloner suffers...
WordPress XCloner Plugin <= 3.1.2 - Multiple vulnerabilities
This XCloner plugin is prone to an authenticated command execution and XSS. Because of multiple vulnerabilities in cloner.functions.php, remote authenticated users can execute arbitrary commands via a file containing filenames with shell metacharacters. Solution Update the plugin...
WordPress XCloner Plugin <= 3.1.2 - Static Code Injection
Because of this vulnerability remote authenticated users can inject arbitrary PHP code into the language files via a Translation LMFRONT field for a language. Solution Update the plugin...
WordPress XCloner Plugin <= 3.1.2 - XSS
Because of this vulnerability, remote authenticated users can inject arbitrary web script or HTML in the xclonershow page via the "exclmanual" parameter to wpadmin/plugins.php. Solution Update the plugin...
WordPress XCloner 3.1.2 XSS / Command Execution
Title: Xloner v3.1.2 wordpress plugin authenticated command execution and XSS Author: Larry W. Cashdollar, @larry0 Date: 2015-05-10 Download Site: https://wordpress.org/plugins/xclonerbackupandrestore/ http://extensions.joomla.org/extensions/accessasecurity/ sitesecurity/ backup/665 Vendor: Ovidi...
XCloner - Backup and Restore 3.1.2 - XSS & Command Execution
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin was affected by a Backup and Restore 3.1.2 - XSS & Command Execution security vulnerability...
XCloner Wordpress/Joomla! backup Plugin v3.1.1 (Wordpress) v3.5.1 (Joomla!) Vulnerabilities
Title: XCloner Wordpress/Joomla! backup Plugin v3.1.1 Wordpress v3.5.1 Joomla! Vulnerabilities Author: Larry W. Cashdollar, @larry0 Date: 10/17/2014 Download: https://wordpress.org/plugins/xcloner-backup-and-restore/ Download:...