4149 matches found
CVE-2017-5493
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
Design/Logic Flaw
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
UBUNTU-CVE-2017-5493
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
CVE-2017-5493
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
CVE-2017-5493
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
CVE-2017-5493
The CVE-2017-5493 issue affects WordPress multisite activation keys in wp-includes/ms-functions.php. The root cause is weak randomness when generating multisite activation keys, which can let an unauthenticated remote attacker bypass access restrictions during (1) site signup or (2) user signup. ...
CVE-2017-5493
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
CVE-2017-5493: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...
PT-2017-16534
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.1 Description The issue concerns the Multisite WordPress API, where the wp-includes/ms-functions.php file does not properly generate random numbers for keys. This weakness allows remote attackers to bypass...
Wordpress Plugin Multisite Post Duplicator Cross-Site Request Forgery Vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A cross-site request forgery vulnerability exists in the tools.php page of version 0.9.5.1 of the Wordpress plug...
WordPress Multisite Post Duplicator 0.9.5.1 Plugin - Cross-Site Request Forgery Vulnerability
Exploit for php platform in category web applications alert1" input type="text" name=...
WordPress Plugin Multisite Post Duplicator 0.9.5.1 - Cross-Site Request Forgery
WordPress Plugin Multisite Post Duplicator 0.9.5.1 - Cross-Site Request Forgery alert1" input type="text" name="el0"...
WordPress Plugin Multisite Post Duplicator 0.9.5.1 - Cross-Site Request Forgery
alert1" input type=...
WordPress Multisite Post Duplicator Plugin <= 0.9.5.1 - Cross Site Request Forgery
This plugin is prone to a cross site request forgery vulnerability. Solution Update the plugin...
WordPress Multisite Post Duplicator Plugin <= 0.9.5.1 - Cross Site Request Forgery
This plugin is prone to a cross site request forgery vulnerability. Solution Update the plugin...
WordPress Multisite Post Duplicator 0.9.5.1 Cross Site Request Forgery
Details ================ Software: Multisite Post Duplicator Version: 0.9.5.1 Homepage: http://wordpress.org/plugins/multisite-post-duplicator/ Advisory report:...
Multisite Post Duplicator <= 0.9.5.1 - Cross-Site Request Forgery (CSRF)
The Multisite Post Duplicator WordPress plugin was affected by a Cross-Site Request Forgery CSRF security vulnerability...
WP Maintenance Mode <= 2.0.6 - Authenticated Multisite Remote Code Execution
The WP Maintenance Mode WordPress plugin was affected by an Authenticated Multisite Remote Code Execution security vulnerability...
CVE-2015-6535: Stored XSS in YouTube Embed (WordPress plugin) allows admins to compromise super admins
Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N Description ================ A stored XSS vulnerability in YouTube Embed 3.3.2 and...
Recent Posts Widget Extended <= 0.9.9.3 - Authenticated XSS (multisite)
XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field. This vulnerability is currently unpatched. 1. Login as single site administrator 2. Add Recent Posts Extended Widget to some widget area 3. Add...