WordPress <=2.8.3 wp-admin多个权限绕过漏洞

No description provided by source...

CVE-2009-3891

Cross-site scripting XSS vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter aka the selection variable...

CVE-2009-3891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter aka the selection variable...

CVE-2008-7175: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action...

WordPress 'wp-admin' Multiple Vulnerabilities (Aug 2009)

WordPress is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescripti...

CVE-2009-2854

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to 1 edit-comments.php, 2 edit-pages.php, 3 edit.php, 4 edit-category-form.php, 5 edit-link-category-form.php, 6 edit-tag-form.php, 7...

DEBIAN-CVE-2009-2853

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to 1 admin-footer.php, 2 edit-category-form.php, 3 edit-form-advanced.php, 4 edit-form-comment.php, 5 edit-link-category-form.php, 6 edit-link-form.php, 7 edit-page-form.php, and 8 edit-tag-form.php in wp-admin...

CVE-2009-2854

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to 1 edit-comments.php, 2 edit-pages.php, 3 edit.php, 4 edit-category-form.php, 5 edit-link-category-form.php, 6 edit-tag-form.php, 7...

CVE-2009-2854: Undefined Security Weakness

Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to 1 edit-comments.php, 2 edit-pages.php, 3 edit.php, 4 edit-category-form.php, 5 edit-link-category-form.php, 6 edit-tag-form.php, 7...

CVE-2009-2853: Undefined Security Weakness

Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to 1 admin-footer.php, 2 edit-category-form.php, 3 edit-form-advanced.php, 4 edit-form-comment.php, 5 edit-link-category-form.php, 6 edit-link-form.php, 7 edit-page-form.php, and 8 edit-tag-form.php in wp-admin...

CVE-2009-2334: Improper Authentication

wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as...

CVE-2008-6762

Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter...

CVE-2008-6762: Improper Link Resolution Before File Access

Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter...

CVE-2008-6767: Undefined Security Weakness

wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service application outage, via a direct request...

WordPress <= 2.6.9 - Open Redirection

Because of this vulnerability in wp-admin/upgrade.php, the attackers can redirect users to arbitrary web sites and conduct phishing attacks via a URL in the "backto" parameter. Solution Update WordPress...

CVE-2008-5695: Improper Input Validation

wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manageoptions and uploadfiles capabilities to execute arbitrary code by uploading a PHP script and adding this...

CVE-2008-4671: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/wp-blogs.php in Wordpress MU WPMU before 2.6 allows remote attackers to inject arbitrary web script or HTML via the 1 s and 2 ipaddress parameters...

CVE-2008-1304

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 inviteemail parameter in an invite action to wp-admin/users.php and the 2 to parameter in a sent action to wp-admin/invites.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 inviteemail parameter in an invite action to wp-admin/users.php and the 2 to parameter in a sent action to wp-admin/invites.php...

CVE-2008-1304

CVE-2008-1304 concerns WordPress 2.3.2, which is affected by multiple XSS vulnerabilities in two parameters: (1) inviteemail in wp-admin/users.php (invite action) and (2) the to parameter in a sent action to wp-admin/invites.php. The underlying issue is cross-site scripting that could allow remot...