CVE-2019-8942

CVE-2019-8942 и CVE-2019-8943: WordPress RCE привилегии автора Обзор CVE-2019-8942 — это уязвимость, использующая ошибку LFI в сочетании с функцией загрузки файлов для выполнения RCE на веб-сервере WordPress с правами автора. Затронутые версии WordPress — до 4.9.9 и 5.x до 5.0.1, что позволяет...

WordPress < 5.0.4 Directory Traversal Vulnerability

According to its self-reported version number, the WordPress application running on the remote web server is prior to 5.0.4. It is, therefore, affected by a directory traversal vulnerability in its wpcropimage component. An authenticated, remote attacker can exploit this, by sending a URI that...

DEBIAN-CVE-2019-8943

WordPress through 5.0.3 allows Path Traversal in wpcropimage. An attacker who has privileges to crop an image can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring...

CVE-2019-8943: Improper Limitation of a Pathname to a Restricted Directory

WordPress through 5.0.3 allows Path Traversal in wpcropimage. An attacker who has privileges to crop an image can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring...