3.3 : Security Vulnerabilities

Cpe Name:cpe:/a:wordpress:wordpress:3.3

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2012-4422	264			2012-09-14	2012-09-17	3.5	None	Remote	Medium	Single system	None	Partial	None
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
2	CVE-2012-4421	264		Bypass	2012-09-14	2012-09-17	4.0	None	Remote	Low	Single system	None	Partial	None
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.
3	CVE-2012-3385	264		+Info	2012-07-22	2012-07-23	5.0	None	Remote	Low	Not required	Partial	None	None
WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.
4	CVE-2012-3384	352		CSRF	2012-07-22	2012-08-09	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
5	CVE-2012-2404	79		XSS	2012-04-21	2012-06-28	4.3	None	Remote	Medium	Not required	None	Partial	None
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
6	CVE-2012-2403	79		XSS	2012-04-21	2012-06-28	4.3	None	Remote	Medium	Not required	None	Partial	None
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
7	CVE-2012-2402	264		Bypass	2012-04-21	2012-06-28	5.5	None	Remote	Low	Single system	None	Partial	Partial
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
8	CVE-2012-2401	264		Bypass	2012-04-21	2012-06-28	5.0	None	Remote	Low	Not required	None	Partial	None
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
9	CVE-2012-2400				2012-04-21	2012-06-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
10	CVE-2012-2399				2012-04-21	2012-06-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in wp-includes/js/swfupload/swfupload.swf in WordPress before 3.3.2 has unknown impact and attack vectors.
11	CVE-2012-1936	352		CSRF	2012-05-03	2012-05-10	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
DISPUTED The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations.
12	CVE-2012-0937		1	DoS	2012-01-30	2012-01-31	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time.
13	CVE-2012-0782	79	1	XSS	2012-01-30	2012-01-31	4.3	None	Remote	Medium	Not required	None	Partial	None
DISPUTED Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance.
14	CVE-2012-0287	79		XSS	2012-01-05	2012-10-11	2.6	None	Remote	High	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.
15	CVE-2011-4899		1	Exec Code Sql XSS	2012-01-30	2012-01-31	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments.
16	CVE-2011-4898	200	1	+Info	2012-01-30	2012-01-31	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective.

Total number of vulnerabilities : 16 Page : 1 (This Page)