CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 64286 | CVE-2013-4339 | Candidate | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string. | Assigned (20130612) | None (candidate not yet proposed) | View | |
| 62150 | CVE-2013-2203 | Candidate | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message. | Assigned (20130219) | None (candidate not yet proposed) | View | |
| 62147 | CVE-2013-2200 | Candidate | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. | Assigned (20130219) | None (candidate not yet proposed) | View | |
| 62149 | CVE-2013-2202 | Candidate | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | Assigned (20130219) | None (candidate not yet proposed) | View | |
| 56628 | CVE-2012-3385 | Candidate | WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors. | Assigned (20120614) | None (candidate not yet proposed) | View |
Page 145 of 20943, showing 5 records out of 104715 total, starting on record 721, ending on 725
