Информационная безопасность
[RU] switch to English


CVECVE-2007-1049
СтатусCandidate
ОписаниеCross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
Важность
Low
CVSS score1,9
CVSS vector(AV:R/AC:H/Au:NR/C:N/I:P/A:N/B:N)
PhaseAssigned (21.02.2007)
NVD:http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1049
ReferencesBID : 22534
 SECUNIA : 24306
 SECUNIA : 24566
 FRSIRT : ADV-2007-0741
 GENTOO : GLSA-200703-23
 MISC : http://downloads.securityfocus.com/vulnerabilities...
 CONFIRM : http://trac.wordpress.org/changeset/4876
 CONFIRM : http://trac.wordpress.org/changeset/4877
 CONFIRM : http://trac.wordpress.org/ticket/3781
SecurityVulns:Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl )
О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород