Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
|
|
| |
|
| |
wordpress: multiple vulnerabilities
| Package(s): | wordpress |
CVE #(s): | CVE-2007-0262
CVE-2007-0539
CVE-2007-0541
|
| Created: | February 13, 2007 |
Updated: | February 14, 2007 |
| Description: |
Wordpress does not properly verify that the m parameter value has the
string data type, which allows remote attackers to obtain sensitive
information via an invalid m[] parameter, as demonstrated by obtaining the
path, and obtaining certain SQL information such as the table
prefix. (CVE-2007-0262)
WordPress before 2.1 allows remote attackers to cause a denial of service
(bandwidth or thread consumption) via pingback service calls with a source
URI that corresponds to a large file, which triggers a long download
session without a timeout constraint. (CVE-2007-0539)
WordPress allows remote attackers to determine the existence of arbitrary
files, and possibly read portions of certain files, via pingback service
calls with a source URI that corresponds to a local pathname, which
triggers different fault codes for existing and non-existing files, and in
certain configurations causes a brief file excerpt to be published as a
blog comment. (CVE-2007-0541) |
| Alerts: |
|
( Log in to post comments)
|
|
|