diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 4f0937f5b19c..f197c8105a84 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,54 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + wordpress -- multiple vulnerabilities + + + wordpress + 4.7.2,1 + + + de-wordpress + ja-wordpress + ru-wordpress + zh-wordpress-zh_CN + zh-wordpress-zh_TW + 4.7.2 + + + + +

Aaron D. Campbell reports:

+
+

WordPress versions 4.7.1 and earlier are affected by three security + issues:

+
    +
  • The user interface for assigning taxonomy terms in Press This is + shown to users who do not have permissions to use it.
    • +
  • WP_Query is vulnerable to a SQL injection (SQLi) when passing + unsafe data. WordPress core is not directly vulnerable to this + issue, but we’ve added hardening to prevent plugins and + themes from accidentally causing a vulnerability.
    • +
  • A cross-site scripting (XSS) vulnerability was discovered in the + posts list table.
    • +
+
+ + + + CVE-2017-5610 + CVE-2017-5611 + CVE-2017-5612 + http://www.openwall.com/lists/oss-security/2017/01/28/5 + https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/ + + + 2017-01-26 + 2017-01-29 + + + nfsen -- remote command execution