Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : https://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use several vulnerabilities of WordPress Core.

Impacted products: Debian, Fedora, WordPress Core.

Severity: 2/4.

Creation date: 22/06/2016.

DESCRIPTION OF THE VULNERABILITY

Several vulnerabilities were announced in WordPress Core.

An attacker can block or tamper with the redirections.
[severity:1/4; CVE-2016-5832]

An attacker can trigger a Cross Site Scripting via the names of
attached files, in order to run JavaScript code in the context of
the web site. [severity:2/4; CVE-2016-5833]

An attacker can trigger a Cross Site Scripting via the names of
attached files, in order to run JavaScript code in the context of
the web site. [severity:2/4; CVE-2016-5834]

An attcker can access to the change log of articles.
[severity:1/4; CVE-2016-5835]

An attacker can trigger a fatal error via oEmbed, in order to
trigger a denial of service. [severity:1/4; CVE-2016-5836]

An attacker can remove categories in which an article is
registered. [severity:1/4; CVE-2016-5837]

An attacker can change the password of another user with a stolen
cookie. [severity:2/4; CVE-2016-5838]

The routine sanitize_file_name accepts invalid names.
[severity:2/4; CVE-2016-5839]

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

https://vigilance.fr/vulnerability/WordPress-Core-eight-vulnerabilities-19952