CVE-2010-4478critical · CVSS 9.8 — OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remot
CVE-2010-4755medium · CVSS 4.0 — The (1) remote_glob function in sftp-glob.c and the (2) process_put function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 an
CVE-2012-0814medium · CVSS 6.5 — The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command o
CVE-2011-5000low · CVSS 3.5 — The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote
CVE-2010-5107high · CVSS 7.5 — The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, w
CVE-2011-4327medium · CVSS 5.5 — ssh-keysign.c in ssh-keysign in OpenSSH before 5.8p2 on certain platforms executes ssh-rand-helper with unintended open file descriptors, wh
CVE-2014-2532medium · CVSS 4.2 — sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass in
CVE-2014-2653medium · CVSS 6.5 — The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP
CVE-2016-0777medium · CVSS 6.5 — The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensit
CVE-2020-15778high · CVSS 7.4 — scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destinat
CVE-2023-38408critical · CVSS 9.8 — The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
CVE-2009-2853critical · CVSS 10.0 — Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php,
CVE-2011-4898medium · CVSS 5.0 — wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki
CVE-2011-4899high · CVSS 7.5 — wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser
CVE-2012-0782medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlie
CVE-2012-0937medium · CVSS 5.0 — wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to ex
CVE-2012-2399critical · CVSS 10.0 — Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image
CVE-2012-2400critical · CVSS 10.0 — Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
CVE-2012-2401medium · CVSS 5.0 — Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the
CVE-2012-2402medium · CVSS 5.5 — wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and de
CVE-2012-2403medium · CVSS 4.3 — wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote
CVE-2012-2404medium · CVSS 4.3 — wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site
CVE-2012-1936medium · CVSS 6.8 — The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a
CVE-2011-4956medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec
CVE-2011-4957medium · CVSS 5.0 — The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the
CVE-2012-3384medium · CVSS 6.8 — Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentica
CVE-2012-3385medium · CVSS 5.0 — WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or con
CVE-2010-5106medium · CVSS 6.5 — The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote au
CVE-2012-4421medium · CVSS 4.0 — The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows
CVE-2012-4422low · CVSS 3.5 — wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges b
CVE-2013-0235medium · CVSS 6.4 — The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attack
CVE-2013-0236medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML
CVE-2013-0237medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other prod
CVE-2013-2199medium · CVSS 4.3 — The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to
CVE-2013-2200medium · CVSS 4.0 — WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restric
CVE-2013-2201medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML
CVE-2013-2202medium · CVSS 4.3 — WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec
CVE-2013-2203medium · CVSS 4.3 — WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an inva
CVE-2013-2204medium · CVSS 4.3 — moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider
CVE-2013-2205medium · CVSS 4.3 — The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote atta
CVE-2012-3414medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image
CVE-2010-5293medium · CVSS 5.8 — wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote
CVE-2010-5294medium · CVSS 4.3 — Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPres
CVE-2010-5295medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary
CVE-2010-5296medium · CVSS 4.9 — wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for th
CVE-2010-5297low · CVSS 2.1 — WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once chang
CVE-2011-5270medium · CVSS 4.0 — wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticat
CVE-2012-6633medium · CVSS 4.3 — Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbi
CVE-2012-6634medium · CVSS 6.4 — wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachm
CVE-2012-6635medium · CVSS 4.0 — wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remot