Computer Security
[EN] securityvulns.ru no-pyccku


WiFi Pineapple protection bypass
Published:24.08.2015
Source:
SecurityVulns ID:14658
Type:remote
Threat Level:
4/10
Description:Predictable CSRF tokens.
Affected:WORDPRESS : Wordpress 4.2
 WIFIPINEAPPLE : WiFi Pineapple 2.3
CVE:CVE-2015-5734 (Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.)
 CVE-2015-5732 (Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.)
 CVE-2015-5731 (Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.)
 CVE-2015-5730 (The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.)
 CVE-2015-5622 (Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.)
 CVE-2015-4624
 CVE-2015-2213
Original documentdocumentKen, [CVE-2015-4624] Predictable CSRF tokens in WiFi Pineapple firmware <= 2.3.0 (24.08.2015)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod