Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Remediation

References

CVE-2012-2401

Related Vulnerabilities

Python Uncontrolled Resource Consumption Vulnerability (CVE-2021-3733)

PleskWin Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2013-0132)

WordPress Plugin YouTube Cross-Site Request Forgery (11.8.1)

Oracle Database Server CVE-2016-0499 Vulnerability (CVE-2016-0499)

ClipBucket Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-1000307)

Severity

Medium

Classification

CVE-2012-2401 CWE-264

Tags

Missing Update Known Vulnerabilities