The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache. Rated low severity (CVSS 1.9). Public exploit code available and no vendor patch available.
Information Disclosure
Race Condition
Accountsservice
NVD
CVSS 2.0
1.9
EPSS
0.1%
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. No vendor patch available.
WordPress
Privilege Escalation
PHP
XSS
NVD
CVSS 2.0
2.6
EPSS
0.2%