Ike.ninja

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Low
• Versions: 2.5.0 through 3.9.1
• Exploit type: XSS
• Reported Date: 2018-December-01
• Fixed Date: 2019-January-15
• CVE Number: CVE-2019-6264

Description

Inadequate escaping in mod_banners leads to a stored XSS vulnerability.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

The post WordPress 5.0 and Gutenberg – What you should expect appeared first on Plesk.

(Jan 14) Guido Vranken discovered that an incorrect bounds check in ZeroMQ, a lightweight messaging kernel, could result in the execution of arbitrary code.

(Jan 14) GNOME Bluetooth could allow unintended access to devices.

(Jan 14) An update for systemd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

The post Website Management Routine Basics appeared first on Plesk.

(Jan 11) **Horde_Image 2.5.4** * [mjr] SECURITY: Fix potential RCE in the text method when using the Imagemagick backend. * [mjr] SECURITY: Sanitize image type parameter (PR: 2, Fariskhi Vidyan). * [mjr] Fix issues with escaping single and double quote characters in the text method when using the Imagemagick backend.

(Jan 11) backport anti-phishing fixes

(Jan 12) Resolves CVE-2018-16869

(Jan 10) Several security issues were fixed in Exiv2.

The post Best practices to strengthen Plesk server security appeared first on Plesk.

(Jan 11) **Horde_Image 2.5.4** * [mjr] SECURITY: Fix potential RCE in the text method when using the Imagemagick backend. * [mjr] SECURITY: Sanitize image type parameter (PR: 2, Fariskhi Vidyan). * [mjr] Fix issues with escaping single and double quote characters in the text method when using the Imagemagick backend.

(Jan 10) GnuPG could allow unintended access to network services.

WordPress 5.1 Beta 1 is now available! This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site to play with the new version. There are two ways to test the WordPress 5.1 beta: try the WordPress Beta Tester plugin (you’ll want to select the “bleeding […]

The post Guard your WordPress security: Understand SQL injections appeared first on Plesk.