Archive for security

987 results.

Update to WHM’s Create Ticket Interface

Feb21
by Ike on February 21, 2019 at 6:00 pm
Posted In: Uncategorized

If you’re not familiar with the Create Support Ticket interface, this tool lives inside WHM and allows a root user to create a support ticket with the cPanel Support staff. How is this more beneficial than logging in to Manage2 or using a form to submit a ticket? The Create Support Ticket tool streamlines and automates much of the process, including ensuring our support team will be able to access your server, decreasing the time it …

 Comment 

Say Hello to Email Deliverability!

Feb19
by Ike on February 19, 2019 at 6:48 pm
Posted In: Uncategorized

We’d like to introduce you to one of our newest features in cPanel & WHM version 78. The evolution of cPanel’s Email Authentication Interface to the Email Deliverability interface began with a desire to help users keep their legitimate emails out of Spam folders and turned into what we are showcasing here. These are some of the many improvements we’ve been making in an ongoing effort to help you increase your mail server’s efficiency. What is it?  Previous to v78, …

 Comment 

WordPress 5.1 RC2

Feb19
by Ike on February 19, 2019 at 2:58 am
Posted In: Uncategorized

The second release candidate for WordPress 5.1 is now available! WordPress 5.1 will be released on Thursday, February 21, but we need your help to get there—if you haven’t tried 5.1 yet, now is the time! There are two ways to test the WordPress 5.1 release candidate: try the WordPress Beta Tester plugin (you’ll want […]

EasyApache 4 and mod_lsapi

Feb12
by Ike on February 12, 2019 at 7:00 pm
Posted In: Uncategorized

As of last week’s update, EasyApache 4 includes a light version of mod_lsapi, a module built and distributed by our friends at CloudLinux. This release is a scaled-back version of the module already distributed by CloudLinux. Anyone already using CloudLinux should use the one distributed by CloudLinux, but for everyone else let’s talk about it! What is mod_lsapi? mod_lsapi is an Apache module based on the LiteSpeed Technologies API that provides significant improvements in speed and …

 Comment 

[20190206] – Core – Implement the TYPO3 PHAR stream wrapper

Feb12
by Ike on February 12, 2019 at 3:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: Object Injection
  • Reported Date: 2019-January-18
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7743

Description

The phar:// stream wrapper can be used for objection injection attacks. We now disallow usage of the phar:// handler for non .phar-files within the CMS globally by implementing the TYPO3 PHAR stream wrapper.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: David Jardin (JSST)

 Comment 

[20190205] – Core – XSS Issue in core.js writeDynaList

Feb12
by Ike on February 12, 2019 at 3:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-October-07
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7740

Description

Inadequate parameter handling in JS code could lead to an XSS attack vector.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Dimitris Grammatikogiannis

 Comment 

[20190204] – Core – Stored XSS issue in the Global Configuration help url #2

Feb12
by Ike on February 12, 2019 at 3:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2019-January-16
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7741

Description

Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

 Comment 

[20190203] – Core – Additional warning in the Global Configuration textfilter settings

Feb12
by Ike on February 12, 2019 at 3:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2019-January-17
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7739

Description

“No Filtering” textfilter overrides child settings in the Global Configuration. This is intended behavior but might be unexpected for the user. An additional message is now shown in the configuration dialog.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Raviraj Powar

 Comment 

[20190202] – Core – Browserside mime-type sniffing causes XSS attack vectors

Feb12
by Ike on February 12, 2019 at 3:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 1.0.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-September-24
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7742

Description

A combination of specific webserver configurations, in connection with specific file types and browserside mime-type sniffing causes a XSS attack vector.

Affected Installs

Joomla! CMS versions 1.0.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Hanno Böck

 Comment 

[20190201] – Core – Lack of URL filtering in various core components

Feb12
by Ike on February 12, 2019 at 3:00 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.2
  • Exploit type: XSS
  • Reported Date: 2018-November-13
  • Fixed Date: 2019-February-12
  • CVE Number: CVE-2019-7744

Description

Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.2

Solution

Upgrade to version 3.9.3

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

 Comment 

WordPress 5.1 Release Candidate

Feb08
by Ike on February 8, 2019 at 2:22 am
Posted In: Uncategorized

The first release candidate for WordPress 5.1 is now available! This is an important milestone, as the release date for WordPress 5.1 draws near. “Release Candidate” means that the new version is ready for release, but with millions of users and thousands of plugins and themes, it’s possible something was missed. WordPress 5.1 is scheduled […]

When PHP Went Pear Shaped- The PHP PEAR Compromise

Feb07
by Ike on February 7, 2019 at 7:00 pm
Posted In: Uncategorized

As you may or may not be aware, on January 19th, 2019, a security announcement was published confirming the compromise of the PHP Extension and Application Repository (PEAR) installation script. The PEAR project had the following statement to announce: “A security breach has been found on the http://pear.php.net webserver, with a tainted go-pear.phar discovered. The PEAR website itself has been disabled until a known clean site can be rebuilt. A more detailed announcement will be on the …

 Comment 

The Month in WordPress: January 2019

Feb04
by Ike on February 4, 2019 at 9:17 am
Posted In: Uncategorized

The momentum from December’s WordPress 5.0 release was maintained through January with some big announcements and significant updates. Read on to find out what happened in the WordPress project last month. WordPress Leadership Grows In a milestone announcement this month, WordPress project lead, Matt Mullenweg (@matt), named two individuals who are coming on board to […]

Moving Your WordPress.com site to a cPanel Server

Jan31
by Ike on January 31, 2019 at 7:00 pm
Posted In: Uncategorized

WordPress is the most commonly used CMS (Content Management Software) on the internet, with a market share of 59.5% of websites built on the internet. There are numerous ways to get a WordPress blog up and running for the public to see. One of the more popular ways to publish a blog is WordPress’ official site- WordPress.com. This site offers the opportunities for its users to build and maintain a free WordPress blog. There are downsides to a …

 Comment 

WordPress 5.1 Beta 3

Jan31
by Ike on January 31, 2019 at 3:34 am
Posted In: Uncategorized

WordPress 5.1 Beta 3 is now available! This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site to play with the new version. There are two ways to test the WordPress 5.1 beta: try the WordPress Beta Testerplugin (you’ll want to select the “bleeding […]

WordPress 5.1 Beta 2

Jan22
by Ike on January 22, 2019 at 1:01 am
Posted In: Uncategorized

WordPress 5.1 Beta 2 is now available! This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site to play with the new version. There are two ways to test the WordPress 5.1 beta: try the WordPress Beta Tester plugin (you’ll want to […]

Manufacturing.gov and White House security suffer under U.S. shutdown

Jan16
by Ike on January 16, 2019 at 1:51 pm
Posted In: Uncategorized

Dozens more U.S. government websites have become inaccessible since last week, when Netcraft highlighted the impact of security certificates expiring during the federal shutdown. As of today, more than 130 TLS certificates used by U.S. government websites have expired without being renewed. Some of these sites are now completely inaccessible in modern browsers due to […]

 Comment 

[20190104] – Core – Stored XSS issue in the Global Configuration help url

Jan15
by Ike on January 15, 2019 at 2:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-December-05
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6262

Description

Inadequate checks at the Global Configuration helpurl settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Mario Korth, Hackmanit

 Comment 

[20190103] – Core – Stored XSS issue in the Global Configuration textfilter settings

Jan15
by Ike on January 15, 2019 at 2:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-November-29
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6263

Description

Inadequate checks at the Global Configuration Text Filter settings allowed a stored XSS.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Sébastien Poirier

 Comment 

[20190102] – Core – Stored XSS in com_contact

Jan15
by Ike on January 15, 2019 at 2:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-December-04
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6261

Description

Inadequate escaping in com_contact leads to a stored XSS vulnerability

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

 Comment 

[20190101] – Core – Stored XSS in mod_banners

Jan15
by Ike on January 15, 2019 at 2:45 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: CMS
  • Impact: Low
  • Severity: Low
  • Versions: 2.5.0 through 3.9.1
  • Exploit type: XSS
  • Reported Date: 2018-December-01
  • Fixed Date: 2019-January-15
  • CVE Number: CVE-2019-6264

Description

Inadequate escaping in mod_banners leads to a stored XSS vulnerability.

Affected Installs

Joomla! CMS versions 2.5.0 through 3.9.1

Solution

Upgrade to version 3.9.2

Contact

The JSST at the Joomla! Security Centre.

Reported By: Antonin Steinhauser

 Comment 

WordPress 5.1 Beta 1

Jan11
by Ike on January 11, 2019 at 12:58 am
Posted In: Uncategorized

WordPress 5.1 Beta 1 is now available! This software is still in development, so we don’t recommend you run it on a production site. Consider setting up a test site to play with the new version. There are two ways to test the WordPress 5.1 beta: try the WordPress Beta Tester plugin (you’ll want to select the “bleeding […]

.gov security falters during U.S. shutdown

Jan10
by Ike on January 10, 2019 at 2:57 pm
Posted In: Uncategorized

Dozens of U.S. government websites have been rendered either insecure or inaccessible during the ongoing U.S. federal shutdown. These sites include sensitive government payment portals and remote access services, affecting the likes of NASA, the U.S. Department of Justice, and the Court of Appeals. With around 400,000 federal employees currently furloughed, more than 80 TLS […]

 Comment 

WordPress 5.0.3 Maintenance Release

Jan09
by Ike on January 9, 2019 at 6:56 pm
Posted In: Uncategorized

WordPress 5.0.3 is now available! 5.0.3 is a maintenance release that includes 37 bug fixes and 7 performance updates. The focus of this release was fine-tuning the new block editor, and fixing any major bugs or regressions. Here are a few of the highlights: 15 block editor related bug fixes and improvements have been added […]

Security Advisor 101

Jan08
by Ike on January 8, 2019 at 7:00 pm
Posted In: Uncategorized

Inside the Security Center section of WHM lies a feature that some cPanel & WHM users may not be familiar with. Security Advisor is a feature that when selected, displays possible security concerns that hosting providers will want to address, as well as a solution to that warning message. The settings that are flagged may be problematic in some configurations but are not something that would be addressed through a cPanel & WHM version …

 Comment 

The Month in WordPress: December 2018

Jan08
by Ike on January 8, 2019 at 9:18 am
Posted In: Uncategorized

New features, a big event, and important announcements marked December as a milestone month for the WordPress community. Release of WordPress 5.0 On December 6 WordPress 5.0 was released. This release includes the much anticipated new block editor as the default editing experience. While some users have chosen to continue using the Classic Editor on […]

Reseller’s Guide to ACLs and API Tokens

Dec27
by Ike on December 27, 2018 at 7:00 pm
Posted In: Uncategorized

Several versions ago, we made some monumental changes to the way that the ACLs (access control lists) and APIs behave and the level of access they grant. These improvements allow webhosts to provide more access to resellers while maintaining security for root users and server owners. We want to take this opportunity to highlight the numerous changes that these updates bring. New Reseller Privileges Granted If you are a webhosting provider, you likely sell hosting …

 Comment 

A Brand New Tomcat is Here!

Dec26
by Ike on December 26, 2018 at 7:00 pm
Posted In: Uncategorized

In cPanel & WHM version 76, we implemented a new version of Apache Tomcat® for users that run EasyApache 4. This iteration represents a complete overhaul of our implementation and provides substantial differences from the EasyApache 3 version. The EasyApache 4 implementation of Tomcat configures a private instance for each user. This utilization increases security and allows the user to manage their Tomcat services, but increases memory use on the server. A Glimpse into the Process

 Comment 

Move Over MyDNS and NSD- Here Comes PowerDNS!

Dec20
by Ike on December 20, 2018 at 7:00 pm
Posted In: Uncategorized

One of the useful features that we offer with cPanel & WHM is the ability to run your own DNS server . The nameserver features we have provided in the past have included PowerDNS, MyDNS, BIND, and NSD. With the release of cPanel & WHM Version 78, we are deprecating NSD and MyDNS. New installations of cPanel & WHM version 78 will not allow you to select the NSD or MyDNS nameservers. Our long-term …

 Comment 

WordPress 5.0.2 Maintenance Release

Dec19
by Ike on December 19, 2018 at 11:47 pm
Posted In: Uncategorized

WordPress 5.0.2 is now available! 5.0.2 is a maintenance release that addresses 73 bugs. The primary focus of this release was performance improvements in the block editor: the cumulated performance gains make it 330% faster for a post with 200 blocks. Here are a few of the additional highlights: 45 total Block Editor improvements are […]

60 queries. 8.75 mb Memory usage. 1.335 seconds.