Ike.ninja

• Project: Joomla!
• SubProject: CMS
• Impact: Moderate
• Severity: Low
• Versions: 3.7.0 through 3.8.3
• Exploit type: XSS
• Reported Date: 2018-January-20
• Fixed Date: 2018-January-30
• CVE Number: CVE-2018-6377

Description

Inadequate input filtering in com_fields leads to a XSS vulnerability in multiple field types, i.e. list, radio and checkbox.

Affected Installs

Joomla! CMS versions 3.7.0 through 3.8.3

Solution

Upgrade to version 3.8.4

Contact

The JSST at the Joomla! Security Centre.

Thousands of phishing sites have been finding homes in special hidden directories on compromised web servers. In the past month alone, over 400 new phishing sites were found hosted within directories named /.well-known/; but rather than being created by fraudsters, these special directories are already present on millions of websites. The /.well-known/ directory acts as […]

WordPress 4.9.2 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately. An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for […]

• Project: Joomla!
• SubProject: CMS
• Severity: Low
• Versions: 3.7.0 through 3.8.1
• Exploit type: Information Disclosure
• Reported Date: 2017-May-17
• Fixed Date: 2017-November-07
• CVE Number: CVE-2017-16633

Description

A logic bug in com_fields exposed read-only information about a site’s custom fields to unauthorized users.

Affected Installs

Joomla! CMS versions 3.7.0 through 3.8.1

Solution

Upgrade to version 3.8.2

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Severity: Medium
• Versions: 1.5.0 through 3.8.1
• Exploit type: Information Disclosure
• Reported Date: 2017-October-06
• Fixed Date: 2017-November-07
• CVE Number: CVE-2017-14596

Description

Inadequate escaping in the LDAP authentication plugin can result in disclosure of username and password.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.8.1

Solution

Upgrade to version 3.8.2

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Severity: Medium
• Versions: 1.5.0 through 3.7.5
• Exploit type: Information Disclosure
• Reported Date: 2017-July-27
• Fixed Date: 2017-September-19
• CVE Number: CVE-2017-14596

Description

Inadequate escaping in the LDAP authentication plugin can result into a disclosure of username and password.

Affected Installs

Joomla! CMS versions 1.5.0 through 3.7.5

Solution

Upgrade to version 3.8.0

Contact

The JSST at the Joomla! Security Centre.

97% of SSL web servers are likely to be vulnerable to POODLE, a vulnerability that can be exploited in version 3 of the SSL protocol. POODLE, in common with BEAST, allows a man-in-the-middle attacker to extract secrets from SSL sessions by forcing the victim’s browser into making many thousands of similar requests. As a result […]

A recent spate of phishing attacks has taken to using the data URI scheme for evil. Supported in most browsers, these special URIs allow the content of a phishing page to be contained entirely within the URI itself, effectively eliminating the need to host the page on a remote web server and adding an additional […]

• Project: Joomla!
• SubProject: CMS
• Severity: Moderate
• Versions: 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4
• Exploit type: Remote File Inclusion
• Reported Date: 2014-September-24
• Fixed Date: 2014-September-30
• CVE Number: CVE-2014-7228

Description

Inadequate checking allowed the potential for remote files to be executed.

Affected Installs

Joomla! CMS versions 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4

Solution

Upgrade to version 2.5.26, 3.2.6, or 3.3.5

Additional Details

Please refer to AkeebaBackup.com for additional details.

Contact

The JSST at the Joomla! Security Center.

• Project: Joomla!
• SubProject: CMS
• Severity: Moderate
• Versions: 3.2.0 through 3.2.4, 3.3.0 through 3.3.3
• Exploit type: XSS Vulnerability
• Reported Date: 2014-August-27
• Fixed Date: 2014-September-23
• CVE Number: CVE-2014-6631

Description

Inadequate escaping leads to XSS vulnerability in com_media.

Affected Installs

Joomla! CMS versions 3.2.0 through 3.2.4 and 3.3.0 through 3.3.3

Solution

Upgrade to version 3.2.5 or 3.3.4

Contact

The JSST at the Joomla! Security Center.

The first release candidate for WordPress 4.0 is now available! In RC 1, we’ve made refinements to what we’ve been working on for this release. Check out the Beta 1 announcement post for more details on those features. We hope to ship WordPress 4.0 next week, but we need your help to get there. If you […]

WordPress 3.9.2 is now available as a security release for all previous versions. We strongly encourage you to update your sites immediately. This release fixes a possible denial of service issue in PHP’s XML processing, reported by Nir Goldshlager of the Salesforce.com Product Security Team. It  was fixed by Michael Adams and Andrew Nacin of the WordPress […]

Case 93317 Summary Limited SQL injection vulnerability in LeechProtect. Security Rating cPanel has assigned a Security Level of Minor to this vulnerability. Description The LeechProtect subsystem built into cPanel & WHM systems allows a website owner to disable HTTP logins for accounts that log in from too many distinct IP …

WordPress 4.0 Beta 2 is now available for download and testing. This is software still in development, so we don’t recommend that you run it on a production site. To get the beta, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download the beta here (zip). For more of what’s new in version 4.0, check out […]

More than a week after we reported deceptive search engine ads being used in Bitcoin wallet attacks, fraudsters are still using Bing ads to trick Blockchain users into visiting phishing sites — but this time, the ads are using some crude social engineering ploys. Searching for “blockchain” on bing.com currently displays the following pair of phishing ads […]