Archive for security

987 results.

IMPORTANT: 11.30, 11.32, & 11.34 cPanel & WHM Updates Available

Dec07
by Ike on December 7, 2012 at 7:41 am
Posted In: Uncategorized

Important: New Information about cPanel & WHM 11.30, 11.32, and 11.34 Updates Now Available Summary: cPanel & WHM 11.30.7.4; 11.32.5.15; 11.34.0.11, which fixes multiple security issues, is now available for download. cPanel has rated these updates as having important security impact. Information on security ratings is available at http://go.cpanel.net/securitylevels. Description: …

 Comment 

IMPORTANT: 11.32 Security Release, cPanel & WHM

Dec06
by Ike on December 6, 2012 at 7:38 am
Posted In: Uncategorized

Important: cPanel & WHM 11.32 Security Release cPanel has released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system. cPanel has rated this update …

 Comment 

IMPORTANT: 11.30 Security Release, cPanel & WHM

Dec06
by Ike on December 6, 2012 at 7:38 am
Posted In: Uncategorized

Important: cPanel & WHM 11.30 Security Release cPanel has released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system. cPanel has rated this update …

 Comment 

WordPress 3.5 Release Candidate 3

Dec04
by Ike on December 4, 2012 at 8:37 am
Posted In: Uncategorized

The third release candidate for WordPress 3.5 is now available. We’ve made a number of changes over the last week since RC2 that we can’t wait to get into your hands. Hope you’re ready to do some testing! Final UI improvements for the new media manager, based on lots of great feedback. Show more information about […]

WordPress 3.5 Release Candidate 2

Nov29
by Ike on November 29, 2012 at 7:55 pm
Posted In: Uncategorized

The second release candidate for WordPress 3.5 is now available for download and testing. We’re still working on about a dozen remaining issues, but we hope to deliver WordPress 3.5 to your hands as early as next week. If you’d like to know what to test, visit the About page ( → About in the toolbar) and check out […]

WordPress 3.5 Release Candidate

Nov22
by Ike on November 22, 2012 at 1:35 pm
Posted In: Uncategorized

The first release candidate for WordPress 3.5 is now available. We hope to ship WordPress 3.5 in two weeks. But to do that, we need your help! If you haven’t tested 3.5 yet, there’s no time like the present. (The oft-repeated warning: Please, not on a live site, unless you’re adventurous.) Think you’ve found a […]

Chrome version of Netcraft Anti-Phishing Extension Available

Nov19
by Ike on November 19, 2012 at 3:47 pm
Posted In: Uncategorized

A version of the Netcraft Anti-Phishing Extension for the Google Chrome™ web browser is now available. The Netcraft Anti-Phishing Extension is a tool allowing easy lookup of information relating to the sites you visit and providing protection from Phishing. The Extension runs on any operating system supported by Google Chrome and displays the hosting location, […]

 Comment 

WordPress 3.5 Beta 3

Nov13
by Ike on November 13, 2012 at 4:26 am
Posted In: Uncategorized

The third beta release of WordPress 3.5 is now available for download and testing. Hey, developers! We expect to WordPress 3.5 to be ready in just a few short weeks. Please, please test your plugins and themes against beta 3. Media management has been rewritten, and we’ve taken great pains to ensure most plugins will work the […]

WordPress 3.5 Beta 2

Oct13
by Ike on October 13, 2012 at 12:02 am
Posted In: Uncategorized

Two weeks after the first beta, WordPress 3.5 Beta 2 is now available for download and testing. This is software still in development, so we don’t recommend that you run it on a production site. Set up a test site to play with the new version. To test WordPress 3.5, try the WordPress Beta Tester plugin (you’ll want “bleeding […]

[20121001] – Core – XSS Vulnerability

Oct10
by Ike on October 10, 2012 at 7:21 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 3.0.0
  • Exploit type: XSS Vulnerability
  • Reported Date: 2012-October-01
  • Fixed Date: 2012-October-09

Description

Typographical error leads to XSS vulnerability in language search component.

Affected Installs

Joomla! version 3.0.0.

Solution

Upgrade to version 3.0.1

Reported by Jeff Channell

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20130203] – Core – Information Disclosure

Oct08
by Ike on October 8, 2012 at 9:09 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 3.0.2 and earlier 3.0.x versions.
  • Exploit type: Information disclosure
  • Reported Date: 2013-January-13
  • Fixed Date: 2013-February-4
  • CVE Number: CVE-2013-1454

Description

Coding errors led to information disclosure in some situations.

Affected Installs

Joomla! version 3.0.2 and earlier 3.0.x versions.

Solution

Upgrade to version 3.0.3.

Reported by Stergios Kolios

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20121101] – Core – Clickjacking

Oct08
by Ike on October 8, 2012 at 9:09 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Moderate
  • Versions: 3.0.1 and 3.0.0.
  • Exploit type: Clickjacking vulnerability
  • Reported Date: 2012-October-15
  • Fixed Date: 2012-November-08
  • CVE Number: CVE-2012-5827

Description

Inadequate protection leads to clickjacking vulnerability.

Affected Installs

Joomla! version 3.0.1 and 3.0.0.

Solution

Upgrade to version 3.0.2

Reported by Ajay Singh Negi

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20130201] – Core – Information Disclosure

Oct08
by Ike on October 8, 2012 at 9:09 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 3.0.2 and earlier 3.0.x versions; version 2.5.8 and earlier 2.5.x versions.
  • Exploit type: Information disclosure
  • Reported Date: 2012-October-31
  • Fixed Date: 2013-February-4
  • CVE Number: CVE-2013-1453

Description

Method of encoding search terms led to possible information disclosure.

Affected Installs

Joomla! version 3.0.2 and earlier 3.0.x versions; version 2.5.8 and earlier 2.5.x versions.

Solution

Upgrade to version 3.0.3 or 2.5.9.

Reported by Egidio Romano

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20130202] – Core – Information Disclosure

Oct08
by Ike on October 8, 2012 at 9:09 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 3.0.2 and earlier 3.0.x versions.
  • Exploit type: Information disclosure
  • Reported Date: 2013-January-16
  • Fixed Date: 2013-February-4
  • CVE Number: CVE-2013-1455

Description

Undefined variable caused information disclosure in some situations.

Affected Installs

Joomla! version 3.0.2 and earlier 3.0.x versions.

Solution

Upgrade to version 3.0.3.

Reported by Mark Dexter

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20121102] – Core – Clickjacking

Oct08
by Ike on October 8, 2012 at 9:09 pm
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Moderate
  • Versions: 2.5.7 and all earlier 2.5.x versions
  • Exploit type: Clickjacking vulnerability
  • Reported Date: 2012-October-15
  • Fixed Date: 2012-November-08
  • CVE Number: CVE-2012-5827

Description

Inadequate protection leads to clickjacking vulnerability.

Affected Installs

Joomla! version 2.5.7 and all earlier 2.5.x versions.

Solution

Upgrade to version 2.5.8

Reported by Ajay Singh Negi

Contact

The JSST at the Joomla! Security Center.

 Comment 

WordPress 3.5 Beta 1 (and a bonus!)

Sep27
by Ike on September 27, 2012 at 10:37 pm
Posted In: Uncategorized

I’m excited to announce the availability of WordPress 3.5 Beta 1. This is software still in development and we really don’t recommend that you run it on a production site — set up a test site just to play with the new version. To test WordPress 3.5, try the WordPress Beta Tester plugin (you’ll want “bleeding edge nightlies”). Or you can download […]

[20120902] – Core – XSS Vulnerability

Sep14
by Ike on September 14, 2012 at 7:21 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 2.5.6 and all earlier 2.5.x versions
  • Exploit type: XSS Vulnerability
  • Reported Date: 2012-July-2
  • Fixed Date: 2012-September-13

Description

Inadequate escaping of output leads to XSS vulnerability in language switcher module.

Affected Installs

Joomla! versions 2.5.6 and all earlier 2.5.x versions

Solution

Upgrade to version 2.5.7

Reported by S. Schurtz

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20120901] – Core – XSS Vulnerability

Sep14
by Ike on September 14, 2012 at 7:21 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 2.5.6 and all earlier 2.5.x versions
  • Exploit type: XSS Vulnerability
  • Reported Date: 2012-April-30
  • Fixed Date: 2012-September-13

Description

Inadequate escaping of output leads to XSS vulnerability.

Affected Installs

Joomla! versions 2.5.6 and all earlier 2.5.x versions

Solution

Upgrade to version 2.5.7

Reported by Janek Vind and Antoine Cervoise

Contact

The JSST at the Joomla! Security Center.

 Comment 

Minimum RSA public key lengths: guidelines or rules?

Sep10
by Ike on September 10, 2012 at 12:05 pm
Posted In: Uncategorized

The length of an RSA public key gives an indication of the strength of the encryption — the shorter the public key is; the easier it is for an attacker to brute-force. An attacker, armed with a compromised private key derived from a short public key, would be able to decrypt both past and future […]

 Comment 

WordPress 3.4.2 Maintenance and Security Release

Sep06
by Ike on September 6, 2012 at 8:07 pm
Posted In: Uncategorized

WordPress 3.4.2, now available for download, is a maintenance and security release for all previous versions. After nearly 15 million downloads since 3.4 was released not three months ago, we’ve identified and fixed a number of nagging bugs, including: Fix some issues with older browsers in the administration area. Fix an issue where a theme […]

Governments and banks still using weak MD5-signed SSL certificates

Aug31
by Ike on August 31, 2012 at 1:05 pm
Posted In: Uncategorized

More than a thousand websites – including several government sites – are still using SSL certificates with weak signature algorithms.

 Comment 

Phishing on sites using SSL Certificates

Aug22
by Ike on August 22, 2012 at 2:50 pm
Posted In: Uncategorized

Over the years the Internet community has been taught that one of the key steps in protecting their personal information on the Internet is to ensure that it is entered only over an encrypted connection, perhaps by looking for the lock symbol in the browser address bar or web addresses beginning with https://. As a […]

 Comment 

Event Organizers Unite!

Jul13
by Ike on July 13, 2012 at 8:18 am
Posted In: Uncategorized

I’m happy to announce the formation of a new official contributor group within the WordPress project for the organizers of in-person events that promote WordPress. Though there are hundreds of people around the globe organizing WordCamps, WordPress meetups, hackathons, free classes and the like, since their “projects” were all happening locally there was never a […]

WordPress 3.4.1 Maintenance and Security Release

Jun27
by Ike on June 27, 2012 at 7:57 pm
Posted In: Uncategorized

WordPress 3.4.1 is now available for download. WordPress 3.4 has been a very smooth release, and copies are flying off the shelf — 3 million downloads in two weeks! This maintenance release addresses 18 bugs with version 3.4, including: Fixes an issue where a theme’s page templates were sometimes not detected. Addresses problems with some category permalink […]

[20120601] – Core – Privilege Escalation

Jun19
by Ike on June 19, 2012 at 7:21 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Medium High
  • Versions: 2.5.4 and all earlier 2.5.x versions
  • Exploit type: Privilege Escalation
  • Reported Date: 2012-April-29
  • Fixed Date: 2012-June-18

Description

Inadequate checking leads to possible user privilege escalation.

Affected Installs

Joomla! versions 2.5.4 and all earlier 2.5.x versions

Solution

Upgrade to version 2.5.5

Reported by Nils Rückmann

Contact

The JSST at the Joomla! Security Center.

 Comment 

[20120602] – Core – Information Disclosure

Jun19
by Ike on June 19, 2012 at 7:21 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 2.5.4 and all earlier 2.5.x versions
  • Exploit type: Information Disclosure
  • Reported Date: 2012-May-1
  • Fixed Date: 2012-June-18

Description

Inadequate filtering leads SQL error and information disclosure.

Affected Installs

Joomla! versions 2.5.4 and all earlier 2.5.x versions

Solution

Upgrade to version 2.5.5

Reported by Jakub Galczyk

Contact

The JSST at the Joomla! Security Center.

 Comment 

Providing the perl stack as RPMs

Jun14
by Ike on June 14, 2012 at 6:06 pm
Posted In: Uncategorized

The information in this post is about a project in motion. The final delivery may differ from what is discussed here, especially as we consider the feedback you have. Our last article discussed changing from compile-on-demand to delivery of pre-compiled…

 Comment 

WordPress 3.4 “Green”

Jun13
by Ike on June 13, 2012 at 6:42 pm
Posted In: Uncategorized

WordPress 3.4 is here and out the door. We’ve dubbed this release “Green” in honor of guitarist Grant Green whose soulful simplicity has kept many of us company during this release. This release includes significant improvements to theme customization, custom headers, Twitter embeds, and image captions — here’s a short clip with the highlights: For […]

WordPress 3.4 Release Candidate 3

Jun12
by Ike on June 12, 2012 at 12:30 am
Posted In: Uncategorized

The third release candidate for WordPress 3.4 is now available. Since RC2, we’ve fixed a few lingering issues with the new live preview feature, as well as with custom headers and backgrounds. There are no remaining issues, and we plan to release 3.4 in the coming days. But if you think you’ve found a bug, […]

WordPress 3.4 Release Candidate 2

Jun07
by Ike on June 7, 2012 at 2:48 am
Posted In: Uncategorized

The second release candidate for WordPress 3.4 is now available. Since RC1, we’ve made a few dozen final changes. Our goal is to release WordPress 3.4 early next week, so plugin and theme authors, this is likely your last chance to test your plugins and themes to find any compatibility issues before the final release. […]

60 queries. 8.75 mb Memory usage. 0.581 seconds.