[20130402] – Core – Information Disclosure

Apr24
by Ike on April 24, 2013 at 5:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 2.5.9 and earlier 2.5.x versions. 3.0.3 and earlier 3.0.x versions.
  • Exploit type: Information Disclosure
  • Reported Date: 2013-March-29
  • Fixed Date: 2013-April-24
  • CVE Number: CVE-2013-3057

Description

Inadequate permission checking allows unauthorised user to see permission settings in some circumstances.

Affected Installs

Joomla! version 2.5.9 and earlier 2.5.x versions; and version 3.0.2 and earlier 3.0.x versions.

Solution

Upgrade to version 2.5.10,  3.1.0 or 3.0.4.

Contact

The JSST at the Joomla! Security Center.

Reported By: Francois Gauthier

 Comment 

[20130403] – Core – XSS Vulnerability

Apr24
by Ike on April 24, 2013 at 5:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Moderate
  • Versions: 2.5.9 and earlier 2.5.x versions. 3.0.3 and earlier 3.0.x versions.
  • Exploit type: XSS Vulnerability
  • Reported Date: 2013-March-9
  • Fixed Date: 2013-April-24
  • CVE Number: CVE-2013-3058

Description

Inadequate filtering allows possibility of XSS exploit in some circumstances.

Affected Installs

Joomla! version 2.5.9 and earlier 2.5.x versions; and version 3.0.2 and earlier 3.0.x versions.

Solution

Upgrade to version 2.5.10,  3.1.0 or 3.0.4.

Contact

The JSST at the Joomla! Security Center.

Reported By: James Kettle

 Comment 

[20130405] – Core – XSS Vulnerability

Apr24
by Ike on April 24, 2013 at 5:00 am
Posted In: Uncategorized
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 2.5.9 and earlier 2.5.x versions. 3.0.3 and earlier 3.0.x versions.
  • Exploit type: XSS Vulnerability
  • Reported Date: 2013-February-26
  • Fixed Date: 2013-April-24
  • CVE Number: CVE-2013-3059

Description

Inadequate filtering leads to XSS vulnerability in Voting plugin.

Affected Installs

Joomla! version 2.5.9 and earlier 2.5.x versions; and version 3.0.2 and earlier 3.0.x versions.

Solution

Upgrade to version 2.5.10,  3.1.0 or 3.0.4.

Contact

The JSST at the Joomla! Security Center.

Reported By: Yannick Gaultier and Jeff Channell

 Comment 

WordPress 10th Anniversary Tees

Apr23
by Ike on April 23, 2013 at 4:40 pm
Posted In: Uncategorized

WordPress 10th Anniversary logoIn honor of the upcoming 10th anniversary celebrations, we’ve put a special 10th anniversary tshirt in the swag store at cost — $10 per shirt plus shipping. They’ll be on sale at this price until the anniversary on May 27, and they’ll start shipping out the week of April 29.

Some people who are planning parties or who organize meetups are already talking about doing group orders to save on shipping costs, which is a great idea — just make sure you allow enough shipping time. If you’re not sure if the tees could make it to you in time on your side of the world, use the contact options at the bottom of the store page to ask about shipping times. If they can’t reach you in time and you want to have a local printer do some for your group, we’ll post the vector file on the wp10 site within the next week (and this post will get updated accordingly).

The shirts are available in black or silvery gray. Why silvery gray? Because of trivia: the traditional gift for 10th anniversaries is tin or aluminum. :)

Silver and Black tshirts with WordPress 10th anniversary logo on them

Debian: 2660-1: curl: exposure of sensitive infor

Apr23
by Ike on April 23, 2013 at 10:22 am
Posted In: Uncategorized

(Apr 20) Yamada Yasuharu discovered that cURL, an URL transfer library, is vulnerable to expose potentially sensitive information when doing requests across domains with matching tails. Due to a bug in the tailmatch function when matching domain names, it was possible that [More…]

 Comment 

60 queries. 8.25 mb Memory usage. 0.683 seconds.