[20120102] – Core – XSS Vulnerability

Jan23
by Ike on January 23, 2012 at 9:45 am
Posted In: CMS, Core Security, Joomla, security
  • Project: Joomla!
  • SubProject: All
  • Severity: Moderate
  • Versions: 1.7.3 and all earlier 1.7 and 1.6 versions
  • Exploit type: XSS Vulnerability
  • Reported Date: 2011-November-16
  • Fixed Date: 2012-January-24

Description

Inadequate filtering leads to XSS vulnerability.

Affected Installs

Joomla! version 1.7.3 and all earlier versions

Solution

Upgrade to version 1.7.4 or 2.5.0 or higher

Reported by Ankita Kapadia

Contact

The JSST at the Joomla! Security Center.

└ Tags:
 Comment 

[20120101] – Core – Information Disclosure

Jan23
by Ike on January 23, 2012 at 9:45 am
Posted In: CMS, Core Security, Joomla, security
  • Project: Joomla!
  • SubProject: All
  • Severity: Low
  • Versions: 1.7.3 and all earlier 1.7 and 1.6 versions
  • Exploit type: Information Disclosure
  • Reported Date: 2012-January-07
  • Fixed Date: 2012-January-24

Description

Inadequate filtering leads to information disclosure.

Affected Installs

Joomla! version 1.7.3 and all earlier versions

Solution

Upgrade to version 1.7.4 or 2.5.0 or higher

Reported by Erwan Peton – Intrinsec

Contact

The JSST at the Joomla! Security Center.

└ Tags:
 Comment 

Plesk Panel 10.4.4 MU#13 for Linux and Windows

Jan19
by Ike on January 19, 2012 at 10:51 am
Posted In: Plesk, Releases

New feature has been added:
[+] (Windows only) Support of PHP 5.3 has been added. More details in article http://kb.parallels.com/en/113179

The following bugs have been fixed:
[-] Cross-site scripting in health monitor
[-] Web presence Builder has session identifier without HttpOnly flag
[-] Synchronization of subscription with Service Plan doesn’t work if Service Plan has disabled webhosting
[-] (Linux only) Licence key update failures aren’t logged
[-] (Linux only) Receiving DrWeb license key doesn’t work
[-] (Windows only) Cannot create MSSQL database if MySQL databases limit is 0
[-] (Windows only) Health Monitor fails to create configuraion files on Turkish Windows

└ Tags: ,
 Comment 

cPanel Releases Fixes for cPanel & WHM 11.30

Jan19
by Ike on January 19, 2012 at 12:15 am
Posted In: Apache, CMS, Community, cPanel, Events, Releases, security, System

The newest cPanel & WHM release, 11.30.5.6, improves Google Chrome support.

This update for cPanel & WHM resolves an issue with handling form submissions by newer versions of Google Chrome. The error affected file uploads in the cPanel File Manager for Chrome users.

cPanel & WHM 11.30.5.6 also corrects an issue with setting the eximstats database password on new installs.

We strongly recommend that all server admins update their cPanel & WHM servers immediately.

To update cPanel & WHM manually:

  1. Log into WHM as the root user.
  2. Click on the WHM 11.30.X (build X) link on the top right corner of the screen.
  3. Click the button labeled Click to Upgrade.

update1.png
update2.png

For More information on these issues, please visit the cPanel & WHM 11.30 Change Log.

└ Tags: , ,
 Comment 

Parallels Plesk 10.4.4 MU#13

Jan18
by Ike on January 18, 2012 at 8:00 pm
Posted In: Plesk, Releases

New feature has been added:
[+] (Windows only) Support of PHP 5.3 has been added. More details in article http://kb.parallels.com/en/113179
The following bugs have been fixed:
[-] Cross-site scripting in health monitor
[-] Web presence Builder has session identifier without HttpOnly flag
[-] Synchronization of subscription with Service Plan doesn’t work if Service Plan has disabled webhosting
[-] (Linux only) Licence key update failures aren’t logged
[-] (Linux only) Receiving DrWeb license key doesn’t work
[-] (Windows only) Cannot create MSSQL database if MySQL databases limit is 0
[-] (Windows only) Health Monitor fails to create configuraion files on Turkish Windows

└ Tags: , , ,
 Comment 

50 queries. 8.75 mb Memory usage. 0.273 seconds.