[SECURITY] Fedora 25 Update: ikiwiki-3.20170111-1.fc25

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

[SECURITY] Fedora 24 Update: ikiwiki-3.20170111-1.fc24

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

Serendipity Cross-Site Request Forgery Vulnerability

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Serendipity 2.0.5 and earlier versions of the Unexpected Events plugin or Sidebar plugin. It...

[SECURITY] Fedora 24 Update: kf5-kblog-16.08.2-1.fc24

The KBlog library can retrieve, update or create blog posts on various popu lar blogging platforms like Wordpress or Blogspot.com. The KBlog Library...

DSA-3681-2 wordpress - regression update

Bulletin has no description...

[SECURITY] [DLA 633-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb7u12 CVE ID : CVE-2015-8834 CVE-2016-4029 CVE-2016-5836 CVE-2016-6634 CVE-2016-6635 CVE-2016-7168 CVE-2016-7169 Several vulnerabilities were discovered in wordpress, a web blogging tool. The Common Vulnerabilities and Exposures project identifies the...

Debian Security Advisory DSA 3639-1 (wordpress - security update)

Several vulnerabilities were discovered in wordpress, a web blogging tool, which could allow remote attackers to compromise a site via cross-site scripting, bypass restrictions, obtain sensitive revision-history information, or mount a denial of service. OpenVAS Vulnerability Test $Id: deb3639.na...

[SECURITY] Fedora 22 Update: wordpress-4.5.3-1.fc22

Wordpress is an online publishing / weblog package that makes it very easy, almost trivial, to get information out to people on the web. Important information in /usr/share/doc/wordpress/README.fedora...

FlatPress 1.0.3 Cross Site Request Forgery / Shell Upload

FlatPress 1.0.3 CSRF Arbitrary File Upload RCE PoC function exec var command = document.getElementById"exec"; var url = "http://localhost/flatpress/fp-content/attachs/test.php?cmd="; var cmdexec = command.v...

[SECURITY] [DSA 3472-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3472-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 08, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3444-1 (wordpress - security update)

Crtc4L discovered a cross-site scripting vulnerability in wordpress, a web blogging tool, allowing a remote authenticated administrator to compromise the site. OpenVAS Vulnerability Test $Id: deb3444.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3444-1 using nvtgen 1....

Happy 13th Birthday TaoSecurity Blog

Today, 8 January 2016, is the 13th birthday of TaoSecurity Blog! This is also my 3,000th blog post. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. Kevin Mandia was my boss. Today I am starting my third year as Chief Security Strategist at...

Dotclear cross-site scripting vulnerability (CNVD-2015-06480)

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in Dotclear 2.8.0 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

[SECURITY] [DLA 294-1] wordpress security update

Package : wordpress Version : 3.6.1+dfsg-1deb6u7 CVE ID : CVE-2015-2213 CVE-2015-5622 CVE-2015-5731 CVE-2015-5732 CVE-2015-5734 Several vulnerabilities have been fixed in Wordpress, the popular blogging engine. CVE-2015-2213 SQL Injection allowed a remote attacker to compromise the site...

Debian DSA-3328-1 : wordpress - security update

Several vulnerabilities have been found in Wordpress, the popular blogging engine. - CVE-2015-3429 The file example.html in the Genericicons icon font package and twentyfifteen Wordpress theme allowed for cross site scripting. - CVE-2015-5622 The robustness of the shortcodes HTML tags filter has...

[SECURITY] Fedora 20 Update: ikiwiki-3.20150329-1.fc20

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

[SECURITY] Fedora 21 Update: ikiwiki-3.20150329-1.fc21

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

[SECURITY] Fedora 22 Update: ikiwiki-3.20150329-1.fc22

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

Debian DSA-3227-1 : movabletype-opensource - security update

John Lightsey discovered a format string injection vulnerability in the localisation of templates in Movable Type, a blogging system. An unauthenticated remote attacker could take advantage of this flaw to execute arbitrary code as the web server user. %NASLMINLEVEL 70300 C Tenable Network...

WordPress Foxypress uploadify.php Arbitrary Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution', 'Description' = %q This module exploits an arbitrary PHP code...