Master User, versions before 2.1.4

Versions before 2.1.4 suffered from an issue with insecure default settings, the issue affects Joomla 3.4 sites only, but users are advised by the developer to update anyway. Resolution: Update to version 2.1.4 Update notice URL:...

SS-2015-018: File upload exposure on UserForms module

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-018/...

Fedora 22 : wordpress-4.2.4-1.fc22 (2015-12235)

WordPress 4.2.4 Security and Maintenance Release WordPress 4.2.4 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. This release addresses six issues, including three cross-site scripting vulnerabilities and a...

Remote code execution in templates

More info at https://symfony.com/blog/security-release-twig-1-20-0...

Fedora 23 : wordpress-4.2.4-1.fc23 (2015-12750)

WordPress 4.2.4 Security and Maintenance Release WordPress 4.2.4 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. This release addresses six issues, including three cross-site scripting vulnerabilities and a...

Fedora 22 : asterisk-13.3.2-1.fc22 (2015-5948)

The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.28, 11.6, and 13.1 and Asterisk 1.8, 11, 12, and 13. The available security releases are released as versions 1.8.28.cert-5, 1.8.32.3, 11.6-cert11, 11.17.1, 12.8.2, 13.1-cert2, and 13.3.2. These releases are...

Fedora 22 : drupal7-feeds-2.0-0.12.alpha9.fc22 (2015-10994)

7.x-2.0-alpha9 This is a security release. People running 7.x-2.0-alpha8 or below should update. This release only contains security fixes, no additional bug fixes or features. Changes since 7.x-2.0-alpha8 : - Issue 2495145 by twistor, cashwilliams, greggles, klausi: Possible XSS in...

Kunena 4.0.2 xss resolution

This version is a security release and addresses most of the important issues that were discovered in K 4.0.1 Developer update statement http://www.kunena.org/blog/149-kunena-4-0-2-released developer @kunena did not inform VEL...

SS-2015-013: X-Forwarded-Host request hostname injection

More info at https://www.silverstripe.org/software/download/security-releases/ss-2015-013/...

FreeBSD : wordpress -- multiple vulnerabilities (505904d3-ea95-11e4-beaf-bcaec565249c)

Gary Pendergast reports : WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could...

Fedora 22 : mksh-50f-1.fc22 (2015-6558)

"R50f is a required security and bugfix release : - Add a patch marker for vendor patch versioning to mksh.1 - SECURITY: make unset HISTFILE actually work - Document some more issues with the current history code - Remove some unused code - RCSID-only sync with OpenBSD, for bogus and irrelevant...

spider random articles 1.5.0 and previous

spider random articles, all versions prior to 1.5.1 SQL Injection Version 1.5.1 is a "Security Release" and those who use Random Article version under 1.5.1 should upgrade immediately to the latest version!...

SS-2016-011: ChangePasswordForm does not check Member::canLogIn()

More info at https://www.silverstripe.org/download/security-releases/ss-2016-011/...

SS-2016-013: Member.Name is not escaped

More info at https://www.silverstripe.org/download/security-releases/ss-2016-013/...

Pods 1.4.7 <= 2.5.1.1 - Blind SQL Injection

Version/s Tested: 2.5.1.1 and previous Description: Pods is a popular custom content types and fields plugin for WordPress. In the PodsUI class, which is used to build Pods administration interfaces, the orderby SQL query is set via a GET variable, which was not properly sanitized. Technical...

Unexpected code execution in smbd.

Description All versions of Samba from 3.5.0 to 4.2.0rc4 are vulnerable to an unexpected code execution vulnerability in the smbd file server daemon. A malicious client could send packets that may set up the stack in such a way that the freeing of memory in a subsequent anonymous netlogon packet...

Fedora 20 : php-ZendFramework2-2.3.3-2.fc20 (2014-13302)

Security release - ZF2014-05, which mititages null byte poisoning of the password provided for LDAP authentication, thus prevening unauthorized LDAP binding. This corrects for unpatched versions of PHP versions 5.5.11 and below, 5.4.27 and below, and any prior releases. - ZF2014-06, which mitigat...

Fedora 21 : php-ZendFramework2-2.3.3-1.fc21 (2014-12676)

Security release - ZF2014-05, which mititages null byte poisoning of the password provided for LDAP authentication, thus prevening unauthorized LDAP binding. This corrects for unpatched versions of PHP versions 5.5.11 and below, 5.4.27 and below, and any prior releases. - ZF2014-06, which mitigat...

JDownloads

unauthorized file upload vulnerable versions: below 1.9.1.6 Joomla 2.5 and below 1.9.2.11 Joomla 3 security release announcement: http://www.jdownloads.com/index.php?option=comcontent=article=231:urgent-security-update-for-19-series=51:news Note that the developer did not inform the VEL...

Fedora 19 : php-htmlpurifier-htmlpurifier-4.6.0-1.fc19 (2014-9379)

HTML Purifier 4.6.0 is a major security release, fixing numerous bad quadratic asymptotics in HTML Purifier's core algorithms. Most users will see a decent speedup on large inputs, although small inputs may take longer. Additionally, the secure URI munging algorithm has changed to do a proper HMA...