Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Apr 2015 16:07:10 +0200
From: "Hannes Trunde" <hannes.trunde@...il.com>
To: <oss-security@...ts.openwall.com>
Subject: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1

Hi,

during a research I found 3 SQL injection vulnerabilities in 3 different
WordPress plugins and wanted to ask for CVE assignments for them. I've
already contacted the WordPress.org team and the plugin authors, who either
released updates already or are working on a fix. I've also sent a mail to
cve-assign@...re.org asking for instructions on how to get CVE IDs assigned
to those 3 vulnerabilities but didn't get a response yet.

1) WP Community Events plugin SQL injection vulnerability
Affected version: 1.3.5 (and likely all versions below)
Fixed version: 1.4
Plugin URL: https://wordpress.org/plugins/community-events/
Changelog: https://wordpress.org/plugins/community-events/changelog/

2) WP Tune Library plugin SQL injection vulnerability
Affected version: 1.5.4 (and likely all versions below)
Fixed version: 1.5.5
Plugin URL: https://wordpress.org/plugins/tune-library/
Changelog: https://wordpress.org/plugins/tune-library/changelog/

3) WP Symposium plugin SQL injection vulnerability
Affected version: 15.1 (and likely all versions below)
Fixed version: Not yet available, author is working on a fix
Plugin URL: https://wordpress.org/plugins/wp-symposium/  (still disabled by
WordPress.org team)

If you need any further information please let me know!

Thank you very much!

Hannes Trunde




Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ