Date: Tue, 14 Apr 2015 16:07:10 +0200 From: "Hannes Trunde" <hannes.trunde@...il.com> To: <oss-security@...ts.openwall.com> Subject: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1 Hi, during a research I found 3 SQL injection vulnerabilities in 3 different WordPress plugins and wanted to ask for CVE assignments for them. I've already contacted the WordPress.org team and the plugin authors, who either released updates already or are working on a fix. I've also sent a mail to cve-assign@...re.org asking for instructions on how to get CVE IDs assigned to those 3 vulnerabilities but didn't get a response yet. 1) WP Community Events plugin SQL injection vulnerability Affected version: 1.3.5 (and likely all versions below) Fixed version: 1.4 Plugin URL: https://wordpress.org/plugins/community-events/ Changelog: https://wordpress.org/plugins/community-events/changelog/ 2) WP Tune Library plugin SQL injection vulnerability Affected version: 1.5.4 (and likely all versions below) Fixed version: 1.5.5 Plugin URL: https://wordpress.org/plugins/tune-library/ Changelog: https://wordpress.org/plugins/tune-library/changelog/ 3) WP Symposium plugin SQL injection vulnerability Affected version: 15.1 (and likely all versions below) Fixed version: Not yet available, author is working on a fix Plugin URL: https://wordpress.org/plugins/wp-symposium/ (still disabled by WordPress.org team) If you need any further information please let me know! Thank you very much! Hannes Trunde
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ