Date: Thu, 26 Feb 2015 12:28:40 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: CVE request: Joomla Google Maps Plugin Hi, Akamai is currently warning of old versions of a joomla google maps plugin. Akamai advisory: http://www.stateoftheinternet.com/resources-web-security-threat-advisories-2015-joomla-reflection-attack-ddos-for-hire.html These vulns have not seen CVEs as far as I can see. They have been fixed in 3.1. This is the developers announcement: http://tech.reumer.net/Google-Maps/Documentation-of-plugin-Googlemap/security-release-3-1-of-plugin-googlemaps.html And here are some more details: http://cxsecurity.com/issue/WLB-2014020215 1 Denial of Service / reflection issue (this seems the one akamai is most concerned about) 1 XML injection 2 XSS 1 path disclosure 1 anti automation (not sure this counts as a vulnerability) I've added detection to freewvs  (which is btw a tool you might find interesting, although its functionality overlaps with a similar tool called pyfiscan and there are some preliminary plans to maybe merge the development work of the two in the future).  https://source.schokokeks.org/freewvs/ cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.