[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <001301d076bc$4d9f9e60$e8dedb20$@gmail.com>
Date: Tue, 14 Apr 2015 16:07:10 +0200
From: "Hannes Trunde" <hannes.trunde@...il.com>
To: <oss-security@...ts.openwall.com>
Subject: CVE request: SQL injection vulnerability in WordPress plugins Community Events 1.3.5, Tune Library 1.5.4, WP Symposium 15.1
Hi,
during a research I found 3 SQL injection vulnerabilities in 3 different
WordPress plugins and wanted to ask for CVE assignments for them. I've
already contacted the WordPress.org team and the plugin authors, who either
released updates already or are working on a fix. I've also sent a mail to
cve-assign@...re.org asking for instructions on how to get CVE IDs assigned
to those 3 vulnerabilities but didn't get a response yet.
1) WP Community Events plugin SQL injection vulnerability
Affected version: 1.3.5 (and likely all versions below)
Fixed version: 1.4
Plugin URL: https://wordpress.org/plugins/community-events/
Changelog: https://wordpress.org/plugins/community-events/changelog/
2) WP Tune Library plugin SQL injection vulnerability
Affected version: 1.5.4 (and likely all versions below)
Fixed version: 1.5.5
Plugin URL: https://wordpress.org/plugins/tune-library/
Changelog: https://wordpress.org/plugins/tune-library/changelog/
3) WP Symposium plugin SQL injection vulnerability
Affected version: 15.1 (and likely all versions below)
Fixed version: Not yet available, author is working on a fix
Plugin URL: https://wordpress.org/plugins/wp-symposium/ (still disabled by
WordPress.org team)
If you need any further information please let me know!
Thank you very much!
Hannes Trunde
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
