From owner-svn-ports-head@FreeBSD.ORG Sat Apr 27 20:58:01 2013 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id C24EB94F; Sat, 27 Apr 2013 20:58:01 +0000 (UTC) (envelope-from nivit@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id B445D1A62; Sat, 27 Apr 2013 20:58:01 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r3RKw1o1062176; Sat, 27 Apr 2013 20:58:01 GMT (envelope-from nivit@svn.freebsd.org) Received: (from nivit@localhost) by svn.freebsd.org (8.14.6/8.14.5/Submit) id r3RKw1al062175; Sat, 27 Apr 2013 20:58:01 GMT (envelope-from nivit@svn.freebsd.org) Message-Id: <201304272058.r3RKw1al062175@svn.freebsd.org> From: Nicola Vitale Date: Sat, 27 Apr 2013 20:58:01 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r316694 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Apr 2013 20:58:01 -0000 Author: nivit Date: Sat Apr 27 20:58:01 2013 New Revision: 316694 URL: http://svnweb.freebsd.org/changeset/ports/316694 Log: - Document multiple XSS and DDoS vulnerabilities for Joomla! (2.5.0 <= version < 2.5.10) Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Apr 27 20:56:38 2013 (r316693) +++ head/security/vuxml/vuln.xml Sat Apr 27 20:58:01 2013 (r316694) @@ -51,6 +51,68 @@ Note: Please add new entries to the beg --> + + Joomla! -- XXS and DDoS vulnerabilities + + + joomla + 2.0.*2.5.10 + + + + +

The JSST and the Joomla! Security Center report:

+
[20130405] - Core - XSS Vulnerability
+
Inadequate filtering leads to XSS vulnerability in Voting plugin.
+

+
[20130403] - Core - XSS Vulnerability
+
Inadequate filtering allows possibility of XSS exploit in some + circumstances.
+

+
[20130402] - Core - Information Disclosure
+
Inadequate permission checking allows unauthorised user to see + permission settings in some circumstances.
+

+
[20130404] - Core - XSS Vulnerability
+
Use of old version of Flash-based file uploader leads to XSS + vulnerability.
+

+
[20130401] - Core - Privilege Escalation
+
Inadequate permission checking allows unauthorised user to delete + private messages.
+

+
[20130406] - Core - DOS Vulnerability
+
Object unserialize method leads to possible denial of service + vulnerability.
+

+
[20130407] - Core - XSS Vulnerability
+
Inadequate filtering leads to XSS vulnerability in highlighter + plugin
+

+ + + + CVE-2013-3059 + CVE-2013-3058 + CVE-2013-3057 + http://developer.joomla.org/security/83-20130404-core-xss-vulnerability.html + CVE-2013-3056 + CVE-2013-3242 + CVE-2013-3267 + + + 2013-04-24 + 2013-04-27 + + + phpMyAdmin -- Multiple security vulnerabilities