Joomla! Security News
- [20131101] Core XSS Vulnerability
- [20131102] Core XSS Vulnerability
- [20131103] Core XSS Vulnerability
[20131101] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: High
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-25
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
[20131102] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: Moderate
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-06
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact, com_weblinks, com_newsfeeds.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
[20131103] Core XSS Vulnerability in Joomla
Posted: 06 Nov 2013 10:47 AM PST
- Project: Joomla!
- SubProject: All
- Severity: Moderate
- Versions: 2.5.14 and earlier 2.5.x versions. 3.1.5 and earlier 3.x versions.
- Exploit type: XSS Vulnerability
- Reported Date: 2013-October-26
- Fixed Date: 2013-November-06
- CVE Number:
Description
Inadequate filtering leads to XSS vulnerability in com_contact.
Affected Installs
Joomla! version 2.5.14 and earlier 2.5.x versions; and version 3.1.5 and earlier 3.0.x versions.
Solution
Upgrade to version 2.5.15, 3.1.6 or 3.2.
Contact
The JSST at the Joomla! Security Center.
Reported By: Osanda Malith
Microsoft Security Bulletin: Cumulative Security Update for Internet Explorer (2862772)
This Microsoft security update resolves eleven privately reported vulnerabilities in Internet Explorer.
The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Maximum Severity Rating and Vulnerability Impact: Critical – Remote Code Execution
Restart Requirement: Requires restart
Affected Software: Microsoft Windows, Internet Explorer
Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution
This security update resolves a privately reported vulnerability in the Unicode Scripts Processor included in Microsoft Windows.
The vulnerability could allow remote code execution if a user viewed a specially crafted document or webpage with an application that supports embedded OpenType fonts.
An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Maximum Severity Rating and Vulnerability Impact: Critical – Remote Code Execution
Restart Requirement: May require restart
Affected Software: Microsoft Windows
Serious Security Warning – Windows XP
Did you know that Microsoft is stopping all support for Windows XP?
This could be a huge threat for your business, as systems running Windows XP will be out of support, so no more updates and patches will be available for your computers.
Say goodbye to security and say hello to vulnerability!
You are entitled to receive security updates until April 9 2014, after this date you will be left with an operating system that is completely obsolete from a security perspective, thus exposing your business to cyber-attacks, data theft, malware, phishing and fraudulent activities perpetrated by external attackers using your own systems.
What’s on the mind of the cybercriminal?
Did you know that cyber-criminals are purposely delaying new attacks on Windows XP? This way they can be more effective in attacking your computers once Microsoft shuts down support, so your systems will be left permanently insecure and open to exploitation. In fact you won’t even notice you have been hacked, until your network goes down, your data is leaked and you receive a call from a customer, partner or supplier inquiring as to the source of confidential information. Your competition will probably hear your name too.
Why should you care?
Unfortunately, you may be held accountable for any consequences, in addition to financial losses and a blow to your reputation as a business. Considering Microsoft operating systems (windows xp) are used by most businesses worldwide, ignoring a fundamental warning about this system becoming totally insecure in the near future cannot do much good.
Think of it as if you were doing 50,000 miles per year with your old car, running on bald tyres in mid-winter, on a road full of potholes. Would you ignore warnings from the DVLA, the car and tyre manufacturer? Your insurance would probably fail you as well. Why risk it?
Act now – you are already late!
You should consider upgrading to Windows 7 or even Windows 8 today, save time and money and most importantly, prevent your computers from being hacked into and your data leaked. If you have not yet done so, you are late, according to Microsoft: http://windows.microsoft.com/en-GB/windows/products/lifecycle
