札幌市内で情報システム関連の企画提案・開発・構築・運用および顧問業務を行っております

CMSの脆弱性情報

  • HOME »
  • CMSの脆弱性情報

2020年8月15日〜9月14日迄の間に1件2つの脆弱性が公表されています。

  1. JVN#40725650
    2020/08/27
    XOOPS
    SQLインジェクションの脆弱性
    https://jvn.jp/jp/JVN40725650/
    XooNIpsモジュール
  2. JVN#40725650
    2020/08/27
    XOOPS
    クロスサイトスクリプティングの脆弱性
    https://jvn.jp/jp/JVN40725650/
    XooNIpsモジュール

ちなみにWordPressに関してJVNに上がっていない情報も仕入れたので貼っておきます。こちらは2020年8月分になります。

WordPress Plugin Vulnerabilities

  • Recall Products <= 0.8 – Authenticated Cross-Site Scripting
  • Recall Products <= 0.8 – Authenticated SQL Injection
  • WP Smart CRM & Invoices FREE <= 1.8.7 – Authenticated Stored Cross-Site Scripting
  • Ceceppa Multilingua <= 1.5.17 – Authenticated Reflected Cross-Site Scripting
  • Bulk Change <= 1.0 – Authenticated Reflected Cross-Site Scripting
  • WP Floating Menu < 1.4.1 – Authenticated Reflected Cross-Site Scripting
  • Subscribe Sidebar <= 1.3.1 – Authenticated Reflected Cross-Site Scripting
  • Quiz and Survey Master < 7.0.2 – Unauthenticated Arbitrary File Upload
  • FooGallery < 1.9.25 – Authenticated Cross-Site Scripting (XSS)
  • Autoptimize < 2.7.7 – Authenticated Arbitrary File Upload
  • RSVPMaker < 7.8.2 – Unauthenticated SQL Injection
  • WooCommerce – NAB Transact < 2.1.2 – Payment Bypass
  • Contact Form – Form builder by Kali Forms < 2.1.2 – Multiple CSRF Bypass Issues
  • Contact Form – Form builder by Kali Forms < 2.1.2 – Authenticated Plugin’s Settings Change
  • Contact Form – Form builder by Kali Forms < 2.1.2 – Unauthenticated Arbitrary Post Deletion
  • Advanced Access Manager < 6.6.2 – Authenticated Information Disclosure
  • Advanced Access Manager < 6.6.2 – Authenticated Authorization Bypass and Privilege Escalation
  • Discount Rules for WooCommerce < 2.1.0 – Multiple Vulnerabilities
  • WP Customer Reviews < 3.4.3 – Multiple Unauthenticated and Low Priv Authenticated Stored XSS
  • Elegant Testimonial <= 1.1.6 – Multiple Authenticated Stored Cross-Site Scripting
  • Click to Top <= 1.2.7 – Authenticated Stored Cross-Site Scripting
  • Change WordPress Login Logo <= 1.1.4 – Authenticated Stored Cross-Site Scripting
  • Internal Links Manager <= 2.0.2 – Multiple Authenticated Stored Cross-Site Scripting
  • Fancy Lightbox < 1.0.2 – Authenticated Stored Cross-Site Scripting
  • Easy Media Download < 1.1.5 – Authenticated Stored Cross-Site Scripting
  • NextGEN Gallery Sell Photo <= 1.0.4 – Authenticated Stored Cross-Site Scripting
  • Responsive Lightbox2 < 1.0.3 – Authenticated Stored Cross-Site Scripting
  • Colorbox Lightbox <= 1.1.2 – Authenticated Stored Cross-Site Scripting
  • Sell Photo <= 1.0.5 – Authenticated Stored Cross-Site Scripting
  • Sell Media < 2.4.2 – Unauthenticated Reflected Cross-Site Scripting (XSS)
  • Quiz and Survey Master < 7.0.1 – Arbitrary File Upload
  • Quiz and Survey Master < 7.0.1 – Unauthenticated Arbitrary File Deletion
  • Ultimate Member < 2.1.7 – Unauthenticated Open Redirect
  • Very Simple Quiz – Multiple Authenticated Stored Cross-Site Scripting (XSS)
  • Admin Menu <= 1.1 – Authenticated Cross-Site Scripting (XSS)
  • Cardoza WordPress Poll <= 36 – Authenticated SQL Injection
  • Ultimate Appointment Booking & Scheduling < 1.1.10 – Authenticated Cross-Site Scripting (XSS)
  • RSS Feed Widget < 2.8.1 – Authenticated Cross-Site Scripting (XSS)
  • File Manager < 6.5 – Backup File Directory Listing
  • The Official WordPress Facebook Chat Plugin < 1.6 – Authenticated Options Change to Chat Takeover
  • CMP – Coming Soon & Maintenance < 3.8.2 – Improper Access Controls on AJAX Calls
  • Elegant Themes (Divi 3.0 – 4.5.2, Extra 2.0 – 4.5.2, Divi Builder 2.0 – 4.5.2) – Authenticated Arbitrary File Upload
  • Newsletter < 6.8.2 – Authenticated PHP Object Injection
  • Newsletter < 6.8.2 – Authenticated Cross-Site Scripting (XSS)
  • Product Input Fields for WooCommerce < 1.2.7 – Unauthenticated File Download

WordPress Theme Vulnerabilities

  • Home Villas <= 2.2 – Multiple Cross-Site Scripting Issues
  • Geo Magazine <= 2.0 – Unauthenticated Reflected XSS
  • Nova Lite < 1.3.9 – Unauthenticated Reflected Cross-Site Scripting (XSS)
  • Konzept < 2.5 – Unauthenticated Reflected XSS
  • FoodBakery < 2.0 – Unauthenticated Reflected XSS
  • Elegant Themes (Divi 3.0 – 4.5.2, Extra 2.0 – 4.5.2, Divi Builder 2.0 – 4.5.2) – Authenticated Arbitrary File Upload

結構ありますね。日々、アップデートが来ていないかの確認は必要かと思います。

前回の情報はこちら

お気軽にお問い合わせください

PAGETOP
Powered by WordPress & BizVektor Theme by Vektor,Inc. technology.