Free Republic

Commenters could cross-site script. Wordpress developer Automattic is urging users to urgently update their installations of the company's publishing platform to fix a critical vulnerability that could lead to attackers taking over entire sites. Jouko Pynnönen of security vendor Klikki.fi discovered a cross-site scripting (XSS) flaw in WordPress that allows commenters to inject Javascript into sites. When admin users check the comments to moderate them and execute the Javascript they contain attackers can gain full control of the target WordPress site through the plugin and theme editors. The vulnerability takes advantage of the TEXT data type in the MySQL database...

Friday, May 1, 2009 Summarizing Zero Day's Posts for April The following is a brief summary of all of my posts at ZDNet's Zero Day for April. You can also go through previous summaries for March, February, January, December, November, October, September, August and July, as well as subscribe to my personal RSS feed or Zero Day's main feed. Notable articles include: Google's CAPTCHA experiment and the human factor; Conficker's estimated economic cost? $9.1 billion and Twitter hit by multiple variants of XSS worm.