Keeping Knowledge Free for Over a Decade

Major Security Vulnerability in WordPress, Drupal Could Take Down Websites

posted onAugust 7, 2014

by l33tdawg

http://rack.3.mshcdn.com/media/ZgkyMDE0LzA4LzA2LzZhL3dwc2VjdXJpdHkuMzc5N2QucG5nCnAJdGh1bWIJOTUweDUzNCMKZQlqcGc/ea031b53/259/wp-security.jpg

Credit: http://rack.3.mshcdn.com/media/ZgkyMDE0LzA4LzA2LzZhL3dwc2VjdXJpdHkuMzc5N2QucG5nCnAJdGh1bWIJOTUweDUzNCMKZQlqcGc/ea031b53/259/wp-security.jpg

If your website runs on a self-hosted WordPress installation or on Drupal, update your software now.

Nir Goldshlager, a security researcher from Salesforce.com's product security team, has discovered an XML vulnerability that impacts the popular website platforms WordPress and Drupal.

The vulnerability uses a well-known XML Quadratic Blowup Attack — and when executed, it can take down an entire website or server almost instantly. The XML vulnerability Goldshlager discovered affects WordPress versions 3.5 to 3.9 (the current version) and works on the default installation. It affects Drupal versions 6.x to 7.x (the latest version) and also works on the default installation.

Source

Tags

Wordpress Drupal Security

You May Also Like

Recent News

Friday, November 29th

North Korean hackers posing as IT workers steal over $1B in cyberattack

OpenAI is at war with its own Sora video testers following brief public leak

Found on VirusTotal: The world’s first UEFI bootkit for Linux

Tuesday, November 19th

CISA Director Jen Easterly, in Place Since 2021, to Step Down

Korea extradites Russian, Vietnamese suspects linked to $16M ransomware scheme

WhatsApp: NSO Group Operates Pegasus Spyware for Customers

Friday, November 8th

North Korean hackers target cryptocurrency with malware

Man sick of crashes sues Intel for allegedly hiding CPU defects

Law enforcement operation takes down 22,000 malicious IP addresses worldwide

Friday, November 1st

Youth of today say passwords are old news, passkeys are the future

Chinese attackers accessed Canadian government networks – for five years

OpenAI launches ChatGPT with Search, taking Google head-on

Here’s the paper no one read before declaring the demise of modern cryptography

Not just ChatGPT anymore: Perplexity and Anthropic’s Claude get desktop apps

Tuesday, July 9th

China's APT40 gang is ready to attack vulns within hours or days of public release

AI-Powered Super Soldiers Are More Than Just a Pipe Dream

The president ordered a board to probe a massive Russian cyberattack. It never did.

Massive car dealer ransom attack is mostly over after 2 weeks of work-arounds

Wednesday, July 3rd

“RegreSSHion” vulnerability in OpenSSH gives attackers root on Linux

Two of the German military’s new spy satellites appear to have failed in orbit

Friday, June 28th

Indonesian Airports, Data Centres Hit By Worst Cyberattack in Years

Cisco Talos warns of wider security implications following Snowflake breach

Thursday, June 27th

I Wore Meta Ray-Bans in Montreal to Test Their AI Translation Skills. It Did Not Go Well

Researchers upend AI status quo by eliminating matrix multiplication in LLMs

YouTube tries convincing record labels to license music for AI song generator

Critical MOVEit vulnerability puts huge swaths of the Internet at severe risk

Julian Assange to plead guilty but is going home after long extradition fight

Thursday, June 13th

Hackers show off jailbroken checkm8-vulnerable iPad and Apple TV running iPadOS 18 & tvOS 18 respectively

One of the major sellers of detailed driver behavioral data is shutting down

Turkish student creates custom AI device for cheating university exam, gets arrested

Wednesday, June 12th

Chinese-Made Biometric Access System Has 24 Vulnerabilities

Apple and OpenAI currently have the most misunderstood partnership in tech

Adobe to update vague AI terms after users threaten to cancel subscriptions

China state hackers infected 20,000 Fortinet VPNs

Tuesday, June 11th

Russia Is Targeting Germany With Fake Information as Europe Votes