Monthly Archives: August 2015

Full Disclosure

Re: Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users (WordPress plugin)

Posted by dxw Security on Aug 12

Ah yes – sorry about that. Should indeed be 2015-08-10

I’ve corrected in our published advisory:
https://security.dxw.com/advisories/xss-in-google-analytics-by-yoast-premium-by-privileged-users/
<https://security.dxw.com/advisories/xss-in-google-analytics-by-yoast-premium-by-privileged-users/>

Thanks for letting me know
—
Duncan Stuart (@dgmstuart)

Head of Products, dxw

Exemplary web projects for the public sector

http://dxw.com/…

Full Disclosure

The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure (WordPress plugin)

Posted by dxw Security on Aug 12

Details
================
Software: OAuth2 Complete For WordPress
Version: 3.1.3
Homepage: http://wordpress.org/plugins/oauth2-provider/
Advisory report:
https://security.dxw.com/advisories/the-oauth2-complete-plugin-for-wordpress-uses-a-pseudorandom-number-generator-which-is-non-cryptographically-secure/
CVE: Awaiting assignment
CVSS: 10 (High; AV:N/AC:L/Au:N/C:C/I:C/A:C)

Description
================
The OAuth2 Complete plugin for WordPress…

Full Disclosure

Open source tool for applying Google Chrome security updates

Posted by David Leo on Aug 12

The Problem
If you are a network administrator, keeping browser updated is the first thing to do for security. Chrome is a very
good browser, but it’s a little bit complicated to answer this simple question: what is the version of the latest
stable Chrome? And for people in places such as China(no Google services), updating Chrome is not an easy task.

The Solution
The official blog of Chrome Releases contains a lot of information. Code of…

Security

Evolution in Attacks Against Cisco IOS Software Platforms

Original release date: August 12, 2015

Cisco has observed increasingly complex attacks that could allow an attacker to gain administrative access to a Cisco IOS device by installing a malicious ROMMON image. Successful exploitation using this image could allow an attacker to manipulate device behavior after the device is rebooted.

US-CERT encourages users and administrators to review the Cisco Security Activity Bulletin and apply recommendations to protect Cisco IOS devices.

This product is provided subject to this Notification and this Privacy & Use policy.