full-disclosure - Day of bugs in WordPress 2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 29 Jul 2010 23:56:34 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Day of bugs in WordPress 2

Hello Full-Disclosure!

I want to inform readers of the list about new project - Day of bugs in
WordPress 2 - which I'll conduct at 30.07.2010, which I already announced
today at my site.

After conducting of Month of Search Engines Bugs
(http://websecurity.com.ua/category/moseb/) in June 2007 and Month of Bugs
in Captchas (http://websecurity.com.ua/category/mobic/) in November 2007, I
switched to smaller and less time-consuming, but still very interesting
projects, which I called "Day of Bugs". Such as Day of bugs in WordPress in
December 2007, Day of bugs in Google Chrome (which was going for three days)
in September 2008,  Day of bugs in browsers in September 2008 and Day of
bugs in browsers 2: reloaded in October 2008. And now the time has come for
new project.

I conducted the project Day of bugs in WordPress
(http://websecurity.com.ua/1685/) at 30.12.2007 and already long time ago
planned to conduct new project, but only now found the time. In that project
I disclosed 81 vulnerabilities - these are Arbitrary file edit
(http://websecurity.com.ua/1686/), Local File Include, Directory Traversal
and Full path disclosure (http://websecurity.com.ua/1687/) vulnerabilities.
Among them there are 49 Full path disclosure, 1 Arbitrary file edit and 31
Local File Include and Directory Traversal (CVE-2008-0195, CVE-2008-0196).
If I'd decided to make not "day of bugs" but "month of bugs" (with
publishing one by one hole), then these vulnerabilities were enough for
almost three projects :-).

In project Day of bugs in WordPress 2 I'll disclose many interesting
vulnerabilities in WordPress, which I found in 2007, 2009 and 2010 (and to
which different versions of engine are affected).

Similarly to first Day of bugs in WordPress, this project will be
interesting for every user of WordPress, for developers of WordPress, for
every web developer who is using WordPress, for every one who is interesting
in WP and for security community, who can find something interesting in
these vulnerabilities and attacks on them. Like in case of first Day of bugs
in WordPress project, new project designed not only to draw attention of
WordPress community to security, but to draw attention of all web developers
to security of web applications.

After they will be published, I'll write detailed descriptions of
vulnerabilities to the mailing list.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/