full-disclosure - Re: A question for the list - WordPress plugin inspections

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140219192748.GB9364@hunt>
Date: Wed, 19 Feb 2014 11:27:48 -0800
From: Seth Arnold <seth.arnold@...onical.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: A question for the list - WordPress plugin
 inspections

On Wed, Feb 19, 2014 at 06:40:51PM +0000, Harry Metcalfe wrote:
> We write and publish light-touch inspections of WordPress plugins
> that we do for our clients. They are just a guide - we conduct some
> basic checks, not a thorough review.
> 
> Would plugins which fail this inspection be of general interest to
> the list and therefore worth posting, as we would a vulnerability?
> 
> Here's an example report:
> 
>   https://security.dxw.com/plugins/gd-star-rating-1-9-22/
> 
> Grateful for a steer...

That's a very nice summary view, but it'd be more useful in this medium
if you included the lines of code that introduce the vulnerabilities.

Most useful would be to coordinate with authors and MITRE for CVE numbers
for the issues you find to ensure the issues aren't forgotten about or
otherwise ignored.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/