Bu başlıkta WordPress'te gelmiş geçmiş tüm açıkları bulabilirsiniz.
Eğer aralarında kullandığınız eklentiler varsa kaldırmanızı öneririm.
Ayrıca WordPressin son sürümü olan 2.5'ten uzak durmaya çalışın.
Özellikle users.php bölümünde açıklar bulunmakta. Emin olmak için 2,3 sitede zarar vermeden denemeler yaptım ve md5'lerin açığa çıktığını gördüm.
Sürümünü güncellemek isteyenler 2.6'ı beklesinler.
__________________________________________________
2008-03-31 Wordpress Plugin Download (dl_id) SQL Injection Vulnerability
2008-02-26 Wordpress Plugin Sniplets 1.1.2 (RFI/XSS/RCE) Multiple Vulnerabilities
2008-02-16 Wordpress Photo album Remote SQL Injection Vulnerability
2008-02-15 Wordpress Plugin Simple Forum 1.10-1.11 SQL Injection Vulnerability
2008-02-15 Wordpress Plugin Simple Forum 2.0-2.1 SQL Injection Vulnerability
2008-02-05 Wordpress MU < 1.3.2 active_plugins option Code Execution Exploit
2008-02-03 Wordpress Plugin st_newsletter Remote SQL Injection Vulnerability
2008-02-02 Wordpress Plugin Wordspew Remote SQL Injection Vulnerability
2008-02-02 Wordpress Plugin dmsguestbook 1.7.0 Multiple Remote Vulnerabilities
2008-01-30 Wordpress Plugin WassUp 1.4.3 (spy.php to_date) SQL Injection Exploit
2008-01-30 Wordpress Plugin Adserve 0.2 adclick.php SQL Injection Exploit
2008-01-27 Wordpress plugin fGallery 2.4.1 fimrss.php SQL Injection Vulnerability
2008-01-27 Wordpress Plugin WP-Cal 0.3 editevent.php SQL Injection Vulnerability
2008-01-19 Wordpress plugin WP-Forum 1.7.4 Remote SQL Injection Vulnerability
2008-01-06 Wordpress Plugin Wp-FileManager 1.2 Remote Upload Vulnerability
2007-12-11 Wordpress <= 2.3.1 Charset Remote SQL Injection Vulnerability
2007-12-05 Wordpress Plugin PictPress <= 0.91 Remote File Disclosure Vulnerability
2007-11-01 WordPress Plugin BackUpWordPress <= 0.4.2b RFI Vulnerability
2007-09-14 Wordpress Multiple Versions Pwnpress Exploitation Tookit (0.2pub)
2007-06-26 WordPress 2.2 (wp-app.php) Arbitrary File Upload Exploit
2007-06-06 Wordpress 2.2 (xmlrpc.php) Remote SQL Injection Exploit
2007-05-21 Wordpress 2.1.3 admin-ajax.php SQL Injection Blind Fishing Exploit
2007-05-01 Wordpress plugin myflash <= 1.00 (wppath) RFI Vulnerability
2007-05-01 Wordpress plugin wordTube <= 1.43 (wpPATH) RFI Vulnerability
2007-05-01 Wordpress plugin wp-Table <= 1.43 (inc_dir) RFI Vulnerability
2007-04-29 Wordpress Plugin myGallery <= 1.4b4 Remote File Inclusion Vulnerability
2007-04-03 Wordpress 2.1.2 (xmlrpc) Remote SQL Injection Exploit
2007-01-10 Wordpress <= 2.0.6 wp-trackback.php Remote SQL Injection Exploit
2007-01-07 Wordpress 2.0.5 Trackback UTF-7 Remote SQL Injection Exploit
2006-12-30 Enigma 2 WordPress Bridge (boarddir) Remote File Include Vulnerability
2006-05-25 WordPress <= 2.0.2 (cache) Remote Shell Injection Exploit
2005-08-10 Wordpress <= 1.5.1.3 Remote Code Execution eXploit (metasploit)
2005-08-09 Wordpress <= 1.5.1.3 Remote Code Execution 0-Day Exploit
2005-06-30 Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit
2005-06-22 WordPress <= 1.5.1.1 SQL Injection Exploit
2005-06-21 WordPress <= 1.5.1.1 "add new admin" SQL Injection Exploit
2004-10-10 WordPress Blog HTTP Splitting Vulnerability
Alıntı ( +SeNYoR+)
ordpress Açıklarını Tanıyalım --->, Güvenliğiniz için mutlaka bakın!
1
●696
- 09-06-2008, 23:59:13
