Live
- Modi frustrated, afraid of invisible voters: Kharge
- SC seeks clarification from EC on functioning of EVMs
- Vijayawada: ‘People disgusted with YSRCP govt, seek change’
- EC pores over Cong’s plaint against Modi’s speech
- MyVoice: Views of our readers 25th April 2024
- Visakhapatnam: NDA government will make AP corruption-free says Rajnath Singh
- Bengaluru’s Water Future
- The inner drive to help others
- Srikakulam: Jagan cautions people against unholy alliance of TDP-BJP-JSP
- Srikakulam: Chandrababu lauds DWCRA groups
Just In
Security researchers have discovered vulnerabilities in the default installation of WordPress, leaving sites that use content management system open to attack - specifically a critical cross-site scripting vulnerability that allows anonymous users to compromise the site.
Security researchers have discovered vulnerabilities in the default installation of WordPress, leaving sites that use content management system open to attack - specifically a critical cross-site scripting vulnerability that allows anonymous users to compromise the site.
David Dede from Sucuri security research company has claimed that any WordPresstheme or plugin that runs a genericons package is at risk. Dede adds that the one of the default themes for WordPress, TwentyFifteen, as well as the JetPack plugin, use the genericons icon fonts package.
The vulnerability can allow attackers to hack into any WordPress website using the default theme and plugin if the administrator accidentally clicks on a malicious link. The genericons package comes with an insecure file that makes the site open to cross-site scripting vulnerability.
The firm on Thursday released version 4.2.2 update which is basically a security and maintenance release targeted to fix the vulnerability. The latest release addresses two security issues including updated genericons used in default themes and plugins that scan the WordPress content directory for the affected (and "nonessential") example.html file and removes it.
Dede of Sucuri tried to demystify the vulnerability and explains, "The XSS vulnerability is very simple to exploit and happens at the Document Object Model (DOM) level. DOM-Based XSS is an XSS attack wherein the attack payload is executed as a result of modifying the Document Object Model (DOM) "environment" in the victim's browser used by the original client side script, so that the client side code runs in an "unexpected" manner.
That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment."
© 2024 Hyderabad Media House Limited/The Hans India. All rights reserved. Powered by hocalwire.com