vulnerability / Security alerts

[yesitsme]

Dear yesitsme,

A new version of the Wordpress plugin "WooCommerce" has been released. A recent hack was found in older versions of this plugin which allows an attacker to perform an Object Injection which allows the attacker to download any file from your account with no authentication required.

Over the next 48 hours we will be making every attempt to upgrade any  "WooCommerce" plugin(s) to the most recent version (2.3.11). We strongly encourage you to check your plugin version to make sure it is on the newest version. We also recommend you update your WordPress installation(s), plugins, and themes to the most current versions to prevent any additional vulnerabilities.

To update your Wordpress and/or plugins and themes follow the steps below:

1) Login to your WordPress admin control panel and click on Dashboard (located on the left panel).
2) Click on Updates and you will be presented with a list of items that need to be updated.
3) To update the item select the item and then click on the appropriate Update button.

For more information please visit: https://blog.sucuri.net/2015/06/security-advisory-object-injection-vulnerability-in-woocommerce.html

There is currently no need to contact us, unless you need additional assistance.  You can contact us at:

[yesitsme]

Dear yesitsme,


Simple Machines Forum has released a new patch to the 2.0.x line, bringing our latest release version to 2.0.11.

This patch is a security release, which focuses on fixing a minor security vulnerability reported in the software, therefore, it is important that you install this patch in a timely manner.

If you are running version 2.0.10, you can upgrade your forum to the latest version by using the package manager. As usual, you should see the upgrade notification in the admin panel notifications and in the package manager, which will allow you to download and install the patch seamlessly.  If you don't see the notification about the upgrade patch, please run the scheduled task "Fetch Simple Machines files" from the Scheduled Tasks page (Admin > Maintenance > Scheduled Tasks > Fetch Simple Machines Files (check the "Run Now" checkbox and click the "Run Now" button)).

If you use older versions of SMF, you can upgrade directly to 2.0.11 from whatever version you are currently using by using the "full upgrade" archive from the downloads page. Be aware that using this upgrade method will require you to reinstall any customizations that you have added to your forum - so, if you are running a version in the 2.0.x series, it is recommended that you apply the successive patches instead of using the full upgrade.

You can view the change log for the latest release, as usual, on the downloads page: http://download.simplemachines.org/

If you are having problems downloading the patch from the admin panel, you can download the patch package from the upgrade patches page at http://custom.simplemachines.org/upgrades/ and install it in the package manager, as you would any other mod package.

Please refer to the Online Manual for more details about:
Upgrading: http://wiki.simplemachines.org/smf/Upgrading
Patching: http://wiki.simplemachines.org/smf/Patching


Thank you for using SMF!


Warm regards,
Simple Machines

[yesitsme]

http://arstechnica.co.uk/security/2016/10/most-serious-linux-privilege-escalation-bug-ever-is-under-active-exploit/

[yesitsme]

https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injection-technical.html

[yesitsme]

https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls

When did you get more emails GDPR or TLS V.0?

https://www.howsmyssl.com/

TLS vs SSL
Okay, last thing. The jargon around is a little funny, so let's be a little more explicit. The 'S' in "HTTPS" is the TLS protocol. When folks refer to the "TLS" they are referring to the most common of modern protocols of encrypting data across the internet. "SSL", when used by experts, refers to the older versions of these protocols. In general, people use "SSL" and "TLS" interchangeably, but that's changing towards everyone saying "TLS". "TLS" is what everyone will call it in the future, while "SSL" is the phrase everyone knows right now.

(Heck, at some point, this site will redirect to howsmytls.com instead of it redirecting here.)

[yesitsme]

If you want to verify php tls version

create file with

Code: [Select]

<?php

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://www.howsmyssl.com/a/check");
curl_setopt($ch, CURLOPT_SSLVERSION, 6);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$tlsVer = json_decode($response, true);
echo "<h1>Your TSL version is: <u>" . ( $tlsVer['tls_version'] ? $tlsVer['tls_version'] : 'no TLS support' ) . "</u></h1>";?>


[yesitsme]

https://newsroom.intel.com/editorials/protecting-our-customers-through-lifecycle-security-threats/

https://blog.digitalocean.com/a-message-about-l1tf/

[yesitsme]

https://us-cert.cisa.gov/ncas/alerts/aa20-302a

[yesitsme]

https://twitter.com/CISAgov/status/1321926809097768961