🔒 Update `wp_kses_bad_protocol()` to recognize `:` on uri attributes

Update `wp_kses_bad_protocol()` to recognize `:` on uri attributes

Update makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by us…

Sicherheitslücken (CVE) portal.patchman.co 14.12.2019, 18:47 Uhr 2 Min. Lesezeit

Update makes sure to validate that uri attributes don’t contain invalid/or not allowed protocols. While this works fine in most cases, there’s a risk that by using the colon html5 named entity, one is able to bypass this function.

This vulnerability affects the following application versions:

WordPress 3.5

WordPress 3.5.1

WordPress 3.5.2

WordPress 3.6

WordPress 3.6.1

WordPress 3.7

WordPress 3.7.1

WordPress 3.7.2

WordPress 3.7.3

WordPress 3.7.4

WordPress 3.7.5

WordPress 3.7.6

WordPress 3.7.7

WordPress 3.7.8

WordPress 3.7.9

WordPress 3.7.10

WordPress 3.7.11

WordPress 3.7.12

WordPress 3.7.13

WordPress 3.7.14

WordPress 3.7.15

WordPress 3.7.16

WordPress 3.7.17

WordPress 3.7.18

WordPress 3.7.19

WordPress 3.7.20

WordPress 3.7.21

WordPress 3.7.22

WordPress 3.7.23

WordPress 3.7.24

WordPress 3.7.25

WordPress 3.7.26

WordPress 3.7.27

WordPress 3.7.28

WordPress 3.7.29

WordPress 3.7.30

WordPress 3.7.31

WordPress 3.8

WordPress 3.8.1

WordPress 3.8.2

WordPress 3.8.3

WordPress 3.8.4

WordPress 3.8.5

WordPress 3.8.6

WordPress 3.8.7

WordPress 3.8.8

WordPress 3.8.9

WordPress 3.8.10

WordPress 3.8.11

WordPress 3.8.12

WordPress 3.8.13

WordPress 3.8.14

WordPress 3.8.15

WordPress 3.8.16

WordPress 3.8.17

WordPress 3.8.18

WordPress 3.8.19

WordPress 3.8.20

WordPress 3.8.21

WordPress 3.8.22

WordPress 3.8.23

WordPress 3.8.24

WordPress 3.8.25

WordPress 3.8.26

WordPress 3.8.27

WordPress 3.8.28

WordPress 3.8.29

WordPress 3.8.30

WordPress 3.8.31

WordPress 3.9

WordPress 3.9.1

WordPress 3.9.2

WordPress 3.9.3

WordPress 3.9.4

WordPress 3.9.5

WordPress 3.9.6

WordPress 3.9.7

WordPress 3.9.8

WordPress 3.9.9

WordPress 3.9.10

WordPress 3.9.11

WordPress 3.9.12

WordPress 3.9.13

WordPress 3.9.14

WordPress 3.9.15

WordPress 3.9.16

WordPress 3.9.17

WordPress 3.9.18

WordPress 3.9.19

WordPress 3.9.20

WordPress 3.9.21

WordPress 3.9.22

WordPress 3.9.23

WordPress 3.9.24

WordPress 3.9.25

WordPress 3.9.26

WordPress 3.9.27

WordPress 3.9.28

WordPress 3.9.29

WordPress 4.0

WordPress 4.0.1

WordPress 4.0.2

WordPress 4.0.3

WordPress 4.0.4

WordPress 4.0.5

WordPress 4.0.6

WordPress 4.0.7

WordPress 4.0.8

WordPress 4.0.9

WordPress 4.0.10

WordPress 4.0.11

WordPress 4.0.12

WordPress 4.0.13

WordPress 4.0.14

WordPress 4.0.15

WordPress 4.0.16

WordPress 4.0.17

WordPress 4.0.18

WordPress 4.0.19

WordPress 4.0.20

WordPress 4.0.21

WordPress 4.0.22

WordPress 4.0.23

WordPress 4.0.24

WordPress 4.0.25

WordPress 4.0.26

WordPress 4.0.27

WordPress 4.0.28

WordPress 4.1

WordPress 4.1.1

WordPress 4.1.2

WordPress 4.1.3

WordPress 4.1.4

WordPress 4.1.5

WordPress 4.1.6

WordPress 4.1.7

WordPress 4.1.8

WordPress 4.1.9

WordPress 4.1.10

WordPress 4.1.11

WordPress 4.1.12

WordPress 4.1.13

WordPress 4.1.14

WordPress 4.1.15

WordPress 4.1.16

WordPress 4.1.17

WordPress 4.1.18

WordPress 4.1.19

WordPress 4.1.20

WordPress 4.1.21

WordPress 4.1.22

WordPress 4.1.23

WordPress 4.1.24

WordPress 4.1.25

WordPress 4.1.26

WordPress 4.1.27

WordPress 4.1.28

WordPress 4.2

WordPress 4.2.1

WordPress 4.2.10

WordPress 4.2.11

WordPress 4.2.12

WordPress 4.2.13

WordPress 4.2.14

WordPress 4.2.15

WordPress 4.2.16

WordPress 4.2.17

WordPress 4.2.18

WordPress 4.2.2

WordPress 4.2.3

WordPress 4.2.4

WordPress 4.2.5

WordPress 4.2.6

WordPress 4.2.7

WordPress 4.2.8

WordPress 4.2.9

WordPress 4.2.19

WordPress 4.2.20

WordPress 4.2.21

WordPress 4.2.22

WordPress 4.2.23

WordPress 4.2.24

WordPress 4.2.25

WordPress 4.3

WordPress 4.3.1

WordPress 4.3.2

WordPress 4.3.3

WordPress 4.3.4

WordPress 4.3.5

WordPress 4.3.6

WordPress 4.3.7

WordPress 4.3.8

WordPress 4.3.9

WordPress 4.3.10

WordPress 4.3.11

WordPress 4.3.12

WordPress 4.3.13

WordPress 4.3.14

WordPress 4.3.15

WordPress 4.3.16

WordPress 4.3.17

WordPress 4.3.18

WordPress 4.3.19

WordPress 4.3.20

WordPress 4.3.21

WordPress 4.4

WordPress 4.4.1

WordPress 4.4.2

WordPress 4.4.3

WordPress 4.4.4

WordPress 4.4.5

WordPress 4.4.6

WordPress 4.4.7

WordPress 4.4.8

WordPress 4.4.9

WordPress 4.4.10

WordPress 4.4.11

WordPress 4.4.12

WordPress 4.4.13

WordPress 4.4.14

WordPress 4.4.15

WordPress 4.4.16

WordPress 4.4.17

WordPress 4.4.18

WordPress 4.4.19

WordPress 4.4.20

WordPress 4.5

WordPress 4.5.1

WordPress 4.5.2

WordPress 4.5.3

WordPress 4.5.4

WordPress 4.5.5

WordPress 4.5.6

WordPress 4.5.7

WordPress 4.5.8

WordPress 4.5.9

WordPress 4.5.10

WordPress 4.5.11

WordPress 4.5.12

WordPress 4.5.13

WordPress 4.5.14

WordPress 4.5.15

WordPress 4.5.16

WordPress 4.5.17

WordPress 4.5.18

WordPress 4.5.19

WordPress 4.6

WordPress 4.6.1

WordPress 4.6.10

WordPress 4.6.11

WordPress 4.6.12

WordPress 4.6.13

WordPress 4.6.2

WordPress 4.6.3

WordPress 4.6.4

WordPress 4.6.5

WordPress 4.6.6

WordPress 4.6.7

WordPress 4.6.8

WordPress 4.6.9

WordPress 4.6.14

WordPress 4.6.15

WordPress 4.6.16

WordPress 4.7

WordPress 4.7.1

WordPress 4.7.2

WordPress 4.7.3

WordPress 4.7.4

WordPress 4.7.5

WordPress 4.7.6

WordPress 4.7.7

WordPress 4.7.8

WordPress 4.7.9

WordPress 4.7.10

WordPress 4.7.11

WordPress 4.7.12

WordPress 4.7.13

WordPress 4.7.14

WordPress 4.7.15

WordPress 4.8

WordPress 4.8.1

WordPress 4.8.2

WordPress 4.8.3

WordPress 4.8.4

WordPress 4.8.5

WordPress 4.8.6

WordPress 4.8.7

WordPress 4.8.8

WordPress 4.8.9

WordPress 4.8.10

WordPress 4.8.11

WordPress 4.9

WordPress 4.9.1

WordPress 4.9.10

WordPress 4.9.2

WordPress 4.9.3

WordPress 4.9.4

WordPress 4.9.5

WordPress 4.9.6

WordPress 4.9.7

WordPress 4.9.8

WordPress 4.9.9

WordPress 4.9.11

WordPress 4.9.12

WordPress 5.0

WordPress 5.0.1

WordPress 5.0.2

WordPress 5.0.3

WordPress 5.0.4

WordPress 5.0.6

WordPress 5.0.7

WordPress 5.0 Beta 1

WordPress 5.0 Beta 2

WordPress 5.0 Beta 3

WordPress 5.0 Beta 4

WordPress 5.0 RC1

WordPress 5.0 RC2

WordPress 5.0 RC3

WordPress 5.1

WordPress 5.1.1

WordPress 5.1.2

WordPress 5.1.3

WordPress 5.2

WordPress 5.2.1

WordPress 5.2.2

WordPress 5.2.3

WordPress 5.2.4

WordPress 5.2 Beta 1

WordPress 5.2 Beta 2

WordPress 5.3

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen

CVE / Incident Software MITRE ATT&CK CWE Weakness IoC

Echtzeit-Radar & Feeds

👥 Community & Social

🕒 tsecurity.de Such-Trends & Chronologie

Update `wp_kses_bad_protocol()` to recognize `:` on uri attributes

2. Cyber Threat Intelligence & Forensik

Auch interessante Nachrichten Update `wp_kses_bad_protocol()` to recognize `&colon;` on uri attributes

CVE-2022-45224 | Web-Based Student Clearance System 1.0 Admin/add-admin.php txtfullname cross site scripting (EUVD-2022-48124)

CVE-2022-45225 | Book Store Management System 1.0 /bsms_ci/index.php/book book_title cross site scripting (EUVD-2022-48125)

CVE-2022-45227 | Dragino Lora LG01 18ed40 IoT 4.3.4 Backup File /lib exposure of information through directory listing (EUVD-2022-48127)

CVE-2022-45228 | Dragino Lora LG01 18ed40 IoT 4.3.4 Logout Page cross-site request forgery (EUVD-2022-48128)

CVE-2022-45275 | oretnom23 Dynamic Transaction Queuing System 1.0 PHP File ajax.php?action=save_settings unrestricted upload (EUVD-2022-48175)

The AI Revolution Fails Without Psychological Safety For Developers: A Conversation with Erin Doyle | AI革命能否成功，取决于开发者的心理安全感——与Erin Doyle的访谈

Update `wp_kses_bad_protocol()` to recognize `:` on uri attributes

2. Cyber Threat Intelligence & Forensik

Mehr aus dieser Kategorie

Auch interessante Nachrichten Update `wp_kses_bad_protocol()` to recognize `&colon;` on uri attributes

CVE-2022-45224 | Web-Based Student Clearance System 1.0 Admin/add-admin.php txtfullname cross site scripting (EUVD-2022-48124)

CVE-2022-45225 | Book Store Management System 1.0 /bsms_ci/index.php/book book_title cross site scripting (EUVD-2022-48125)

CVE-2022-45227 | Dragino Lora LG01 18ed40 IoT 4.3.4 Backup File /lib exposure of information through directory listing (EUVD-2022-48127)

CVE-2022-45228 | Dragino Lora LG01 18ed40 IoT 4.3.4 Logout Page cross-site request forgery (EUVD-2022-48128)

CVE-2022-45275 | oretnom23 Dynamic Transaction Queuing System 1.0 PHP File ajax.php?action=save_settings unrestricted upload (EUVD-2022-48175)

The AI Revolution Fails Without Psychological Safety For Developers: A Conversation with Erin Doyle | AI革命能否成功，取决于开发者的心理安全感——与Erin Doyle的访谈

tsecurity.de App