Many Websites Vulnerable ImageMagick Leak

A serious vulnerability in ImageMagick , a popular software library to handle with graphics, ensures that a large number of websites are vulnerable and at risk of being hacked. In case a website allows users to upload an image and using ImageMagick, an attacker can, at worst, run arbitrary code on the Web server.

Several plug-ins for image processing depend on the ImageMagick library, such as PHP's imagick, Ruby's RMagick and paperclip and NodeJS's imagemagick. The vulnerability is called " ImageTragick received" and was discovered by security researcher Nikolay Ermishkin . According to researcher Ryan Huber, it's easy to make abuse and will exploit them for short term appear.

The prediction Huber yesterday evening did turned out to be correct, because now such exploits include published. The developers of ImageMagick have a solution available that prevents the attack. Administrators should add a few lines of code in this case a file used by ImageMagick. A security will be released this weekend.

Weather Patched Critical Vulnerability In WordPress

Administrators of WordPress sites are warned again for a critical vulnerability in the popular content management system (CMS) allowing attackers vulnerable websites and blogs can take over completely.Like the critical vulnerability of last week , it is a cross-site scripting issue could allow an attacker JavaScript can put in comments.

As a logged-in administrator to see this code gets the attacker can execute arbitrary code on the server and thus compromise the website. It is also possible to change the administrator password, create new administrative accounts or perform other actions that normally only reserved to the administrator. The problem was Sunday a Finnish security researcher Jouko pynnönen revealed.

WordPress responded to the zero day flaw with an emergency patch is available for download since yesterday. Because of the severity of the vulnerability provides administrators advised as soon as possible to version 4.2.1 upgrade. When websites that the automatic update feature of WordPress have enabled the roll-out has already started. Security firm Sucuri has an analysis of the vulnerability put online.

Critical Vulnerability In WordPress Poem

For owners of WordPress sites this week, there is an important security update released that fixes a vulnerability that could allow an attacker to take over the site completely. According to the developers of WordPress, it is a critical cross-site scripting vulnerability that allows anonymous users can compromise the website.

The leak, which was discovered by Belgian security researcher Cedric Bockhaven is present in WordPress 4.1.1 and older. In addition to these vulnerabilities are also fixed three other leaks. The impact of these leaks are less severe. The developers of WordPress report in the announcement of the update this week also for different plug-ins security updates are released."Keep everything up to date in order to stay safe," said Gary Pendergast WordPress.

Unpatched plugins and WordPress installations are in fact a major reason why attackers managed to hijack websites. As revealed in late March that thousands of WordPress websites were hacked through a leak in a popular plug-in which has long been an update is available. The hacked sites were then used to spread malware. Because of the severity of the vulnerability patched now also has the US government Readiness Team (US-CERT) issued a warning issued and advises administrators to WordPress 4.1.2 upgrade.