 |
Home ▼ Bookkeeping
Online ▼ Security
Audits ▼
Managed
DNS ▼
About
Order
FAQ
Acceptable Use Policy
Dynamic DNS Clients
Configure Domains Dyanmic DNS Update Password Network
Monitor ▼
Enterprise Package
Advanced Package
Standard Package
Free Trial
FAQ
Price/Feature Summary
Order/Renew
Examples
Configure/Status Alert Profiles | ||
| CVE ID: | CVE-2019-20041 |
| Description: | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring. |
| Test IDs: | 1.3.6.1.4.1.25623.1.0.126316 1.3.6.1.4.1.25623.1.0.892067 |
| Cross References: |
Common Vulnerability Exposure (CVE) ID: CVE-2019-20041 Bugtraq: 20200108 [SECURITY] [DSA 4599-1] wordpress security update (Google Search) https://seclists.org/bugtraq/2020/Jan/8 Debian Security Information: DSA-4599 (Google Search) https://www.debian.org/security/2020/dsa-4599 Debian Security Information: DSA-4677 (Google Search) https://www.debian.org/security/2020/dsa-4677 https://github.com/WordPress/wordpress-develop/commit/b1975463dd995da19bb40d3fa0786498717e3c53 https://wordpress.org/news/2019/12/wordpress-5-3-1-security-and-maintenance-release/ https://lists.debian.org/debian-lts-announce/2020/01/msg00010.html |