Hello Bugtraq! I want to inform readers of the list about new project - Day of bugs in WordPress 2 - which I'll conduct at 30.07.2010, which I already announced today at my site. After conducting of Month of Search Engines Bugs (http://websecurity.com.ua/category/moseb/) in June 2007 and Month of Bugs in Captchas (http://websecurity.com.ua/category/mobic/) in November 2007, I switched to smaller and less time-consuming, but still very interesting projects, which I called "Day of Bugs". Such as Day of bugs in WordPress in December 2007, Day of bugs in Google Chrome (which was going for three days) in September 2008, Day of bugs in browsers in September 2008 and Day of bugs in browsers 2: reloaded in October 2008. And now the time has come for new project. I conducted the project Day of bugs in WordPress (http://websecurity.com.ua/1685/) at 30.12.2007 and already long time ago planned to conduct new project, but only now found the time. In that project I disclosed 81 vulnerabilities - these are Arbitrary file edit (http://websecurity.com.ua/1686/), Local File Include, Directory Traversal and Full path disclosure (http://websecurity.com.ua/1687/) vulnerabilities. Among them there are 49 Full path disclosure, 1 Arbitrary file edit and 31 Local File Include and Directory Traversal (CVE-2008-0195, CVE-2008-0196). If I'd decided to make not "day of bugs" but "month of bugs" (with publishing one by one hole), then these vulnerabilities were enough for almost three projects :-). In project Day of bugs in WordPress 2 I'll disclose many interesting vulnerabilities in WordPress, which I found in 2007, 2009 and 2010 (and to which different versions of engine are affected). Similarly to first Day of bugs in WordPress, this project will be interesting for every user of WordPress, for developers of WordPress, for every web developer who is using WordPress, for every one who is interesting in WP and for security community, who can find something interesting in these vulnerabilities and attacks on them. Like in case of first Day of bugs in WordPress project, new project designed not only to draw attention of WordPress community to security, but to draw attention of all web developers to security of web applications. After they will be published, I'll write detailed descriptions of vulnerabilities to the mailing list. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
