Full Disclosure mailing list archives
Re: A question for the list - WordPress plugin inspections
From: Jerome Athias <athiasjerome () gmail com>
Date: Thu, 20 Feb 2014 11:39:02 +0300
It is valuable I concur (# line of code, file names and CVE submission). I would also suggest to use common classifications (or a mapping) such as OWASP TOP10, WASC, CWE (CAPEC) for your criterias. Providing details regarding the methodology or/and tools used for the assessment would be also valuable. (i.e. Checklist, RIPS, https://labs.portcullis.co.uk/tools/wordpress-build-review-tool/ ) Thank you Best regards 2014-02-19 Seth Arnold <seth.arnold () canonical com>:
On Wed, Feb 19, 2014 at 06:40:51PM +0000, Harry Metcalfe wrote:We write and publish light-touch inspections of WordPress plugins that we do for our clients. They are just a guide - we conduct some basic checks, not a thorough review. Would plugins which fail this inspection be of general interest to the list and therefore worth posting, as we would a vulnerability? Here's an example report: https://security.dxw.com/plugins/gd-star-rating-1-9-22/ Grateful for a steer...That's a very nice summary view, but it'd be more useful in this medium if you included the lines of code that introduce the vulnerabilities. Most useful would be to coordinate with authors and MITRE for CVE numbers for the issues you find to ensure the issues aren't forgotten about or otherwise ignored. Thanks _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- A question for the list - WordPress plugin inspections Harry Metcalfe (Feb 19)
- Re: A question for the list - WordPress plugin inspections Seth Arnold (Feb 19)
- Re: A question for the list - WordPress plugin inspections Harry Metcalfe (Feb 19)
- Re: A question for the list - WordPress plugin inspections Thomas MacKenzie (Feb 19)
- Re: A question for the list - WordPress plugin inspections Henri Salo (Feb 20)
- Re: A question for the list - WordPress plugin inspections Jerome Athias (Feb 20)
- Re: A question for the list - WordPress plugin inspections Harry Metcalfe (Feb 20)
- Re: A question for the list - WordPress plugin inspections Jerome Athias (Feb 20)
- Re: A question for the list - WordPress plugin inspections Harry Metcalfe (Feb 19)
- Re: A question for the list - WordPress plugin inspections Seth Arnold (Feb 19)