Invision Power Services has released patches to address a cross-site scripting (XSS) vulnerability in IP.Gallery 4.2.1 and 5.05.
The XSS security hole is related to Shockwave Flash (SWF) file uploads.
Because SWF files allow arbitrary script to execute within the context of the site they are hosted on, we are releasing a patch today which disables SWF files from being accepted by IP.Gallery by default, the advisory published by IPS reveals.
…
Comments are closed.
