Multiple vulnerabilies in b2evolution version: 6.11.6-stable

[sohambakore]

Hi @fplanque,

We have identified the following vulnerabilities in version 6.11.6-stable:

• Open redirect
• Multiple XSS

Please check your mail for more information.

[fplanque]

Thank you. We are fixing these vulnerabilities.

[sohambakore]

Thanks @fplanque for your quick response

[Metztli]

Re: 'Multiple XSS'
Nasty sh*t. I have recovered from backups several times already as soon as a given site is hit and wounded.

[fplanque]

All users have had a warning with auto-upgrade possibility since last Friday.

[Metztli]

I have just finished manually upgrading my last site to b2evolution 6.11.7. But

WARNING: You are running an outdated development version (6.11.7-stable-2020-05-01).

Yet other problem was neither b2evo-6.11.7 nor matter of fact b2evo-7.1.5 are shown in the download link nor in the GitHub releases section. But now I have downloaded both cloaked resource archives.

Thanks @fplanque.