Security Alerts for Foswiki

• Security Alert: SlideShowPlugin should be updated to version 2.1.4 or later to close a cross site scripting vulnerability. All Foswiki versions are affected but the plugin can be updated in minutes from configure or manually by downloading and replacing the plugin from SlideShowPlugin

• Security Alert: A normal user can alter topic preferences using the "Edit topic preference settings" feature and save them even though he has no privileges to edit the topic.
  • Description available in SecurityAlertCVE20104215. Only versions 1.1.0 and 1.1.1 are affected. It is fixed in Foswiki release 1.1.2 released 10 Nov 2010.

• Security Alert: Foswiki Page View Cross-Site Request Forgery (CSRF)
  • Description available in SecurityAlert-CVE-2009-1434, fixed in Foswiki release 1.0.5 and much further improved in Foswiki release 1.0.6

NOTE:	Please put any general security questions in the Support web, as support questions. New security holes found should follow the SecurityAlertProcess and any public discussion must be avoided. Ie. do not raise security reports as public bugs or support questions.