michael_s's blog

A serious security vulnerability has been discovered in osCMax v2.0.3 and all prior versions. It is important that you follow the below instructions carefully to secure your site. Failure to do so could result in your site being breached by attack.

The following files must be removed from your site's administrative panel folder:

/admin/file_manager.php

Over the last week I have been releasing a few mods that I converted to osCMax format. They are all very useful mods, and add a ton of features to osCMax

osCMax v2.0.2 has been released. This is a bugfix release and it is recommended that you update to this new version.

 

A bug fix package was released a couple days ago. If you missed the announcement, grab the fixed file from the bugtracker here:

Bug 282

 

Just one template file is affected, so be sure to get the fix. The main osCMax download V2.0.1 already has this fixed. 

osCMax v2.0.0

The release is now official, get your osCMax 2.0 Stable download today:

http://www.oscmax.com/project/osCMax

 

Finally, osCMax 2.0 RC4 is here, with hundreds of improvements, upgrades, patches and updates. There was so much to do from RC3 to RC4 that it was a sometimes a daunting task to keep at it.

 

For a list of changes and download link, check out the release announcement here:

An XSS security flaw has been found in osCMax, specifically the printable catalog module. The flaw is in all 2.0 versions, including RC3, RC3.0.1, RC3.0.2, and RC4 SVN.

 

A security hole was found in osCMax 2.0 RC 3.0.1 that allows a remote attacker to upload files to your site via a browser.