CVE-2014-9408: Exposure of Sensitive Information to an Unauthorized Actor

Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System RTLS Controller 6.0.5-FINAL, and Activator 3 uses part of the MAC address as part of the RC4 setup key, which makes it easier for remote attackers to guess the key via a brute-force attack...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge...

CVE-2014-3547

Multiple cross-site scripting XSS vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge...

CVE-2014-3547

Multiple cross-site scripting XSS vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via an external badge...

PT-2014-5385

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.x through 2.5.6 Moodle versions 2.6.x through 2.6.3 Moodle versions 2.7.x through 2.7.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via an external badge, potentially leading to...

CVE-2014-0129

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors...

CVE-2014-0129

Moodle 2.5.x (before 2.5.5) and 2.6.x (before 2.6.2) are affected by CVE-2014-0129: badges/mybadges.php does not correctly track the user whom a badge was issued to, allowing remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors. The issue is limited to...

CVE-2014-0129: Undefined Security Weakness

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors...

PT-2014-3490

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.x through 2.5.4 Moodle versions 2.6.x through 2.6.1 Description The issue concerns the improper tracking of badge issuance to users, allowing remote authenticated users to modify the visibility of arbitrary badges...

Security changes in Opera 20 update

Security Security changes in Opera 20 update Share March 13th, 2014 We have just released a silent update of Opera 20, you would most likely not even have noticed. From a security perspective, we have made two interesting changes in this update. The first one regards what we call the badge, the...

Moodle 'external.php' 'badge' Parameter XSS

The version of Moodle installed on the remote host fails to properly sanitize user-supplied input to the 'badge' parameter of the 'external.php' script. The application also fails to properly sanitize serialized objects. An attacker can exploit these issues by crafting a URL containing a serializ...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

UBUNTU-CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

Judge Rules Against Texas Teen Who Refused to Wear SmartID Badge

In a closely watched case, a federal judge today ruled against a high school sophomore who refused to wear a student ID embedded with a radio frequency chip that tracks students’ movement on campus. The teenager, Andrea Hernandez, and her father, Steven Hernandez, sued a San Antonio school distri...

Bananadance Wiki b2.2 - Multiple Vulnerabilities

Bananadance Wiki b2.2 - Multiple Vulnerabilities Title: ====== BananaDance Wiki b2.2 - Multiple Web Vulnerabilities Date: ===== 2012-11-10 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=745 VL-ID: ===== 745 Common Vulnerability Scoring System:...

Joe Grand on the DEFCON Badge, Hacking Parking Meters and the Hazards of Security Research

Dennis Fisher talks with Joe Grand of Grand Idea Studio about the design for this year’s DEFCON badge, the secret feature he added that no one has uncovered yet and his research on hacking smart parking meters. Download SHOW NOTES: Hacking The Defcon 2009 Badge Subscribe to the Digital Undergroun...